SC-200 Manage a security operations environment Practice Test 18 — 15 Questions

Question 1

Which TWO are supported methods to ingest syslog data into Microsoft Sentinel?

Accepted Answer

Common Event Format (CEF) connector. The Common Event Format (CEF) connector is a supported method because it uses a syslog daemon on a Linux log collector to receive CEF-formatted syslog messages over UDP/TCP (port 514 or 25226) and forwards them to the Log Analytics workspace via the Log Analytics agent. This connector specifically parses CEF headers and maps fields to Sentinel's schema, making it a native ingestion path for security appliances like Palo Alto Networks or Fortinet.

Answer

Logstash output plugin

Answer

Azure Event Hubs

Answer

Direct Azure Monitor Agent ingestion without connector

Question 2

Your Microsoft Sentinel workspace has multiple analytics rules generating incidents. You need to ensure that when an incident is created from a specific rule, a Teams message is sent to the security team. What should you configure?

Accepted Answer

Create an automation rule that runs a playbook when the incident is created. Automation rules in Microsoft Sentinel can trigger on incident creation and execute a playbook, which can be configured to send a Teams message via a connector. This provides a native, low-code way to automate notifications without custom code or external tools.

Answer

Configure a workbook to send an email when an incident appears

Answer

Modify the incident creation rule in Microsoft 365 Defender

Answer

Add a custom analytics rule that triggers on incident creation

Question 3

A security analyst reports that a scheduled analytics rule in Microsoft Sentinel has stopped generating incidents after a recent update. The rule still runs but produces no alerts. What should you check first?

Accepted Answer

Review the rule's query logic for changes or syntax errors.. The most likely cause of a scheduled analytics rule running but producing no alerts is a change or error in the KQL query logic. Since the rule still executes, the issue is not with the rule being disabled or paused, but rather with the query failing to return results due to syntax errors, schema changes, or logic flaws introduced during the update.

Answer

Verify that the rule is enabled and not paused.

Answer

Check the entity mapping configuration for missing fields.

Answer

Ensure that the automation rule triggering the incident is still active.

Question 4

You are configuring Microsoft Defender for Cloud Apps session controls for a SharePoint site containing sensitive data. Which condition must be met to apply real-time monitoring?

Accepted Answer

Users must be configured with Conditional Access policies from Microsoft Entra ID.. Microsoft Defender for Cloud Apps session controls for SharePoint require users to be routed through the Cloud App Security proxy, which is invoked by Conditional Access policies in Microsoft Entra ID. Conditional Access app controls apply session policies to traffic when users access SharePoint, enabling real-time monitoring. The Microsoft Entra ID application proxy is designed for on-premises apps, not for SaaS apps like SharePoint Online. Therefore, the correct prerequisite is having Conditional Access policies configured.

Answer

The SharePoint site must be added as a custom app in Defender for Cloud Apps.

Answer

Users must access the site through Microsoft Entra ID application proxy.

Answer

A browser extension must be installed on all client devices.

Question 5

Your Microsoft Sentinel workspace ingests logs from multiple sources but you notice that some custom logs are missing in the Log Analytics workspace. You've confirmed that the data connectors are healthy. What is the most likely cause?

Accepted Answer

The custom log table schema does not match the incoming log format.. When data connectors are healthy but custom logs are missing, the most common cause is a schema mismatch between the custom log table definition in the Log Analytics workspace and the actual log data being sent. Microsoft Sentinel requires the custom log table's schema (columns, data types, and delimiters) to exactly match the incoming log format; otherwise, the ingestion pipeline drops the records without error. This is because the Log Analytics agent or AMA uses the table schema to parse and transform the data, and any deviation results in silent failures.

Answer

There is a time gap between log generation and ingestion.

Answer

The workspace has exceeded its daily ingestion limit.

Answer

The data connectors are not properly configured for custom log ingestion.

Question 6

You are designing an automation rule in Microsoft Sentinel that should automatically assign incidents to the appropriate analyst based on the incident type. However, the rule fails to assign correctly for some incidents. What should you verify?

