SC-200 Manage a security operations environment Practice Test 19 — 15 Questions

Question 1

Your organization uses Microsoft Defender XDR. You need to ensure that when a user reports a phishing email in Outlook, it automatically triggers an investigation in Microsoft Defender XDR. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable user-reported message settings in Microsoft Defender for Office 365 and configure automated investigation.. Enabling user-reported message settings in Microsoft Defender for Office 365 allows users to report phishing emails directly from Outlook. When combined with automated investigation and response (AIR) policies, this triggers an automatic investigation in Microsoft Defender XDR, leveraging the unified incident and alerting pipeline to analyze the reported message and associated threats.

Answer

Create a playbook in Microsoft Sentinel triggered by a custom connector.

Answer

Configure a data loss prevention policy in Microsoft Purview.

Answer

Set up a session policy in Microsoft Defender for Cloud Apps.

Question 2

Your organization uses Microsoft Sentinel with multiple workspaces. You need to ensure that incidents involving the same alert in different workspaces are automatically grouped into a single incident. What should you configure?

Accepted Answer

Create an analytics rule that runs across all workspaces.. You can create a scheduled analytics rule that queries across multiple workspaces (using the workspace() function or union operator) and if the same alert appears in multiple workspaces, the rule can generate a single incident. This allows automatic grouping of correlated alerts from different workspaces into one incident. Option D is incorrect because Microsoft Sentinel does not have a dedicated 'incident grouping rule' that groups alerts from multiple workspaces; that feature does not exist.

Answer

Enable UEBA to correlate alerts across workspaces.

Answer

Set up an automation rule to merge incidents.

Answer

Configure an incident grouping rule in Microsoft Sentinel.

Question 3

You are managing Microsoft Defender XDR. The security team reports that some automated investigations are closing prematurely without sufficient evidence. You need to ensure that investigations only close when a minimum confidence level is reached. What should you modify?

Accepted Answer

Adjust the automation level in the Microsoft 365 Defender security settings.. The automation level in Microsoft 365 Defender security settings controls how automated investigations behave, including the confidence level required for actions to be taken or for investigations to close. By adjusting the automation level (e.g., from 'Full – remediate threats automatically' to a higher threshold like 'Semi – require approval for any remediation'), you can ensure that investigations do not close prematurely without sufficient evidence. This setting directly addresses the requirement to enforce a minimum confidence level before closure.

Answer

Change the action center settings to require manual approval.

Answer

Modify the tenant-level advanced features in Microsoft Defender XDR.

Answer

Create a custom detection rule to override default behavior.

Question 4

Your organization uses Microsoft Sentinel. You need to ensure that an incident is automatically assigned to a specific analyst when it is created. What should you create?

Accepted Answer

An automation rule with an 'Assign incident' action.. An automation rule in Microsoft Sentinel can be configured to run when an incident is created and includes an 'Assign incident' action that automatically assigns the incident to a specific analyst or group. This is the native, no-code method for incident assignment without requiring external logic or playbooks.

Answer

An analytics rule with an output to a specific user.

Answer

A playbook triggered by incident creation.

Answer

A watchlist that maps incident types to owners.

Question 5

You have a Microsoft Sentinel automation rule that triggers a playbook. The playbook definition is shown in the exhibit. The playbook runs but no email is sent. What is the most likely cause?

Accepted Answer

The playbook uses a recurrence trigger instead of a Microsoft Sentinel trigger.. The playbook uses a recurrence trigger, which means it runs on a schedule (e.g., every hour) rather than being invoked by a Microsoft Sentinel incident or alert. A Microsoft Sentinel automation rule can only trigger a playbook that has a Microsoft Sentinel trigger (e.g., 'When a response to a Microsoft Sentinel incident is triggered'). Without the correct trigger, the playbook will execute on its schedule but will not receive the incident context or be invoked by the automation rule, so no email is sent.

