SC-200 Manage a security operations environment Practice Test 19 — 15 Questions

Question 1

You are responsible for Microsoft Defender for Identity. The security team reports that some high-confidence alerts are not triggering any automated response. You need to automate the response for these alerts. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

In Microsoft Defender XDR, configure automated investigation and response for Identity alerts.. Microsoft Defender for Identity alerts are natively integrated into Microsoft Defender XDR (formerly Microsoft 365 Defender), which provides automated investigation and response (AIR) capabilities. By configuring AIR for Identity alerts in Defender XDR, you can automatically trigger remediation actions such as suspending compromised accounts or blocking suspicious activities without additional scripting or third-party tools.

Answer

Use Microsoft Intune to trigger a script on domain controllers when an alert fires.

Answer

Create an automation rule in Microsoft Sentinel to respond to Identity alerts.

Answer

Configure Microsoft Purview compliance policies to respond to Identity alerts.

Question 2

Your organization uses Microsoft Defender for Office 365. You need to ensure that when a user reports a phishing email, the email is automatically analyzed and remediated. What should you configure?

Accepted Answer

Configure User Reported Message settings to use the built-in reporting tool and automated investigation.. Configuring User Reported Message settings in Microsoft 365 Defender to use the built-in reporting tool and enable automated investigation ensures that when a user reports a phishing email, it is routed to Microsoft, analyzed, and remediated automatically (e.g., moved to quarantine, soft-deleted, or blocked for other recipients). This is the purpose-built feature for the scenario. It ties the user report directly into the automated investigation and response (AIR) pipeline.

Answer

Configure Anti-Phish policy to move messages to quarantine.

Answer

Enable Safe Attachments policy.

Answer

Enable Safe Links policy.

Question 3

You are the security analyst for a company that uses Microsoft Sentinel. You notice that a critical analytics rule has not generated any incidents in the past week, but you know that relevant logs are being ingested. You need to troubleshoot why the rule is not firing. What is the first step you should take?

Accepted Answer

Run the analytics rule's query directly in Log Analytics to see if it returns results.. The first step in troubleshooting a Sentinel analytics rule that is not generating incidents despite relevant logs being ingested is to run the rule's query directly in Log Analytics. This isolates whether the issue is with the query logic itself (e.g., syntax errors, time range misconfiguration, or data not matching the KQL conditions) rather than with data ingestion or rule settings. If the query returns results in Log Analytics, the problem lies elsewhere; if it returns no results, the query needs adjustment.

Answer

Check the incident creation rule configuration.

Answer

Verify that the log sources are connected and sending data to the workspace.

Answer

Disable and re-enable the analytics rule.

Question 4

Your company uses Microsoft Defender XDR. The security team needs to restrict access to the Microsoft Defender portal so that only analysts in the 'Security Operations' group can view incidents. What is the most efficient way to achieve this?

Accepted Answer

Create a custom role in the Microsoft Defender portal with permissions to view incidents and assign it to the Security Operations group.. Microsoft Defender XDR uses role-based access control (RBAC) within the portal itself. Creating a custom role with permissions to view incidents and assigning it to the Security Operations group directly controls access to incident data without affecting broader Microsoft Entra ID roles or requiring Conditional Access policies. This is the most efficient method as it scopes permissions precisely to the Defender portal's incident management functionality.

Answer

Assign the Security Operations group the Defender for Endpoint administrator role.

Answer

Configure Conditional Access policy to allow only Security Operations group to sign in to the Defender portal.

Answer

Assign the Security Operations group the Security Reader role in Microsoft Entra ID.

Question 5

You manage Microsoft Sentinel. You need to ensure that an automated response is triggered when a specific type of incident is created. The response should send an email to the on-call security engineer. What should you use?

Accepted Answer

Create an automation rule that runs a playbook when an incident is created.. Automation rules in Microsoft Sentinel can trigger a playbook (an Azure Logic Apps workflow) when an incident is created. The playbook can include an action to send an email to the on-call security engineer, providing the automated response required by the scenario.

Answer

Use a watchlist to map incident types to email addresses and configure a scheduled query.

Answer

Modify the analytics rule to include an email action in the rule settings.

Answer

Create a workbook that alerts via email when new incidents appear.

Question 6

Which TWO actions should you take to improve the performance of Microsoft Sentinel analytics rules that query large datasets?

Accepted Answer

Use a time filter in the query to limit the data range.. Applying a time filter (e.g., using the `TimeGenerated` column) in a KQL query restricts the dataset to only the relevant time window, which significantly reduces the amount of data scanned by Microsoft Sentinel. This directly improves query performance by minimizing I/O and processing overhead, especially when analytics rules run against large log tables.

Answer

Use a watchlist to pre-filter results.

Answer

Change the data type of the columns to string.

Answer

Simplify the event by removing unused columns using project.

Question 7

Which THREE components are required to enable automated investigation and response (AIR) in Microsoft Defender XDR for alerts from Microsoft Defender for Identity?

Accepted Answer

Automated investigation and response enabled in Microsoft Defender XDR.. Automated investigation and response (AIR) must be explicitly enabled in Microsoft Defender XDR to allow the platform to automatically respond to alerts. Without this setting enabled, even if other components are in place, the system will not trigger automated actions for Defender for Identity alerts.

Answer

Microsoft Sentinel workspace configured to ingest Defender for Identity alerts.

Answer

A custom playbook in Microsoft Sentinel.

Question 8

Which TWO tasks can you perform using Microsoft Sentinel automation rules?

Accepted Answer

Assign an incident to an analyst.. Automation rules in Microsoft Sentinel can directly assign incidents to specific analysts or groups without requiring a playbook. This is a native action within the automation rule configuration, enabling immediate ownership and accountability for incident response.

