SC-200 Manage a security operations environment Practice Test 17 — 15 Questions

Question 1

Your company uses Microsoft Defender for Cloud Apps to monitor cloud applications. You have discovered that a user is accessing a sanctioned cloud storage app from an IP address that belongs to a known malicious botnet. You need to automatically block the user's access to the app and require them to re-authenticate. You have already configured session policies in Defender for Cloud Apps. What should you do next?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure a session policy in Defender for Cloud Apps with the action 'Block' and 'Require re-authentication'.. Session policies in Defender for Cloud Apps can enforce real-time controls on sanctioned apps. By configuring a session policy with the actions 'Block' and 'Require re-authentication', you can immediately terminate the user's session and force them to re-authenticate, which effectively blocks access from the malicious IP while ensuring the user re-verifies their identity.

Answer

Create an access policy in Defender for Cloud Apps to block the user.

Answer

Create an app governance policy in Microsoft Purview to block the app.

Answer

Create a device compliance policy in Microsoft Intune to block the device.

Question 2

You are a security operations analyst for a company that uses Microsoft Sentinel. You need to ensure that incidents are automatically assigned to the appropriate team based on the incident type. Which two actions should you take?

Accepted Answer

Define custom details in the analytics rule to include the team name, then use an automation rule to assign.. Custom details in an analytics rule allow you to extract and store the team name from the incident data, and then an automation rule can use that custom detail as a condition to automatically assign the incident to the appropriate owner. This approach ensures dynamic assignment based on the incident type without requiring a playbook or manual intervention.

Answer

Modify the analytics rule to set the incident owner directly.

Answer

Create a playbook that assigns incidents based on the incident type.

Answer

Create a workbook that filters incidents by type and assigns them manually.

Question 3

Your organization uses Microsoft Defender XDR and Microsoft Sentinel. You need to ensure that high-severity incidents are automatically escalated to the on-call security engineer via Microsoft Teams. Which three components should you configure?

Accepted Answer

A playbook that uses a condition to check severity and then sends a Teams message.. A playbook in Microsoft Sentinel can contain a condition action that evaluates the incident severity. If the severity is 'High', the playbook then uses a Microsoft Teams connector to send a message to the on-call security engineer, automating the escalation process.

Answer

An analytics rule that sends a Teams message when a high-severity alert fires.

Answer

A workbook that displays high-severity incidents for manual escalation.

Question 4

You are managing a Microsoft Sentinel workspace that ingests data from multiple sources. You need to reduce the cost of log ingestion while maintaining security visibility. Which two actions should you take?

Accepted Answer

Enable analytics rules to run only on high-value data sources.. Enabling analytics rules to run only on high-value data sources reduces the volume of data that must be queried and processed, directly lowering ingestion and analytics costs while preserving security visibility on critical logs. In Microsoft Sentinel, analytics rules incur costs based on the data scanned; by scoping rules to high-value sources, you avoid unnecessary processing of low-signal data.

Answer

Remove all custom log connectors that are not used frequently.

Answer

Increase the retention period for all tables to 90 days to avoid data loss.

Answer

Use compression algorithms in Log Analytics to reduce log size.

Question 5

Your organization uses Microsoft Defender for Cloud and Microsoft Sentinel. You need to ensure that security alerts from Defender for Cloud are automatically synchronized to Sentinel and assigned to the cloud security team. Which three actions should you take?

Accepted Answer

Create an automation rule that sets the incident owner to the cloud security team.. Automation rules in Microsoft Sentinel allow you to automatically assign incident owners based on conditions such as alert severity or source connector. By creating an automation rule that sets the incident owner to the cloud security team, you ensure that every Defender for Cloud alert synchronized to Sentinel is immediately assigned to the appropriate team without manual intervention.

Answer

Manually export alerts from Defender for Cloud to Sentinel daily.

Answer

Create a playbook that periodically pulls alerts from Defender for Cloud.

Question 6

You are a security analyst at a company that uses Microsoft Sentinel. You need to create a custom analytics rule that detects failed logon attempts from multiple IP addresses within 5 minutes. Which two KQL operators should you use?

Accepted Answer

bin. The `bin` operator is correct because it groups timestamps into fixed-size time buckets (e.g., 5-minute intervals), which is essential for detecting patterns like failed logon attempts from multiple IPs within a specific time window. The `summarize` operator is correct because it aggregates data (e.g., counting distinct IP addresses) per each time bucket, enabling the rule to identify when the count exceeds a threshold.

