SC-200 Manage a security operations environment Practice Test 18 — 15 Questions

Question 1

You are a security operations engineer for a company that uses Microsoft Defender XDR. You need to create a custom detection rule that alerts when a user performs more than 10 failed logon attempts within 5 minutes from different IP addresses. The rule should use the IdentityLogonEvents table. You have written the KQL query and now need to configure the rule settings in Microsoft 365 Defender. Which configuration should you use for the rule frequency and lookback period to minimize false positives while ensuring timely detection?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Run every 5 minutes with a 5-minute lookback.. Running every 5 minutes with a 5-minute lookback ensures the rule catches the pattern within the same window and minimizes false positives by not aggregating over longer periods. Option B is incorrect because a 1-hour lookback may capture multiple sessions. Option C is incorrect because a 24-hour run period is too coarse. Option D is incorrect because no lookback misses past events.

Answer

Run every 5 minutes with a 1-hour lookback.

Answer

Run every 1 hour with no lookback.

Answer

Run every 24 hours with a 24-hour lookback.

Question 2

Your organization uses Microsoft Sentinel and Microsoft Defender for Cloud. You need to ensure that all security alerts from Defender for Cloud are automatically ingested into Sentinel with the least latency. What should you configure?

Accepted Answer

Use the Microsoft Defender for Cloud data connector in Sentinel to stream alerts.. The Microsoft Defender for Cloud data connector in Microsoft Sentinel provides a native, direct integration that streams security alerts from Defender for Cloud into Sentinel with near-real-time latency. This connector uses the underlying Azure Resource Graph and alert APIs to push alerts automatically, eliminating the need for custom polling or additional orchestration, which ensures the least possible ingestion delay.

Answer

Configure a custom API connector in Sentinel to pull alerts from Defender for Cloud REST API every 5 minutes.

Answer

Enable continuous export in Defender for Cloud to send alerts to a Log Analytics workspace and then create a scheduled query in Sentinel.

Answer

Create a Logic App that triggers on Defender for Cloud alerts and sends them to Sentinel via the Azure Monitor HTTP Data Collector API.

Question 3

Refer to the exhibit. You have an automation rule in Microsoft Sentinel configured as shown. The rule does not trigger as expected for newly created incidents with High severity. What is the most likely cause?

Accepted Answer

The trigger type is misspelled; it should be 'Microsoft.SecurityInsights/Incident' instead of 'Microsoft.SecurityInsights/Incident'.. The automation rule's trigger type is misspelled as 'Microsoft.SecurityInsights/Incident' (with a lowercase 's' in 'SecurityInsights'), whereas the correct trigger type is 'Microsoft.SecurityInsights/Incident' (with an uppercase 'S'). This casing mismatch causes the rule to fail to trigger on new incidents, as Sentinel's automation rule engine is case-sensitive when matching trigger types.

Answer

The automation rule is disabled because 'state' is set to 'Enabled' but the rule is in a 'Disabled' state due to a missing property.

Answer

The playbookId references a Logic App in a resource group that does not exist.

Answer

The conditions use 'Equals' operator, but 'Severity' and 'Status' require 'Contains' operator.

Question 4

Your team uses Microsoft Defender XDR to manage incidents. You need to ensure that all incidents with a severity of 'High' are automatically assigned to a specific SOC analyst group. What should you configure?

Accepted Answer

Create an automation rule in Microsoft Defender XDR to automatically assign incidents.. Microsoft Defender XDR's automation rules allow you to define conditions (e.g., severity equals 'High') and actions (e.g., assign to a specific SOC analyst group) that are executed automatically when incidents are created or updated. This is the native, built-in mechanism for incident assignment without requiring external scripts, playbooks, or email-based workflows.

Answer

Set up an advanced hunting query to detect high severity incidents and send email.

Answer

Configure a playbook in Microsoft Sentinel triggered by incidents.

Answer

Use the 'New-MTPIncidentAssignment' cmdlet in a scheduled task.