Answer

Send an email notification without a playbook.

Answer

Delete an incident.

Answer

Create a new analytics rule.

Question 9

Refer to the exhibit. You have a Logic Apps playbook that triggers on Microsoft Sentinel alerts. The playbook is not posting messages to Teams. What is the most likely cause?

Accepted Answer

The playbook is using the wrong trigger type.. The playbook is triggered on Microsoft Sentinel alerts, but Logic Apps requires a specific trigger type to process these alerts correctly. The most likely cause is that the playbook uses a generic HTTP trigger instead of the 'Microsoft Sentinel Incident' or 'Microsoft Sentinel Alert' trigger, which is designed to parse the alert payload and provide the necessary context for downstream actions like posting to Teams. Without the correct trigger, the playbook may not receive the alert data or may fail to execute the Teams connector properly.

Answer

The Teams connector is not authenticated.

Answer

The trigger body is not referencing the correct alert ID.

Answer

The JSON syntax is invalid.

Question 10

Refer to the exhibit. You have a KQL query in a Microsoft Sentinel analytics rule. The rule is not generating incidents even though there are 'Suspicious sign-in' alerts from non-contoso.com users. What is the most likely issue?

Accepted Answer

The query is querying the wrong table. 'Suspicious sign-in' alerts may be in a different table.. The query is likely querying the 'Alert' table, but 'Suspicious sign-in' alerts from non-contoso.com users are generated by Microsoft Defender for Identity or Microsoft Entra ID Protection and stored in the 'SecurityAlert' table (or 'AlertEvidence' in the new schema). The rule's query must reference the correct table to retrieve these alerts; otherwise, no matching records are found, and no incidents are created.

Answer

The 'extend' line is incorrectly parsing the entity.

Answer

The 'where' clause using !endswith is incorrect.

Answer

The query does not filter by AlertName correctly.

Question 11

Your organization uses Microsoft Sentinel. You need to ensure that incident investigation is efficient by automatically grouping related alerts into incidents. Which configuration should you use?

Accepted Answer

Configure alert grouping in the analytics rule wizard. Microsoft Sentinel's analytics rule wizard includes a dedicated 'Alert grouping' configuration that allows you to specify how alerts from the same analytics rule are automatically combined into a single incident. This setting is essential for efficient incident investigation, as it reduces alert noise by grouping related alerts based on criteria such as matching entities, time windows, or custom alert details, ensuring that security analysts work with consolidated incidents rather than individual alerts.

Answer

Create an automation rule to group alerts

Answer

Use a playbook to merge incidents

Answer

Define a watchlist to consolidate alerts

Question 12

Your security team uses Microsoft Defender XDR. You need to ensure that a user who is suspected of credential theft is immediately blocked from accessing corporate email and cloud apps, while the investigation continues. What should you do?

Accepted Answer

Use Microsoft Defender for Cloud Apps to suspend the user. Suspending the user in Microsoft Defender for Cloud Apps immediately revokes the user's access tokens and active sessions for cloud apps, blocking further access to corporate email and cloud apps without deleting the account. This allows the investigation to continue while the user is isolated, which is the precise requirement for a suspected credential theft scenario.

Answer

Create a conditional access policy in Microsoft Entra ID to block the user

Answer

Disable the user account in Microsoft Entra ID

Answer

Reset the user's password from Microsoft Entra ID

Question 13

You manage a Microsoft Sentinel workspace that ingests logs from multiple sources. You notice that the workspace is approaching its daily ingestion quota, and some data sources are being dropped. You need to ensure that security-related logs are prioritized and that non-critical logs are not ingested. What should you configure?

Accepted Answer

Use data collection rules (DCRs) to filter log ingestion. Data collection rules (DCRs) allow you to define transformations that filter logs before they are ingested into a Log Analytics workspace. By configuring a DCR with a KQL-based transformation, you can drop non-critical logs while ensuring security-related logs are always ingested, preventing them from being dropped when the daily quota is approached.

Answer

Create analytic rules with entity mapping to prioritize alerts

Answer

Set a daily cap on the Log Analytics workspace

Answer

Configure diagnostic settings to exclude certain logs

Question 14

Your incident response team uses Microsoft Sentinel. You need to automatically assign incidents to the appropriate analyst based on the type of alert. What should you create?

Accepted Answer

An automation rule with an 'Assign owner' action. Automation rules in Microsoft Sentinel allow you to define conditions (e.g., alert type) and corresponding actions, including 'Assign owner' to automatically route incidents to the appropriate analyst. This is the native, no-code mechanism for incident assignment based on alert properties, making it the correct choice for this requirement.

Answer

A playbook that runs when an incident is created

Answer

A watchlist containing analyst names

Answer

A hunting bookmark to track assignments

Question 15

Your company uses Microsoft Defender for Cloud Apps. You discover that a user is accessing sensitive data from an unfamiliar IP address. You need to immediately block the user's access to all cloud apps while preserving the session for investigation. What should you do?

Accepted Answer

Use the 'Block' governance action in Defender for Cloud Apps. The 'Block' governance action in Defender for Cloud Apps immediately blocks the user's access to all cloud apps while preserving the session for investigation. This action is applied directly within the Defender for Cloud Apps portal, allowing you to stop data exfiltration without disrupting the ability to analyze the session logs or alerts. It is the only option that meets the requirement of blocking access while keeping the session intact for forensic review.

Answer

Create a conditional access policy to block the IP

Answer

Add the IP to the blocked IP address range list

Answer

Suspend the user from Microsoft Entra ID