Accepted Answer

The order of conditions in the automation rule; ensure more specific conditions are evaluated first.. Automation rules in Microsoft Sentinel evaluate conditions in order, and the first matching condition triggers the associated action. If a broad condition (e.g., 'all incidents') is placed before a more specific condition (e.g., 'incident type equals Phishing'), the broad rule will match first and assign incorrectly, preventing the specific rule from ever running. Reordering conditions so that the most specific ones are evaluated first ensures correct assignment based on incident type.

Answer

That a playbook has been created to perform the assignment.

Answer

That the incident assignment rule in Microsoft Entra ID is configured correctly.

Answer

That the owner (analyst) has the required permissions in Microsoft Sentinel.

Question 7

Your organization is migrating from Azure Active Directory to Microsoft Entra ID. You need to ensure that Microsoft Sentinel continues to receive identity logs. What should you do?

Accepted Answer

No action is required; the existing connector automatically updates.. The migration from Microsoft Entra ID (Azure AD) to Microsoft Entra ID is a rebranding and consolidation effort that does not change the underlying service endpoints, APIs, or log schemas. The existing Microsoft Entra ID data connector in Microsoft Sentinel continues to collect identity logs (e.g., Sign-in logs, Audit logs, Provisioning logs) without any reconfiguration because the connector is tied to the same underlying directory service. Therefore, no action is required; the existing connector automatically updates to reflect the new name.

Answer

Install the new Microsoft 365 Defender connector for identity logs.

Answer

Reconfigure the diagnostic settings to send logs to a new Log Analytics workspace.

Answer

Create a new data connector for Microsoft Entra ID.

Question 8

You have deployed Microsoft Defender for Endpoint and integrated it with Microsoft Sentinel. You notice that alerts from Defender for Endpoint are not appearing in Sentinel. What should you check first?

Accepted Answer

Verify that the Microsoft 365 Defender connector in Sentinel is enabled and configured.. The Microsoft 365 Defender connector in Microsoft Sentinel is the specific data connector responsible for ingesting alerts from Microsoft Defender for Endpoint (and other Defender products). If this connector is not enabled or misconfigured, alerts will not flow into Sentinel regardless of licensing, device onboarding, or analytics rules. This is the first and most direct check because the connector acts as the ingestion pipeline.

Answer

Confirm that Defender for Endpoint is licensed for all users.

Answer

Check that the alert severity is not being filtered out by analytics rules.

Answer

Ensure that all devices are onboarded to Defender for Endpoint.

Question 9

You are configuring an automated investigation and response (AIR) playbook in Microsoft Sentinel. The playbook should automatically block a user in Microsoft Entra ID when a high-severity incident is created. Which action should you include in the playbook?

Accepted Answer

Call the Microsoft Graph API to update the user's accountEnabled property to false.. The 'Block user' action is not available in the Microsoft Entra ID connector for Azure Logic Apps; instead, you must call the Microsoft Graph API to update the user's `accountEnabled` property to `false`. This directly disables the user account in Microsoft Entra ID, effectively blocking their access. The playbook in Microsoft Sentinel uses Azure Logic Apps, and the Graph API is the appropriate method to perform this action programmatically.

Answer

Use the 'Block user' action from the Microsoft Entra ID connector in Azure Logic Apps.

Answer

Add a 'Block IP' action from the Azure Firewall connector.

Answer

Add a 'Change incident status' action to close the incident.

Question 10

Which TWO actions can reduce the cost of Microsoft Sentinel while maintaining security coverage?

Accepted Answer

Configure some tables to use Basic Logs tier.. Configuring tables to use the Basic Logs tier reduces ingestion costs for high-volume, verbose logs (e.g., from firewalls or DNS servers) while still retaining the data for security analysis. Basic Logs are stored at a lower cost per GB but have reduced query capabilities (e.g., no interactive full-text search, limited to KQL summarization). This allows you to keep security coverage by retaining the logs for detection and investigation, albeit with a different query pattern.

