SC-200 Manage a security operations environment Practice Test 19 — 15 Questions

Question 1

You are configuring Microsoft Defender for Identity (MDI) in your on-premises Active Directory environment. You need to ensure that MDI can detect lateral movement attacks. Which two configurations are required?

Accepted Answer

Enable port mirroring on the domain controller switches.. Option A is correct because MDI sensors must be installed on domain controllers. Option C is correct because port mirroring or network capture is required. Option B is incorrect because Azure AD Connect is not required for MDI. Option D is incorrect because MDI does not require VPN. Option E is incorrect because Microsoft Defender for Cloud is separate.

Answer

Integrate with Microsoft Defender for Cloud.

Answer

Configure Azure AD Connect to sync identities.

Answer

Configure site-to-site VPN to Azure.

Question 2

You are the security operations lead for a multinational company that uses Microsoft Sentinel in a single workspace. You have recently onboarded 10 new business units, each with their own analytics rules and automation. The security team is overwhelmed by the number of low-fidelity incidents generated. You need to reduce noise without disabling critical detections. You must ensure that each business unit retains ownership of their incidents and can customize their own suppression rules. You also need centralized reporting on incident trends across all business units. You have identified that many low-fidelity alerts come from a common set of data sources. What should you do?

Accepted Answer

Create a separate analytics rule for low-fidelity alerts that uses alert suppression to group similar alerts.. Option C is correct because creating a separate analytics rule for low-fidelity alerts with alert suppression enabled allows you to group similar alerts into a single incident, reducing noise without disabling the underlying data connectors or critical detections. This approach preserves each business unit's ownership of their incidents and enables them to customize suppression rules via automation rules or analytics rule settings, while centralized reporting on incident trends remains intact because the workspace still ingests all alerts.

Answer

Disable the data connectors that produce the most noise.

Answer

Create an automation rule that automatically closes low-severity incidents.

Answer

Create a workbook that filters out low-severity incidents from the dashboard.

Question 3

You are a security analyst for a company that uses Microsoft Defender XDR. You receive a high-severity incident indicating that a user's device has been compromised with a remote access trojan (RAT). The incident is automatically generated by Microsoft Defender XDR. You need to contain the threat immediately while preserving forensic data. You also need to ensure that the user can continue working with minimal disruption. What should you do?

Accepted Answer

Initiate device isolation from Microsoft Defender XDR.. Option A is correct because initiating device isolation from Microsoft Defender XDR immediately disconnects the device from the network while preserving forensic data on the device. This contains the RAT's command-and-control communication without disrupting the user's ability to work offline, and it allows the security team to investigate the compromised device without risk of lateral movement or data exfiltration.

Answer

Restore the device from a recent backup.

Answer

Run a full antivirus scan on the device.

Answer

Reset the user's password and force a sign-out.

Question 4

You are a security operations analyst for a company that uses Microsoft Sentinel. You need to create a custom analytics rule that detects when a user account is created and then deleted within 24 hours, which could indicate a test account used for malicious purposes. The rule should only run on the SecurityEvent table. You have written the KQL query and now need to configure the rule settings. Which alert scheduling configuration should you set to minimize latency while ensuring that the rule catches the pattern?

Accepted Answer

Run query every 1 hour with a 1-hour lookback.. Option A is correct because running the query every 1 hour with a 1-hour lookback ensures that any account creation and deletion occurring within a 24-hour window is captured with minimal latency. The 1-hour lookback allows the rule to detect events that span across the current and previous execution windows, which is essential for catching the creation and deletion pattern without missing events due to scheduling gaps.

Answer

Run query every 24 hours with a 24-hour lookback.

Answer

Run query every 1 hour with no lookback.

Answer

Run query every 5 minutes with a 5-minute lookback.

Question 5

You are a security operations analyst for a company that uses Microsoft Sentinel and Microsoft Defender for Cloud. You have configured the Microsoft Defender for Cloud connector to stream security alerts into Sentinel. However, you notice that some alerts from Defender for Cloud are not appearing in Sentinel. You have verified that the connector is enabled and the subscription is connected. The missing alerts are of the type 'Security misconfiguration' from Azure Policy. You need to ensure all alerts appear in Sentinel. What should you do?

Accepted Answer

Enable the Defender for Cloud plan on the subscription in Azure Policy.. The 'Security misconfiguration' alerts from Azure Policy are generated only when the Defender for Cloud plan is enabled on the subscription. The Microsoft Defender for Cloud data connector streams alerts from Defender for Cloud into Sentinel, but if the Defender for Cloud plan is not enabled, those specific policy-based alerts are never generated. Enabling the Defender for Cloud plan on the subscription in Azure Policy ensures that Azure Policy evaluations produce security misconfiguration alerts, which are then ingested by the connector into Sentinel.

Answer

Create a custom analytics rule to detect misconfigurations.

