SC-200 Manage a security operations environment Practice Test 17 — 15 Questions

Question 1

Your organization uses Microsoft Defender XDR. You want to ensure that all incidents with severity 'High' are automatically assigned to the 'Tier1' group and have a playbook executed. What should you use?

Accepted Answer

Automation rules in Microsoft Sentinel. Automation rules in Microsoft Sentinel allow you to automatically assign incidents to a specific group (e.g., 'Tier1') and trigger a playbook based on incident properties such as severity. This directly meets the requirement to assign 'High' severity incidents to the 'Tier1' group and execute a playbook without manual intervention.

Answer

Microsoft Defender XDR incident assignment manually by analysts

Answer

Custom analytics rules in Microsoft Sentinel

Answer

Playbooks in Microsoft Sentinel

Question 2

Your organization has deployed Microsoft Sentinel in multiple regions. You need to ensure that incidents created in one workspace are available for correlation in a central workspace. What should you implement?

Accepted Answer

Sentinel workspace manager (incident replication). Sentinel Workspace Manager (incident replication) is the correct choice because it provides native, built-in replication of incidents from multiple workspaces to a central workspace without requiring custom code or external automation. This feature ensures that incidents created in regional workspaces are automatically synchronized to a designated central workspace, enabling unified correlation and investigation across regions.

Answer

Cross-workspace queries in KQL

Answer

Automated export of incidents to central workspace using Logic Apps

Answer

Azure Lighthouse

Question 3

Your organization uses Microsoft Defender for Identity. You need to create a role that allows analysts to view security alerts but not modify them. Which built-in role should you assign?

Accepted Answer

Security Reader. The Security Reader role (D) is the correct choice because it provides read-only access to security-related features in Microsoft 365 Defender, including the ability to view security alerts from Microsoft Defender for Identity without the ability to modify or respond to them. This aligns directly with the requirement to allow analysts to view alerts but not modify them, as the role grants no write permissions to security configurations or alert states.

Answer

Security Administrator

Answer

Compliance Administrator

Answer

Global Administrator

Question 4

Which TWO actions can you perform using Microsoft Sentinel automation rules? (Select two.)

Accepted Answer

Create a task on an incident. Option A is correct because Microsoft Sentinel automation rules can create tasks on incidents. This allows you to automatically assign investigation steps or remediation actions to specific personnel, ensuring consistent incident response workflows.

Answer

Create an incident automatically

Answer

Create a new automation rule

Answer

Send an email notification

Question 5

Which THREE are valid ways to ingest data into Microsoft Sentinel? (Select three.)

Accepted Answer

Configuring Syslog using Azure Monitor Agent (AMA). Option A is correct because the Azure Monitor Agent (AMA) can collect Syslog events from Linux-based sources and forward them to a Log Analytics workspace, which is the underlying data store for Microsoft Sentinel. By configuring a Data Collection Rule (DCR) that specifies the Syslog facility and severity levels, AMA streams these logs into the Syslog table in the workspace, making them available for detection and analysis within Sentinel.

Answer

Connecting to Azure DevOps directly

Answer

Importing from Power BI datasets

Question 6

Which TWO roles in Microsoft Entra ID can manage Microsoft Defender for Cloud Apps? (Select two.)

Accepted Answer

Security Administrator. The Security Administrator role in Microsoft Entra ID has the necessary permissions to manage Microsoft Defender for Cloud Apps, including configuring policies, investigating alerts, and managing app permissions. This role is specifically designed for security-related tasks within Microsoft 365 security products, making it a correct choice for managing Defender for Cloud Apps.

Answer

Compliance Administrator

Answer

Security Reader

Answer

Application Administrator

Question 7

You are a SOC analyst at Contoso. The environment includes Microsoft Sentinel in a single workspace, Microsoft Defender XDR (including Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps), Microsoft Entra ID, and Microsoft Intune. You need to design a solution to automatically triage and respond to phishing incidents detected by Defender for Office 365. The requirements are: 1) When a phishing alert is generated with high confidence, an incident should be automatically created in Sentinel. 2) The incident should be assigned to the 'Phishing' team and have a severity of High. 3) A playbook should run that will send a Teams message to the Phishing team and also block the sender in Exchange Online. 4) The incident should be automatically closed if the playbook successfully executes. What should you do?