Question 5

Your organization uses Microsoft Sentinel with a hybrid environment including on-premises servers and Azure VMs. You notice that some Windows events from on-premises servers are not being collected in Sentinel. Log Analytics agent is installed on all servers. Other events are collected. What should you check first?

Accepted Answer

Check the Windows Event Log collection configuration in the Log Analytics workspace data collection rules.. The issue is that specific Windows events are missing while other events are collected. This indicates that the data collection rules in the Log Analytics workspace, which define which event logs and event IDs to collect, are likely misconfigured or not applied correctly to the on-premises servers. Option A is incorrect because if the workspace key were wrong, no events would be collected. Option B is incorrect because the agent is running and sending some events, so connectivity is fine. Option C is incorrect because Azure Arc is not required for Log Analytics agent connectivity; the agent communicates directly with the workspace.

Answer

Confirm that the workspace key is correctly deployed on the servers.

Answer

Verify that the Log Analytics agent is running and has network connectivity to Azure.

Answer

Ensure that the servers are listed in the Azure Arc management pane.

Question 6

Your organization uses Microsoft Defender for Office 365. You need to create a custom alert that triggers when users receive external emails with attachments from untrusted domains. What should you configure?

Accepted Answer

Create an alert policy in Microsoft 365 Defender.. A custom alert policy in Microsoft 365 Defender can be configured to detect when users receive external emails with attachments from untrusted domains. This leverages the built-in threat detection capabilities of Defender for Office 365, allowing you to define conditions such as sender domain reputation and attachment presence, and trigger an alert when the criteria are met.

Answer

Create a mail flow rule in Exchange admin center.

Answer

Set up a conditional access policy in Microsoft Entra ID.

Answer

Configure a data sensitivity label in Microsoft Purview.

Question 7

Refer to the exhibit. You are configuring an automation rule in Microsoft Sentinel. The rule is enabled but never runs. The playbook exists and is in the same resource group. What is the most likely cause?

Accepted Answer

The trigger type is incorrect; it should be 'Microsoft.SecurityInsights/Alert'.. The exhibit shows the trigger type set to 'Microsoft.SecurityInsights/Incident', but the playbook is designed to run on alerts, not incidents. Automation rules in Microsoft Sentinel require the trigger type to match the data type the playbook expects; for alert-triggered playbooks, the trigger must be 'Microsoft.SecurityInsights/Alert'. Since the rule is enabled and the playbook exists in the same resource group, the mismatch in trigger type is the most likely reason the rule never runs.

Answer

The condition uses 'Contains' operator, but 'AlertProvider' requires 'Equals'.

Answer

The automation rule is in a 'Disabled' state.

Answer

The playbookId is missing the subscription ID.

Question 8

Your organization uses Microsoft Defender for Cloud Apps. You need to receive alerts when a user accesses a cloud app from a location that is not whitelisted. What should you configure?

Accepted Answer

Create an activity policy in Microsoft Defender for Cloud Apps.. An activity policy in Microsoft Defender for Cloud Apps monitors user activities and can trigger alerts based on specific conditions, such as access from non-whitelisted locations. This policy type evaluates activities against defined criteria (e.g., IP address ranges) and generates alerts without blocking access, which matches the requirement to receive alerts.

Answer

Create a conditional access policy in Microsoft Entra ID.

Answer

Set up a session policy in Microsoft Defender for Cloud Apps.

Answer

Configure an access policy in Microsoft Defender for Cloud Apps.

Question 9

Your SOC team uses Microsoft Sentinel incident management. You need to ensure that when an incident is created, it automatically runs a playbook to gather additional context from threat intelligence sources. What should you create?

Accepted Answer

Automation rule with a trigger on incident creation.. Microsoft Sentinel automation rules can be configured with a trigger on incident creation to automatically run a playbook. This allows the SOC team to gather additional context from threat intelligence sources without manual intervention, directly addressing the requirement to execute a playbook when an incident is created.