Answer

Re-enable the Microsoft Defender for Cloud data connector.

Answer

Create a new Microsoft Defender for Cloud data connector for the same subscription.

Question 6

You are a security operations architect for a company that uses Microsoft Sentinel in a hybrid environment with multiple workspaces. The company has a central SOC team that needs to view incidents from all workspaces in a single pane of glass. Each workspace belongs to a different business unit and has its own retention and access policies. You need to design a solution that provides centralized incident management without duplicating data or requiring users to switch workspaces. You also need to ensure that the SOC team can perform actions on incidents across workspaces. What should you do?

Accepted Answer

Use Microsoft Sentinel incident multi-view to connect all workspaces.. Microsoft Sentinel incident multi-view allows SOC teams to view and manage incidents across multiple workspaces from a single interface without duplicating data. This feature provides a centralized pane of glass while respecting each workspace's independent retention and access policies, and it enables cross-workspace incident actions without requiring users to switch contexts.

Answer

Create a playbook that copies incidents from all workspaces to a central workspace.

Answer

Use the Microsoft Sentinel data connector to connect all workspaces to a central workspace.

Answer

Create a new Log Analytics workspace that ingests data from all workspaces via diagnostic settings.

Question 7

You are a security analyst for a company that uses Microsoft Defender for Office 365. You receive an incident indicating that a user reported a phishing email. You need to investigate the email and determine if it was delivered to other users. You also need to ensure that similar emails are blocked in the future. What should you do?

Accepted Answer

Use Threat Explorer to search for similar emails and delete them.. Threat Explorer in Microsoft Defender for Office 365 allows you to search for and take bulk action on emails matching specific criteria, such as sender, subject, or URL. By using Threat Explorer, you can identify all instances of the reported phishing email across your tenant and delete them from user mailboxes, which directly addresses the need to determine if the email was delivered to other users and to remediate it. This tool is designed for hunting and remediation, making it the correct choice for this investigation.

Answer

Submit the email to Microsoft for analysis and quarantine it.

Answer

Create a Safe Links policy to block URLs in the email.

Answer

Run a simulated phishing attack to test user awareness.

Question 8

You are a security operations analyst for a company that uses Microsoft Sentinel. You need to create a workbook that displays the top 10 most common alert types over the last 7 days. The workbook will be used by the SOC manager to identify trends. You have already created a new workbook and added a query step. Which KQL query should you use in the query step?

Accepted Answer

AlertInfo | where TimeGenerated > ago(7d) | summarize Count = count() by AlertName | top 10 by Count desc | render barchart. Option C is correct because it uses the `summarize` operator to count alerts by `AlertName`, then `top 10 by Count desc` to return the ten most frequent alert types, and `render barchart` to visualize the data in the workbook. This directly meets the requirement to display the top 10 most common alert types over the last 7 days.

Answer

AlertInfo | where TimeGenerated > ago(7d) | project AlertName

Answer

AlertInfo | where TimeGenerated > ago(7d) | project AlertName, count()

Answer

AlertInfo | where TimeGenerated > ago(7d) | summarize count() by bin(TimeGenerated, 1d) | render timechart

Question 9

You are a security operations engineer for a company that uses Microsoft Defender XDR. You need to create a custom detection rule that alerts when a user performs more than 10 failed logon attempts within 5 minutes from different IP addresses. The rule should use the IdentityLogonEvents table. You have written the KQL query and now need to configure the rule settings in Microsoft 365 Defender. Which configuration should you use for the rule frequency and lookback period to minimize false positives while ensuring timely detection?

Accepted Answer

Run every 5 minutes with a 5-minute lookback.. Option A is correct because running every 5 minutes with a 5-minute lookback ensures the rule catches the pattern within the same window and minimizes false positives by not aggregating over longer periods. Option B is incorrect because a 1-hour lookback may capture multiple sessions. Option C is incorrect because a 24-hour run period is too coarse. Option D is incorrect because no lookback misses past events.

Answer

Run every 5 minutes with a 1-hour lookback.

Answer

Run every 1 hour with no lookback.

Answer

Run every 24 hours with a 24-hour lookback.

Question 10

Your organization uses Microsoft Sentinel and Microsoft Defender for Cloud. You need to ensure that all security alerts from Defender for Cloud are automatically ingested into Sentinel with the least latency. What should you configure?

Accepted Answer

Use the Microsoft Defender for Cloud data connector in Sentinel to stream alerts.. Option D is correct because the data connector for Microsoft Defender for Cloud (formerly Azure Security Center) provides real-time streaming of alerts into Sentinel. Option A is incorrect because Logic Apps introduce processing delay. Option B is incorrect because the API connector is not optimized for low latency. Option C is incorrect because continuous export is a feature of Defender for Cloud but does not directly connect to Sentinel without a connector.