Accepted Answer

Enable the Microsoft 365 Defender connector to synchronize incidents, create an automation rule triggered on incident creation with conditions for 'Phishing' and high confidence, assigning to 'Phishing' team, running a playbook, and enabling auto-closure.. Option B is correct because it leverages the Microsoft 365 Defender connector to synchronize incidents from Defender for Office 365 into Microsoft Sentinel, which is the recommended approach for ingesting high-confidence phishing alerts. An automation rule triggered on incident creation with conditions for 'Phishing' and high confidence can assign the incident to the 'Phishing' team, run a playbook to send a Teams message and block the sender in Exchange Online, and enable auto-closure upon successful playbook execution.

Answer

Use the Office 365 connector to ingest alerts, then create an analytics rule to generate incidents, and use automation rules to assign and run playbooks.

Answer

Use a Logic App to continuously poll Defender for Office 365 APIs for alerts, create incidents via the Sentinel API, and assign them.

Answer

Create a custom analytics rule with KQL to detect phishing in Defender for Office 365 logs, generate incidents, and use automation rules.

Question 8

Your organization has recently deployed Microsoft Sentinel and wants to ensure that all critical Azure resources are monitored for security misconfigurations. You have already enabled Microsoft Defender for Cloud on all subscriptions. You need to configure a solution that will automatically create a Sentinel incident whenever a new security recommendation with severity 'High' is generated in Defender for Cloud. The incident should be assigned to the 'Infrastructure' team. Additionally, you want to run a playbook that will open a ticket in your IT Service Management (ITSM) tool. What should you do?

Accepted Answer

Enable the Defender for Cloud connector, then create an automation rule that triggers on incident creation from the connector, assigns to 'Infrastructure', and runs a playbook.. Option D is correct because the Defender for Cloud connector in Microsoft Sentinel ingests security recommendations and alerts as incidents. By creating an automation rule that triggers on incident creation from this connector, you can automatically assign incidents to the 'Infrastructure' team and run a playbook to open a ticket in your ITSM tool, fulfilling all requirements without custom queries or workbooks.

Answer

Use the Azure Activity connector to ingest recommendations, then create an analytics rule to generate incidents.

Answer

Enable the Defender for Cloud connector and create a workbook to monitor recommendations.

Answer

Create a custom analytics rule that queries the SecurityRecommendation table in the Log Analytics workspace.

Question 9

Your SOC team uses Microsoft Sentinel. You need to ensure that all incidents are classified and resolved within 72 hours. Currently, analysts manually update the incident status and classification. You want to automate the following: 1) If an incident is not updated within 48 hours, send a reminder to the assigned analyst via email. 2) If an incident remains open after 72 hours, automatically escalate it to the SOC manager and increase its severity. What should you implement?

Accepted Answer

Create automation rules with triggers on 'incident updated' and scheduled conditions to run playbooks for reminders and escalation.. Option B is correct because automation rules in Sentinel can be configured to trigger on a schedule (e.g., every 1 hour) and check incident properties. Using conditions on 'last update time' and 'status', you can send reminders via playbooks and escalate. Option A is wrong because analytics rules are for creating incidents, not for post-creation actions. Option C is wrong because playbooks are triggered by automation rules or alerts, not directly on a schedule for existing incidents. Option D is wrong because a separate Logic App would require custom polling, which is more complex than built-in automation rules.

Answer

Create an analytics rule that runs every hour and queries for old incidents.

Answer

Use Azure Logic Apps with a recurrence trigger to query the Sentinel API and update incidents.

Answer

Create a single playbook that runs on a schedule and checks all incidents.