Answer

where

Answer

project

Answer

join

Question 7

Your organization uses Microsoft Sentinel with UEBA enabled. You need to investigate a potential insider threat where a user is accessing sensitive data outside of business hours. Which three built-in UEBA entities should you review?

Accepted Answer

User account. User account (B) is correct because UEBA in Microsoft Sentinel profiles user behavior to detect anomalies such as accessing sensitive data outside business hours. The user account entity is the primary identity used to correlate activities, logon events, and data access patterns, enabling the detection of insider threats based on deviations from established baselines.

Answer

Azure subscription

Answer

Resource group

Question 8

You are configuring Microsoft Defender for Identity (MDI) in your on-premises Active Directory environment. You need to ensure that MDI can detect lateral movement attacks. Which two configurations are required?

Accepted Answer

Enable port mirroring on the domain controller switches.. Port mirroring (SPAN) on domain controller switches allows the MDI sensor to capture network traffic without being in the direct data path, enabling it to analyze authentication and authorization packets (e.g., Kerberos, NTLM) for lateral movement patterns like pass-the-hash or pass-the-ticket. Option B is correct because installing the MDI sensor directly on all domain controllers provides deep visibility into local security event logs (e.g., Event ID 4624, 4672) and Active Directory replication traffic, which is essential for detecting lateral movement attempts that use compromised credentials or privilege escalation.

Answer

Integrate with Microsoft Defender for Cloud.

Answer

Configure Azure AD Connect to sync identities.

Answer

Configure site-to-site VPN to Azure.

Question 9

You are the security operations lead for a multinational company that uses Microsoft Sentinel in a single workspace. You have recently onboarded 10 new business units, each with their own analytics rules and automation. The security team is overwhelmed by the number of low-fidelity incidents generated. You need to reduce noise without disabling critical detections. You must ensure that each business unit retains ownership of their incidents and can customize their own suppression rules. You also need centralized reporting on incident trends across all business units. You have identified that many low-fidelity alerts come from a common set of data sources. What should you do?

Accepted Answer

Create a separate analytics rule for low-fidelity alerts that uses alert suppression to group similar alerts.. Creating a separate analytics rule for low-fidelity alerts with alert suppression enabled allows you to group similar alerts into a single incident, reducing noise without disabling the underlying data connectors or critical detections. This approach preserves each business unit's ownership of their incidents and enables them to customize suppression rules via automation rules or analytics rule settings, while centralized reporting on incident trends remains intact because the workspace still ingests all alerts.

Answer

Disable the data connectors that produce the most noise.

Answer

Create an automation rule that automatically closes low-severity incidents.

Answer

Create a workbook that filters out low-severity incidents from the dashboard.

Question 10

You are a security analyst for a company that uses Microsoft Defender XDR. You receive a high-severity incident indicating that a user's device has been compromised with a remote access trojan (RAT). The incident is automatically generated by Microsoft Defender XDR. You need to contain the threat immediately while preserving forensic data. You also need to ensure that the user can continue working with minimal disruption. What should you do?

Accepted Answer

Initiate device isolation from Microsoft Defender XDR.. Initiating device isolation from Microsoft Defender XDR immediately disconnects the device from the network while preserving forensic data on the device. This contains the RAT's command-and-control communication without disrupting the user's ability to work offline, and it allows the security team to investigate the compromised device without risk of lateral movement or data exfiltration.

Answer

Restore the device from a recent backup.

Answer

Run a full antivirus scan on the device.

Answer

Reset the user's password and force a sign-out.

Question 11

You are a security operations analyst for a company that uses Microsoft Sentinel. You need to create a custom analytics rule that detects when a user account is created and then deleted within 24 hours, which could indicate a test account used for malicious purposes. The rule should only run on the SecurityEvent table. You have written the KQL query and now need to configure the rule settings. Which alert scheduling configuration should you set to minimize latency while ensuring that the rule catches the pattern?

Accepted Answer

Run query every 1 hour with a 1-hour lookback.. Running the query every 1 hour with a 1-hour lookback ensures that any account creation and deletion occurring within a 24-hour window is captured with minimal latency. The 1-hour lookback allows the rule to detect events that span across the current and previous execution windows, which is essential for catching the creation and deletion pattern without missing events due to scheduling gaps.