Answer

Configure a custom API connector in Sentinel to pull alerts from Defender for Cloud REST API every 5 minutes.

Answer

Enable continuous export in Defender for Cloud to send alerts to a Log Analytics workspace and then create a scheduled query in Sentinel.

Answer

Create a Logic App that triggers on Defender for Cloud alerts and sends them to Sentinel via the Azure Monitor HTTP Data Collector API.

Question 11

Refer to the exhibit. You have an automation rule in Microsoft Sentinel configured as shown. The rule does not trigger as expected for newly created incidents with High severity. What is the most likely cause?

Accepted Answer

The trigger type is misspelled; it should be 'Microsoft.SecurityInsights/Incident' instead of 'Microsoft.SecurityInsights/Incident'.. Option B is correct because the JSON shows a typo in the trigger type: 'Microsoft.SecurityInsights/Incident' instead of 'Microsoft.SecurityInsights/Incident'. The correct trigger type should be 'Microsoft.SecurityInsights/Incident'. Option A is incorrect because the trigger type is malformed. Option C is incorrect because the conditions use 'Equals' which is valid. Option D is incorrect because the playbookId is a well-formed resource ID.

Answer

The automation rule is disabled because 'state' is set to 'Enabled' but the rule is in a 'Disabled' state due to a missing property.

Answer

The playbookId references a Logic App in a resource group that does not exist.

Answer

The conditions use 'Equals' operator, but 'Severity' and 'Status' require 'Contains' operator.

Question 12

Your team uses Microsoft Defender XDR to manage incidents. You need to ensure that all incidents with a severity of 'High' are automatically assigned to a specific SOC analyst group. What should you configure?

Accepted Answer

Create an automation rule in Microsoft Defender XDR to automatically assign incidents.. Option A is correct because Microsoft Defender XDR allows you to create automation rules that can assign incidents based on criteria like severity. Option B is incorrect because it is for automated investigation and response. Option C is incorrect because it is a PowerShell cmdlet, not a configuration. Option D is incorrect because advanced hunting is for querying data, not automation.

Answer

Set up an advanced hunting query to detect high severity incidents and send email.

Answer

Configure a playbook in Microsoft Sentinel triggered by incidents.

Answer

Use the 'New-MTPIncidentAssignment' cmdlet in a scheduled task.

Question 13

Your organization uses Microsoft Sentinel with a hybrid environment including on-premises servers and Azure VMs. You notice that some Windows events from on-premises servers are not being collected in Sentinel. Log Analytics agent is installed on all servers. Other events are collected. What should you check first?

Accepted Answer

Check the Windows Event Log collection configuration in the Log Analytics workspace data collection rules.. Option B is correct because missing specific event IDs often indicates a filtering issue in the data collection rules. Option A is incorrect because the agent is healthy if it sends other events. Option C is incorrect because connectivity is likely fine if other events arrive. Option D is incorrect because the workspace key is used for authentication; if it were wrong, no events would be collected.

Answer

Confirm that the workspace key is correctly deployed on the servers.

Answer

Verify that the Log Analytics agent is running and has network connectivity to Azure.

Answer

Ensure that the servers are listed in the Azure Arc management pane.

Question 14

Your organization uses Microsoft Defender for Office 365. You need to create a custom alert that triggers when users receive external emails with attachments from untrusted domains. What should you configure?

Accepted Answer

Create an alert policy in Microsoft 365 Defender.. A custom alert policy in Microsoft 365 Defender can be configured to detect when users receive external emails with attachments from untrusted domains. This leverages the built-in threat detection capabilities of Defender for Office 365, allowing you to define conditions such as sender domain reputation and attachment presence, and trigger an alert when the criteria are met.

Answer

Create a mail flow rule in Exchange admin center.

Answer

Set up a conditional access policy in Microsoft Entra ID.

Answer

Configure a data sensitivity label in Microsoft Purview.

Question 15

Refer to the exhibit. You are configuring an automation rule in Microsoft Sentinel. The rule is enabled but never runs. The playbook exists and is in the same resource group. What is the most likely cause?

Accepted Answer

The trigger type is incorrect; it should be 'Microsoft.SecurityInsights/Alert'.. Option C is correct because the exhibit shows the trigger type set to 'Microsoft.SecurityInsights/Incident', but the playbook is designed to run on alerts, not incidents. Automation rules in Microsoft Sentinel require the trigger type to match the data type the playbook expects; for alert-triggered playbooks, the trigger must be 'Microsoft.SecurityInsights/Alert'. Since the rule is enabled and the playbook exists in the same resource group, the mismatch in trigger type is the most likely reason the rule never runs.

Answer

The condition uses 'Contains' operator, but 'AlertProvider' requires 'Equals'.

Answer

The automation rule is in a 'Disabled' state.

Answer

The playbookId is missing the subscription ID.