SC-200 Manage a security operations environment Practice Test 18 — 15 Questions

Question 1

You are reviewing a Microsoft Sentinel analytics rule configuration. The rule is not generating incidents as expected. What is the most likely cause?

Accepted Answer

The query references a table that is not available in the Sentinel workspace.. Option A is correct because the query uses 'IdentityLogonEvents', which is a table from Microsoft Defender for Identity, not from Microsoft Entra ID. The data source connector for Microsoft Defender for Identity may not be configured. Option B is incorrect because 'MFA disabled' action type is valid. Option C is incorrect because the suppression is disabled. Option D is incorrect because the query frequency matches the query period.

Answer

The queryFrequency and queryPeriod are mismatched.

Answer

The suppressionDuration is set to 5 hours, suppressing alerts.

Answer

The action type 'MFA disabled' is not supported in IdentityLogonEvents.

Question 2

Your organization has recently deployed Microsoft Sentinel and Microsoft Defender XDR. You are tasked with configuring the environment to ensure that incidents created by Microsoft Defender for Cloud Apps are automatically synchronized to Microsoft Sentinel. The security operations team wants to manage all incidents from within Sentinel. You have already connected the Microsoft Defender XDR connector to Sentinel. However, you notice that incidents from Defender for Cloud Apps are not appearing in Sentinel. You verify that the Defender for Cloud Apps connector is not listed in the data connectors blade. What should you do to resolve this issue?

Accepted Answer

Ensure the Microsoft Defender XDR connector is configured to include Defender for Cloud Apps incidents.. When Microsoft Defender XDR connector is enabled in Sentinel, it can ingest incidents from all Microsoft Defender products, including Defender for Cloud Apps, provided the connector's configuration includes the option to synchronize those incidents. Since the Defender for Cloud Apps connector is not listed separately, the correct approach is to verify and adjust the Microsoft Defender XDR connector's settings to include Defender for Cloud Apps incidents. Option D directly addresses this by ensuring the existing connector is configured to forward those incidents.

Answer

Enable the Microsoft Sentinel integration in the Defender for Cloud Apps portal.

Answer

Configure a data collection rule in Microsoft Purview to forward alerts to Sentinel.

Answer

Install the Microsoft Defender for Cloud Apps connector from Sentinel data connectors.

Question 3

Your organization uses Microsoft Sentinel with multiple workspaces for different business units. You need to provide a single-pane-of-glass view for incident management across all workspaces. You have deployed Azure Lighthouse to manage multiple workspaces from a single portal. The SOC team is able to see incidents from all workspaces, but when they try to investigate an incident by clicking on it, they receive a 'Resource not found' error. The team has the necessary permissions on the Sentinel resources. What is the most likely cause of this error?

Accepted Answer

The user does not have the 'Microsoft Sentinel Contributor' role on the subscription containing the workspace.. The 'Resource not found' error when clicking an incident in a cross-workspace view typically occurs because the user lacks the 'Microsoft Sentinel Contributor' role at the subscription level that contains the workspace. While Azure Lighthouse enables cross-workspace visibility, each workspace's Sentinel resources require the user to have the Contributor role on the subscription (or at least the resource group) to access incident details, not just the workspace itself. Without this role, the portal cannot resolve the resource path for the incident.

Answer

The workspace is in a different Azure region.

Answer

Cross-workspace queries are not enabled in Sentinel.

Answer

The incidents are generated by analytics rules that are not deployed in the user's workspace.

Question 4

You are the security operations lead for a multinational company using Microsoft Sentinel. You have deployed a custom analytics rule that uses a KQL query to detect anomalous outbound network traffic. The rule runs every hour and looks back 24 hours. Recently, the rule has been generating a high number of false positives. You need to tune the rule to reduce false positives without missing genuine threats. The rule currently triggers when the count of outbound connections to a single IP exceeds 100 in an hour. You analyze the data and find that legitimate cloud services often trigger the rule. What should you do?

Accepted Answer

Modify the KQL query to exclude traffic to known benign IP ranges.. Option A is correct because adding known benign IPs to the exclusion list directly reduces false positives from legitimate cloud services while keeping the detection logic intact. Option B is incorrect because suppressing alerts only hides them, not reducing false positives. Option C is incorrect because increasing the threshold may miss real threats. Option D is incorrect because disabling the rule is not tuning.

Answer

Disable the rule and create a new one with a different query.

Answer

Increase the threshold to 200 connections per hour.

Answer

Configure a suppression rule to automatically close incidents from those IPs.