Answer

Run query every 24 hours with a 24-hour lookback.

Answer

Run query every 1 hour with no lookback.

Answer

Run query every 5 minutes with a 5-minute lookback.

Question 12

You are a security operations analyst for a company that uses Microsoft Sentinel and Microsoft Defender for Cloud. You have configured the Microsoft Defender for Cloud connector to stream security alerts into Sentinel. However, you notice that some alerts from Defender for Cloud are not appearing in Sentinel. You have verified that the connector is enabled and the subscription is connected. The missing alerts are of the type 'Security misconfiguration' from Azure Policy. You need to ensure all alerts appear in Sentinel. What should you do?

Accepted Answer

Enable the Defender for Cloud plan on the subscription in Azure Policy.. The 'Security misconfiguration' alerts from Azure Policy are generated only when the Defender for Cloud plan is enabled on the subscription. The Microsoft Defender for Cloud data connector streams alerts from Defender for Cloud into Sentinel, but if the Defender for Cloud plan is not enabled, those specific policy-based alerts are never generated. Enabling the Defender for Cloud plan on the subscription in Azure Policy ensures that Azure Policy evaluations produce security misconfiguration alerts, which are then ingested by the connector into Sentinel.

Answer

Create a custom analytics rule to detect misconfigurations.

Answer

Re-enable the Microsoft Defender for Cloud data connector.

Answer

Create a new Microsoft Defender for Cloud data connector for the same subscription.

Question 13

You are a security operations architect for a company that uses Microsoft Sentinel in a hybrid environment with multiple workspaces. The company has a central SOC team that needs to view incidents from all workspaces in a single pane of glass. Each workspace belongs to a different business unit and has its own retention and access policies. You need to design a solution that provides centralized incident management without duplicating data or requiring users to switch workspaces. You also need to ensure that the SOC team can perform actions on incidents across workspaces. What should you do?

Accepted Answer

Use Microsoft Sentinel incident multi-view to connect all workspaces.. Microsoft Sentinel incident multi-view allows SOC teams to view and manage incidents across multiple workspaces from a single interface without duplicating data. This feature provides a centralized pane of glass while respecting each workspace's independent retention and access policies, and it enables cross-workspace incident actions without requiring users to switch contexts.

Answer

Create a playbook that copies incidents from all workspaces to a central workspace.

Answer

Use the Microsoft Sentinel data connector to connect all workspaces to a central workspace.

Answer

Create a new Log Analytics workspace that ingests data from all workspaces via diagnostic settings.

Question 14

You are a security analyst for a company that uses Microsoft Defender for Office 365. You receive an incident indicating that a user reported a phishing email. You need to investigate the email and determine if it was delivered to other users. You also need to ensure that similar emails are blocked in the future. What should you do?

Accepted Answer

Use Threat Explorer to search for similar emails and delete them.. Threat Explorer in Microsoft Defender for Office 365 allows you to search for and take bulk action on emails matching specific criteria, such as sender, subject, or URL. By using Threat Explorer, you can identify all instances of the reported phishing email across your tenant and delete them from user mailboxes, which directly addresses the need to determine if the email was delivered to other users and to remediate it. This tool is designed for hunting and remediation, making it the correct choice for this investigation.

Answer

Submit the email to Microsoft for analysis and quarantine it.

Answer

Create a Safe Links policy to block URLs in the email.

Answer

Run a simulated phishing attack to test user awareness.

Question 15

You are a security operations analyst for a company that uses Microsoft Sentinel. You need to create a workbook that displays the top 10 most common alert types over the last 7 days. The workbook will be used by the SOC manager to identify trends. You have already created a new workbook and added a query step. Which KQL query should you use in the query step?

Accepted Answer

AlertInfo | where TimeGenerated > ago(7d) | summarize Count = count() by AlertName | top 10 by Count desc | render barchart. It uses the `summarize` operator to count alerts by `AlertName`, then `top 10 by Count desc` to return the ten most frequent alert types, and `render barchart` to visualize the data in the workbook. This directly meets the requirement to display the top 10 most common alert types over the last 7 days.

Answer

AlertInfo | where TimeGenerated > ago(7d) | project AlertName

Answer

AlertInfo | where TimeGenerated > ago(7d) | project AlertName, count()

Answer

AlertInfo | where TimeGenerated > ago(7d) | summarize count() by bin(TimeGenerated, 1d) | render timechart