Answer

The JSON syntax is invalid.

Answer

The email operation 'SendEmailV2' is deprecated.

Answer

The connection name 'office365' is incorrect.

Question 6

Your organization uses Microsoft Sentinel and Microsoft Defender for Cloud. You need to ensure that security alerts from Defender for Cloud are automatically ingested into Sentinel. What should you configure?

Accepted Answer

Add the 'Microsoft Defender for Cloud' data connector in Microsoft Sentinel.. The 'Microsoft Defender for Cloud' data connector in Microsoft Sentinel is specifically designed to ingest security alerts from Defender for Cloud into Sentinel. When you enable this connector, it automatically synchronizes alerts from all connected Defender for Cloud subscriptions, allowing you to investigate and respond to those alerts within Sentinel's unified security operations environment.

Answer

Enable diagnostic settings on the Defender for Cloud subscription.

Answer

Configure the 'Azure Activity' data connector.

Answer

Create an automation rule in Sentinel to fetch alerts from Defender for Cloud.

Question 7

Your organization uses Microsoft Defender for Endpoint. You need to ensure that when a malware alert is generated, an automated investigation is triggered. What should you configure?

Accepted Answer

Enable automated investigation and remediation in the Microsoft 365 Defender portal.. Enabling automated investigation and remediation in the Microsoft 365 Defender portal is the specific configuration that triggers an automated investigation when a malware alert is generated by Microsoft Defender for Endpoint. This feature allows the security operations team to define the automation level (e.g., full, semi, or no automation) for alerts, ensuring that when a malware alert fires, the system automatically initiates an investigation to contain and remediate the threat without manual intervention.

Answer

Configure the Action center settings.

Answer

Create custom indicators of compromise (IOCs).

Answer

Use threat analytics to trigger investigations.

Question 8

Your organization uses Microsoft Sentinel with Azure Policy. You need to ensure that new Log Analytics workspaces are automatically connected to Sentinel and configured with a standard set of data connectors. What should you use?

Accepted Answer

Create Azure Policy definitions that deploy Sentinel and data connectors.. Azure Policy can be used to automatically deploy and configure Microsoft Sentinel and its data connectors on new Log Analytics workspaces. By creating policy definitions with 'DeployIfNotExists' or 'Modify' effects, you ensure that any new workspace is automatically onboarded to Sentinel and has the required data connectors installed, meeting the requirement for automated, consistent configuration at scale.

Answer

Deploy an ARM template to each new workspace manually.

Answer

Use Sentinel automation rules to configure new workspaces.

Answer

Develop a Logic App that runs on a schedule to check for new workspaces.

Question 9

You have a Microsoft Sentinel automation rule as shown in the exhibit. The rule triggers a playbook that blocks a user in Microsoft Entra ID. The rule is enabled but never fires. What is the most likely reason?

Accepted Answer

The playbook does not have a Microsoft Sentinel trigger.. The automation rule is configured to trigger a playbook, but for a playbook to be invoked by a Microsoft Sentinel automation rule, it must have a Microsoft Sentinel trigger (e.g., 'When a response to a Microsoft Sentinel incident is triggered'). Without this trigger, the playbook cannot receive the incident context from Sentinel, so the rule will never fire even if all other conditions are met.

Answer

The automation rule is disabled.

Answer

No incidents with High severity are created.

Answer

The JSON syntax is invalid.

Question 10

Your organization uses Microsoft Defender XDR. You need to ensure that when a user reports a phishing email in Outlook, it automatically triggers an investigation in Microsoft Defender XDR. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the Microsoft Defender for Office 365 data connector in Sentinel.. The Microsoft Defender for Office 365 data connector in Microsoft Sentinel ingests email-related alerts and events (e.g., phishing, malware, spam) from Defender for Office 365. When you configure automated investigation and response (AIR) policies in Defender for Office 365 to move suspicious emails to quarantine, and enable the connector in Sentinel, those quarantine actions trigger corresponding incidents in Sentinel. This integration ensures that email threats are both remediated (quarantined) and tracked as security incidents for further analysis.