Answer

Remove unused data connectors.

Answer

Switch to a pay-as-you-go workspace.

Answer

Reduce workspace retention to 30 days for all tables.

Question 11

Which THREE components are required to use Microsoft Sentinel's automation rules to automatically respond to incidents?

Accepted Answer

The appropriate permissions to run playbooks.. Automation rules require appropriate permissions (e.g., Microsoft Sentinel Contributor or Automation Contributor) to execute playbooks. Without these permissions, the automation rule cannot invoke the playbook when an incident is created or updated, even if the rule and playbook are properly configured.

Answer

A playbook created in Azure Logic Apps.

Answer

An analytics rule generating alerts.

Question 12

Which TWO Microsoft Sentinel features allow you to organize and prioritize incidents for better triage?

Accepted Answer

Incident assignment to analysts.. Incident assignment allows security operations center (SOC) analysts to take ownership of specific incidents, ensuring accountability and preventing duplicate work. This feature directly supports triage by routing incidents to the appropriate team member based on skills or workload. Option E is correct because classification and tagging let analysts categorize incidents by severity, attack type, or status, enabling efficient filtering and prioritization across the incident queue.

Answer

Entity mapping in analytics rules.

Answer

Automation rules with incident creation triggers.

Answer

Workbooks for dashboard reporting.

Question 13

Your security team receives frequent false positive alerts from Microsoft Defender for Cloud Apps. You need to reduce noise without disabling any threat detection policies. What should you do?

Accepted Answer

Configure suppression rules based on user, IP, or app to automatically dismiss matching alerts.. Suppression rules in Microsoft Defender for Cloud Apps allow you to automatically dismiss alerts that match specific criteria (e.g., user, IP address, or app) without disabling the underlying threat detection policy. This reduces false positive noise while keeping the detection engine active for genuine threats. Disabling policies or adjusting severity thresholds would either remove detection entirely or fail to address the root cause of false positives.

Answer

Disable the built-in anomaly detection policies that generate false positives.

Answer

Adjust the alert severity thresholds in the policy settings.

Answer

Create custom detection policies to override default rules.

Question 14

You are managing a Microsoft Sentinel environment. You need to ensure that incidents are automatically assigned to the appropriate analyst based on the type of attack. The assignment must consider the current workload of each analyst. What should you use?

Accepted Answer

Use an automation rule with a playbook that queries the current incident assignments and assigns to the least busy analyst.. Automation rules in Microsoft Sentinel can trigger a playbook (Azure Logic App) that queries the current incident assignments and assigns the incident to the analyst with the fewest active incidents. This satisfies both the attack-type mapping (via the analytics rule that generates the incident) and the workload-balancing requirement, as the playbook can dynamically evaluate workload using Azure Resource Graph or Sentinel's API.

Answer

Configure multiple analytics rules, each with a different incident owner.

Answer

Create a watchlist that maps attack types to analyst names and use it in an analytics rule.

Answer

Create a workbook that shows analyst workload and manually assign.

Question 15

Your organization uses Microsoft Defender XDR. You need to ensure that all cloud app alerts are forwarded to Microsoft Sentinel for correlation. What should you configure?

Accepted Answer

In Microsoft Sentinel, enable the data connector for Microsoft Defender for Cloud Apps.. The Microsoft Defender for Cloud Apps data connector in Microsoft Sentinel is specifically designed to ingest alerts and cloud discovery logs from Defender for Cloud Apps. Enabling this connector ensures that all cloud app alerts are automatically forwarded to Sentinel for correlation without requiring custom API queries or external export pipelines.

Answer

Create an analytics rule in Sentinel that queries Defender for Cloud Apps API.

Answer

Configure Microsoft Defender for Cloud Apps to export alerts to Azure Event Hubs.

Answer

In Microsoft Sentinel, enable the data connector for Microsoft Defender for Endpoint.