Question 5

Your organization uses Microsoft Sentinel with UEBA enabled. You are investigating a suspicious incident where a user's account is reported to have accessed an unusual amount of data from a SharePoint site. The incident alert points to the user 'jdoe@contoso.com'. You open the incident and see that the entity timeline for jdoe shows several activities, including file downloads. However, you notice that the timeline does not include any Azure AD sign-in events for this user. You need to include sign-in events in the entity timeline to get a complete picture. What should you do?

Accepted Answer

Install the Azure Active Directory connector to ingest sign-in logs.. The entity timeline in Microsoft Sentinel relies on data already ingested into the workspace. Since Azure AD sign-in events are not appearing, the most likely cause is that the Azure Active Directory connector has not been installed or configured. Installing this connector ingests sign-in logs (and audit logs) into Sentinel, which then populates the entity timeline with sign-in activities for users like jdoe.

Answer

Enable UEBA for Azure AD in the Sentinel settings.

Answer

Install the Office 365 connector to ingest Azure AD logs.

Answer

Configure the entity timeline to include Azure AD events manually.

Question 6

You are a security analyst at a company that uses Microsoft Defender XDR. You receive an alert about a potential ransomware activity on a workstation. The alert is generated by Microsoft Defender for Endpoint. You need to contain the threat by isolating the workstation from the network while allowing forensic analysis to proceed. You want to use Microsoft Defender XDR's built-in actions. What should you do?

Accepted Answer

Use the 'Isolate device' action from the Microsoft Defender XDR portal.. The 'Isolate device' action in Microsoft Defender XDR (specifically from the Microsoft Defender for Endpoint component) disconnects the device from all network traffic except for the Defender for Endpoint service and a few authorized services (such as Windows Update and the Microsoft Update Service). This allows forensic analysis tools (like Live Response) to continue communicating with the device while preventing the ransomware from spreading laterally or communicating with command-and-control servers. This is the built-in, recommended containment action for such scenarios.

Answer

Create a firewall rule in Microsoft Defender for Cloud Apps to block the device's IP.

Answer

Unenroll the device from Microsoft Intune.

Answer

Disable the network adapter on the workstation remotely.

Question 7

Your company uses Microsoft Sentinel to monitor security events. You have configured a daily email report that summarizes the top 10 incidents from the past 24 hours. The report is sent using a Logic App playbook triggered by a scheduled query. Recently, the report has stopped being delivered. You check the Logic App run history and see that the last run failed with an HTTP 403 error when connecting to the Microsoft Sentinel API. The Logic App uses a managed identity for authentication. What is the most likely cause of the failure?

Accepted Answer

The managed identity does not have the required permissions on the Sentinel workspace.. The HTTP 403 error indicates a permissions failure when the Logic App attempted to call the Microsoft Sentinel API. Since the Logic App uses a managed identity for authentication, the most likely cause is that the managed identity lacks the necessary role assignments on the Sentinel workspace, such as 'Microsoft Sentinel Contributor' or 'Microsoft Sentinel Reader', which are required to query incidents via the API.

Answer

The managed identity's client ID has changed.

Answer

The Logic App is not connected to Microsoft Entra ID.

Answer

The scheduled query is no longer running.

Question 8

Your organization has Microsoft Sentinel deployed in a single workspace. You need to implement role-based access control (RBAC) so that only senior analysts can modify analytics rules, while junior analysts can only view incidents. You have created custom roles in Azure. You assign the junior analysts the 'Microsoft Sentinel Reader' role. However, you find that junior analysts can still create and modify analytics rules. What is the most likely reason?

Accepted Answer

The junior analysts have been assigned the 'Contributor' role on the resource group containing the workspace.. Option D is correct because RBAC assignments can be overridden if the user is also assigned a higher role at a higher scope (e.g., subscription). Option A is incorrect because there is no 'Analytics Rules' specific role. Option B is incorrect because custom roles are allowed. Option C is incorrect because inherited permissions do not automatically grant write access.

Answer

The 'Microsoft Sentinel Reader' role does not exist; you used the wrong role.

Answer

The junior analysts are members of a group that has a role assignment on the workspace.

Answer

You need to create a custom role instead of using built-in roles.

Question 9

Your company uses Microsoft Defender for Cloud Apps to monitor cloud applications. You have discovered that a user is accessing a sanctioned cloud storage app from an IP address that belongs to a known malicious botnet. You need to automatically block the user's access to the app and require them to re-authenticate. You have already configured session policies in Defender for Cloud Apps. What should you do next?