Question 10

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You need to ensure that a new SOC analyst can triage incidents without being able to delete or modify analytics rules. Which role should you assign?

Accepted Answer

Microsoft Sentinel Reader. Microsoft Sentinel Reader provides read-only access to Sentinel data, including incidents, workbooks, and analytics rules, but explicitly prevents any modifications or deletions. This role is ideal for SOC analysts who need to triage incidents without altering detection configurations. Security Reader and Global Reader lack Sentinel-specific incident triage permissions, while Security Operator allows modification of incidents, which exceeds the required scope.

Answer

Security Reader

Answer

Global Reader

Answer

Security Operator

Question 11

Your organization uses Microsoft Sentinel with a workspace in the East US region. You need to reduce data ingestion costs while retaining security events for one year. You have enabled Azure Monitor Agent on all servers. What should you do?

Accepted Answer

Configure a daily ingestion cap and enable Basic Logs for the workspace.. Option B is correct because configuring a daily ingestion cap limits the total data ingested per day, directly controlling costs. Enabling Basic Logs for the workspace allows you to store security events at a lower ingestion cost while retaining them for up to one year, as Basic Logs support up to 365 days of retention by default. This combination meets the requirement to reduce costs and retain security events for one year without losing data.

Answer

Configure a daily ingestion cap and enable archiving for data older than 90 days.

Answer

Set a daily ingestion cap and convert the workspace to Auxiliary Logs.

Answer

Reduce the data retention period to 90 days and set a daily ingestion cap.

Question 12

You are configuring a Microsoft Sentinel automation rule to automatically assign incidents to a specific owner based on a custom property. Which action type should you use?

Accepted Answer

Assign owner. The 'Assign owner' action type is specifically designed to change the owner of an incident in Microsoft Sentinel. When you need to automatically assign incidents to a specific owner based on a custom property (e.g., a tag or custom field), this action directly modifies the incident's 'Owner' property. Other action types serve different purposes: 'Run playbook' executes a logic app, 'Change status' updates the incident's status (e.g., New, Active, Closed), and 'Create ticket (preview)' creates an external ticket in a connected ticketing system.

Answer

Run playbook

Answer

Change status

Answer

Create ticket (preview)

Question 13

Which TWO actions can be performed using Microsoft Sentinel automation rules? (Choose two.)

Accepted Answer

Change the severity of an incident. Automation rules in Microsoft Sentinel allow you to automate incident management tasks, including changing the severity of an incident and adding tags. These actions are part of the incident-handling workflow and can be triggered when an incident is created or updated, enabling consistent triage and enrichment without manual intervention.

Answer

Deploy a data connector

Answer

Modify a watchlist

Answer

Create a scheduled query rule

Question 14

Which TWO conditions must be met to enable Microsoft Sentinel UEBA? (Choose two.)

Accepted Answer

Microsoft Entra ID P2 licenses must be assigned to users.. Microsoft Sentinel UEBA requires the SecurityInsights solution to be installed in the Log Analytics workspace, as this solution provides the UEBA data connectors and analytics rules. Additionally, Microsoft Entra ID P2 licenses are required because UEBA relies on the identity protection and risk detection capabilities that are only available with P2 licensing, enabling the enrichment of entity behavior profiles with risk data.

Answer

KQL queries must be created for entity behavior.

Answer

Microsoft Defender XDR must be onboarded.

Answer

Azure SQL Database must be deployed.

Question 15

Which THREE permissions are required for a user to manage Microsoft Sentinel playbooks using Azure Logic Apps? (Choose three.)

Accepted Answer

Microsoft Sentinel Contributor. Microsoft Sentinel Contributor is required because it grants the necessary permissions to create, update, and delete playbooks within Microsoft Sentinel, which are built on Azure Logic Apps. This role allows the user to manage playbooks as part of the security operations environment, including assigning playbooks to automation rules and incident triggers.

Answer

Global Administrator in Microsoft Entra ID

Answer

Reader on the Logic App