Answer

Configure the Microsoft Defender for Cloud data connector in Sentinel.

Answer

Use the Microsoft Defender for Identity data connector.

Answer

Enable the Microsoft Defender for Endpoint data connector.

Question 11

Your organization uses Microsoft Sentinel. You need to ensure that incident response times are monitored and reported. Which TWO capabilities should you use?

Accepted Answer

Automation rules. Automation rules (C) are correct because they allow you to define conditions and actions that automatically trigger when an incident is created or updated, enabling consistent assignment, severity changes, and tagging. Workbooks (E) are correct because they provide customizable visualizations and reports that can track key metrics like incident response times, mean time to acknowledge (MTTA), and mean time to remediate (MTTR) using KQL queries against Sentinel's security data.

Answer

Playbooks

Answer

UEBA

Answer

Watchlists

Question 12

Your organization uses Microsoft Defender XDR. You need to ensure that when a user reports a phishing email in Outlook, it automatically triggers an investigation in Microsoft Defender XDR. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Security Administrator. Security Administrator is correct because this role in Microsoft 365 Defender provides full access to incident management features, including the ability to investigate, respond to, and resolve incidents, while not granting full global admin permissions. It allows analysts to manage alerts, perform advanced hunting, and configure security settings within the Defender portal, making it suitable for delegated incident management tasks.

Answer

Security Analyst

Answer

Compliance Administrator

Question 13

You are managing Microsoft Defender for Cloud Apps. Which TWO actions can be performed using the Microsoft Defender XDR integration?

Accepted Answer

Investigate user activities across cloud apps.. Microsoft Defender XDR integration with Defender for Cloud Apps enables cross-domain investigation of user activities across cloud apps, leveraging signals from Microsoft 365 Defender to correlate events like sign-ins, file downloads, and admin actions. This allows security analysts to trace a user's behavior across SaaS applications (e.g., SharePoint, OneDrive, Teams) without switching consoles, using the unified incidents and alerts in the Microsoft 365 Defender portal.

Answer

Quarantine malicious emails.

Answer

Manage device compliance policies in Microsoft Intune.

Answer

Onboard devices to Microsoft Defender for Endpoint.

Question 14

Your organization uses Microsoft Sentinel. You need to ensure that an alert is created when a user accesses a sensitive SharePoint site from an unusual location. What should you create?

Accepted Answer

An analytics rule. An analytics rule in Microsoft Sentinel defines the conditions under which alerts are generated. To detect a user accessing a sensitive SharePoint site from an unusual location, you would create an analytics rule that queries the Office 365 activity logs (e.g., SharePoint operations) and uses the 'Unusual Geo-Location' anomaly detection or a custom KQL query comparing the user's location against a baseline of their typical access patterns. This rule will then generate an alert when the condition is met.

Answer

A watchlist

Answer

A playbook

Answer

An automation rule

Question 15

Your organization uses Microsoft Defender XDR. You need to ensure that when a user reports a phishing email in Outlook, it automatically triggers an investigation in Microsoft Defender XDR. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure an automated investigation and remediation rule in Microsoft Defender XDR to suppress alerts matching the legacy application pattern.. Configuring an automated investigation and remediation rule in Microsoft Defender XDR allows you to suppress alerts that match a specific pattern (e.g., legacy application login behavior) without disabling the underlying detection rule. This directly reduces alert fatigue by automatically closing or ignoring false positive alerts while keeping the rule active for genuine threats.

Answer

Use Microsoft Sentinel bookmarks to mark the alerts as false positives.

Answer

Create a watchlist in Microsoft Sentinel containing the legacy application's user accounts and use it in the rule.

Answer

Modify the analytics rule in Microsoft Sentinel to exclude the legacy application IP range.