Accepted Answer

Configure a session policy in Defender for Cloud Apps with the action 'Block' and 'Require re-authentication'.. Session policies in Defender for Cloud Apps can enforce real-time controls on sanctioned apps. By configuring a session policy with the actions 'Block' and 'Require re-authentication', you can immediately terminate the user's session and force them to re-authenticate, which effectively blocks access from the malicious IP while ensuring the user re-verifies their identity.

Answer

Create an access policy in Defender for Cloud Apps to block the user.

Answer

Create an app governance policy in Microsoft Purview to block the app.

Answer

Create a device compliance policy in Microsoft Intune to block the device.

Question 10

You are a security operations analyst for a company that uses Microsoft Sentinel. You need to ensure that incidents are automatically assigned to the appropriate team based on the incident type. Which two actions should you take?

Accepted Answer

Define custom details in the analytics rule to include the team name, then use an automation rule to assign.. Option D is correct because custom details in an analytics rule allow you to extract and store the team name from the incident data, and then an automation rule can use that custom detail as a condition to automatically assign the incident to the appropriate owner. This approach ensures dynamic assignment based on the incident type without requiring a playbook or manual intervention.

Answer

Modify the analytics rule to set the incident owner directly.

Answer

Create a playbook that assigns incidents based on the incident type.

Answer

Create a workbook that filters incidents by type and assigns them manually.

Question 11

Your organization uses Microsoft Defender XDR and Microsoft Sentinel. You need to ensure that high-severity incidents are automatically escalated to the on-call security engineer via Microsoft Teams. Which three components should you configure?

Accepted Answer

A playbook that uses a condition to check severity and then sends a Teams message.. Option A is correct because a playbook in Microsoft Sentinel can contain a condition action that evaluates the incident severity. If the severity is 'High', the playbook then uses a Microsoft Teams connector to send a message to the on-call security engineer, automating the escalation process.

Answer

An analytics rule that sends a Teams message when a high-severity alert fires.

Answer

A workbook that displays high-severity incidents for manual escalation.

Question 12

You are managing a Microsoft Sentinel workspace that ingests data from multiple sources. You need to reduce the cost of log ingestion while maintaining security visibility. Which two actions should you take?

Accepted Answer

Enable analytics rules to run only on high-value data sources.. Option C is correct because enabling analytics rules to run only on high-value data sources reduces the volume of data that must be queried and processed, directly lowering ingestion and analytics costs while preserving security visibility on critical logs. In Microsoft Sentinel, analytics rules incur costs based on the data scanned; by scoping rules to high-value sources, you avoid unnecessary processing of low-signal data.

Answer

Remove all custom log connectors that are not used frequently.

Answer

Increase the retention period for all tables to 90 days to avoid data loss.

Answer

Use compression algorithms in Log Analytics to reduce log size.

Question 13

Your organization uses Microsoft Defender for Cloud and Microsoft Sentinel. You need to ensure that security alerts from Defender for Cloud are automatically synchronized to Sentinel and assigned to the cloud security team. Which three actions should you take?

Accepted Answer

Create an automation rule that sets the incident owner to the cloud security team.. Option A is correct because automation rules in Microsoft Sentinel allow you to automatically assign incident owners based on conditions such as alert severity or source connector. By creating an automation rule that sets the incident owner to the cloud security team, you ensure that every Defender for Cloud alert synchronized to Sentinel is immediately assigned to the appropriate team without manual intervention.

Answer

Manually export alerts from Defender for Cloud to Sentinel daily.

Answer

Create a playbook that periodically pulls alerts from Defender for Cloud.

Question 14

You are a security analyst at a company that uses Microsoft Sentinel. You need to create a custom analytics rule that detects failed logon attempts from multiple IP addresses within 5 minutes. Which two KQL operators should you use?

Accepted Answer

bin. Option B is correct because summarize with count and dcount helps aggregate. Option E is correct because the bin function is used for time windows. Option A is incorrect because where filters rows. Option C is incorrect because project selects columns. Option D is incorrect because join combines tables.

Answer

where

Answer

project

Answer

join

Question 15

Your organization uses Microsoft Sentinel with UEBA enabled. You need to investigate a potential insider threat where a user is accessing sensitive data outside of business hours. Which three built-in UEBA entities should you review?

Accepted Answer

User account. Option B is correct because UEBA tracks user entities. Option C is correct because IP address is a common entity. Option D is correct because devices are entities in UEBA. Option A is incorrect because subscriptions are not UEBA entities. Option E is incorrect because resource groups are not entities.

Answer

Azure subscription

Answer

Resource group

SC-200 Manage a security operations environment Practice Test 18 — 15 Questions

Exhibit

SC-200 Manage a security operations environment Practice Test 18 — 15 Questions

Exhibit