Answer

Workbook that queries threat intelligence.

Answer

Watchlist that maps to the incident.

Answer

Analytics rule that generates an alert.

Question 10

Your organization uses Microsoft Defender for Identity. You need to receive alerts when suspicious LDAP queries are detected. What should you configure?

Accepted Answer

Configure alert rules in Microsoft Defender for Identity.. Microsoft Defender for Identity (MDI) detects suspicious LDAP queries, such as LDAP reconnaissance or directory traversal attacks, by analyzing domain controller traffic. To receive alerts for these detections, you must configure alert rules directly within the MDI portal, which allows you to set thresholds and notification preferences for specific LDAP-related activities. Option B is correct because MDI's built-in alert rules are the mechanism for generating and delivering these security alerts.

Answer

Set up an anomaly detection policy in Microsoft Defender for Cloud Apps.

Answer

Assign the Security Administrator role in Microsoft Entra ID.

Answer

Create a custom sensitivity label in Microsoft Purview.

Question 11

Which TWO actions are valid for automation rules in Microsoft Sentinel? (Choose two.)

Accepted Answer

Change the severity of an incident.. Automation rules in Microsoft Sentinel allow you to automate incident management tasks without requiring a playbook. Changing the severity of an incident is a supported action, enabling you to adjust the priority based on custom criteria such as incident properties or enrichment data.

Answer

Delete an incident.

Answer

Add tags to an incident.

Answer

Modify an existing analytics rule.

Question 12

Which THREE components are part of Microsoft Sentinel's SOAR capabilities? (Choose three.)

Accepted Answer

Incident management. Incident management is a core SOAR component in Microsoft Sentinel because it provides the structured workflow for security analysts to triage, investigate, and respond to security incidents. It integrates with automation rules and playbooks to orchestrate response actions, enabling consistent and efficient handling of threats.

Answer

Workbooks

Answer

Watchlists

Question 13

Which TWO roles can be used to manage Microsoft Sentinel? (Choose two.)

Accepted Answer

Microsoft Sentinel Responder. Microsoft Sentinel Contributor (Option E) is a built-in Azure RBAC role that grants full permissions to create and manage Sentinel resources, including data connectors, analytics rules, and workbooks. Microsoft Sentinel Responder (Option B) is a dedicated role that allows users to manage incidents, perform investigations, and respond to threats without having full write access to the Sentinel workspace. Both roles are specifically designed for managing Microsoft Sentinel operations.

Answer

Compliance Administrator

Answer

Security Reader

Answer

Global Administrator

Question 14

Refer to the exhibit. You are creating an automation rule in Microsoft Sentinel. The rule is enabled but does not assign incidents. What is the most likely issue?

Accepted Answer

The action 'AssignIncident' is not a supported automation rule action.. The 'AssignIncident' action is not a supported action type in Microsoft Sentinel automation rules. Automation rules support only 'Run Playbook' and 'Change Status' actions; incident assignment must be done via playbooks or manually, not directly within an automation rule.

Answer

The condition 'Owner' property does not support 'Equals' operator.

Answer

The trigger type 'Microsoft.SecurityInsights/Incident' is incorrect.

Answer

The 'assignedTo' value should be a user principal name instead of an email alias.

Question 15

Your organization uses Microsoft Sentinel. You need to provide a SOC analyst with the ability to create and modify incident comments but not delete incidents. Which role should you assign?

Accepted Answer

Microsoft Sentinel Responder. The Microsoft Sentinel Responder role is designed for SOC analysts who need to manage incidents, including adding and modifying comments, but not delete incidents. Microsoft Sentinel Contributor can delete incidents, so it is too permissive. Microsoft Sentinel Reader is read-only and cannot create or modify comments. Global Administrator has full access to all resources, including the ability to delete incidents, which is excessive for this requirement.

Answer

Global Administrator

Answer

Microsoft Sentinel Contributor

Answer

Microsoft Sentinel Reader