SC-200 Manage a security operations environment Practice Test 2 — 15 Questions

Question 1

Your security team uses Microsoft Defender XDR (formerly Microsoft 365 Defender) to investigate incidents. You notice that some alerts from Microsoft Defender for Endpoint are not being automatically correlated into incidents as expected. You have confirmed that the relevant alert sources are enabled in the Microsoft Defender XDR portal. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Incident correlation rules are not enabled for the relevant alert sources.. Microsoft Defender XDR uses built-in correlation logic to automatically group related alerts from different sources (e.g., Defender for Endpoint, Defender for Office 365) into incidents. If alerts from a specific source, such as Defender for Endpoint, are not being correlated, the most likely cause is that the incident correlation rules for that source are not enabled in the Microsoft Defender XDR portal. Enabling the alert source alone is insufficient; the correlation engine must be explicitly activated for each source to aggregate alerts into incidents.

Answer

Alert tuning rules are causing the alerts to be excluded.

Answer

Automation rules in Microsoft Sentinel are deleting the alerts.

Answer

Alert suppression rules are blocking the alerts.

Question 2

Which TWO Azure services can be used to automate response actions in Microsoft Sentinel when an incident is created?

Accepted Answer

Azure Logic Apps. Azure Logic Apps (B) is correct because Microsoft Sentinel playbooks are built on Logic Apps, and a playbook with an incident-created trigger can automatically run response actions (e.g., block an IP, post to Teams, create a ticket) when an incident is generated. Power Automate (E) is also correct because it is the same underlying workflow engine as Logic Apps and is supported for creating and running Sentinel playbooks, including automation rules that invoke playbooks on incident creation. Azure Automation (A) is not the Sentinel playbook mechanism; it runs runbooks and can be invoked from a playbook, but it does not itself provide the incident-created automation trigger. Azure Functions (C) is compute code that can be called by a playbook but is not the automation service that responds to Sentinel incident creation. Azure Event Grid (D) is an event-routing service and does not implement Sentinel response actions on incident creation.

Answer

Azure Automation

Answer

Azure Functions

Answer

Azure Event Grid

Question 3

Refer to the exhibit. You are analyzing a KQL query in Microsoft Sentinel. The query returns no results even though you know there are alerts with the name 'Malware detected'. What is the most likely issue?

Accepted Answer

The 'Entities' column might be null for these alerts.. KQL operators are case-insensitive, so the casing of `mv-expand` is not the problem. The most likely issue is that the `Entities` column is null or empty for the matching alerts. `mv-expand` on such rows can drop them, causing the query to return no results even though alerts with the name 'Malware detected' exist.

Answer

The operator 'mv-expand' should be lowercase 'mv-expand'.

Answer

The 'project' operator should be 'project-away'.

Answer

The function 'parse_json' should be 'parse_json()' with parentheses.

Question 4

Your organization has Microsoft Defender for Cloud Apps and Microsoft Sentinel integrated. You need to create an automated playbook that, when a Microsoft Sentinel incident is created from a Defender for Cloud Apps alert, automatically suspends the user in Microsoft Entra ID and sends a notification to the security team. Which two connectors should you use in the playbook?

Accepted Answer

Microsoft Entra ID and Microsoft Teams. Microsoft Entra ID provides the identity management action to suspend a user account, and Microsoft Teams enables sending a notification to the security team via a Teams channel or chat. This combination directly fulfills the requirements of suspending the user in Entra ID and notifying the team when a Sentinel incident is triggered from a Defender for Cloud Apps alert.

Answer

Microsoft Power BI and Microsoft Teams

Answer

Azure Automation and Microsoft Sentinel

Answer

Microsoft Entra ID and Outlook.com

Question 5

Your security team uses Microsoft Defender XDR to investigate a potential malware outbreak. You need to collect a full memory dump from an affected Windows 10 device for forensic analysis. Which action should you take from the Microsoft Defender XDR portal?

Accepted Answer

Initiate a 'Collect investigation package' action.. The 'Collect investigation package' action is the closest built-in forensic collection step in Microsoft Defender XDR, gathering artifacts such as running processes, network connections, autoruns, scheduled tasks, services, installed programs, prefetch files, and the security event log. However, it does not capture a full physical memory dump — that requires a Live Response session in which the analyst runs or uploads a dedicated memory-acquisition tool and then downloads the resulting file.

Answer

Isolate the device from the network.

Answer

Run a full antivirus scan on the device.

Answer

Restrict app execution on the device.

Question 6

Refer to the exhibit. You are reviewing an Azure Policy definition intended to block malicious IPs by denying the creation of network security group rules that allow traffic from a list of blocked IPs. However, the policy is not working as expected. What is the most likely reason?

Accepted Answer

The policy rule does not evaluate the source IP address; it denies all security rules.. The policy rule in the exhibit uses the 'sourceAddressPrefix' condition with the parameter 'listOfBlockedIPs', but it does not include a condition to evaluate the 'sourcePortRange' or 'destinationAddressPrefix'. More critically, the rule denies all security rules regardless of the source IP because the condition logic is flawed: it denies if the source IP is in the blocked list, but it does not also check that the rule is allowing traffic (e.g., direction 'Inbound' and access 'Allow'). Without these additional conditions, the policy incorrectly denies all NSG rules, including those that are not allowing traffic from blocked IPs.

Answer

The policy mode is incorrect; it should be 'All' instead of 'Microsoft.Network/virtualNetworks'.

Answer

The parameter 'listOfBlockedIPs' is not used in the policy rule.

Answer

The effect 'deny' is not supported for this resource type.

Question 7

A junior SOC analyst receives multiple low-severity alerts from Microsoft Sentinel. The alerts are related to failed logon attempts from a single IP address over a short period. The analyst wants to group these alerts into a single incident to reduce noise. What should the analyst do?

Accepted Answer

Configure the analytics rule to group alerts into incidents by the IP address. In Microsoft Sentinel, analytics rules can be configured with incident grouping settings to group alerts into a single incident based on entity matching, such as IP address. By configuring the analytics rule to group alerts by the IP address, the analyst ensures that multiple failed logon alerts from the same IP are consolidated into one incident, reducing noise. This is the built-in, automated approach for alert grouping.

Answer

Use the Microsoft Defender XDR incident queue to group the alerts

Answer

Create an automation rule to close duplicate alerts

Answer

Manually merge the alerts into one incident in the Sentinel incidents blade

Question 8

Refer to the exhibit. You have created a scheduled analytics rule in Microsoft Sentinel as shown. The rule is not generating any incidents, even though you know Copilot for Microsoft 365 is accessing sensitive files. What is the most likely cause?

Accepted Answer

The table being queried does not contain Copilot events. The rule queries the 'SensitivityLabelEvents' table, which tracks sensitivity label changes but does not contain Copilot for Microsoft 365 events. Copilot events are stored in the 'MicrosoftCopilotAudit' table (or 'CloudAppEvents' with specific filters). Since the query targets the wrong table, no matching records are returned, and no incidents are generated.

Answer

The triggerThreshold is too high

Answer

The severity is set to Medium, which suppresses incidents

Answer

The queryFrequency is too short

Question 9

Your organization uses Microsoft Sentinel with a pay-as-you-go pricing tier. You need to reduce costs by archiving older logs that are rarely accessed. Which action should you take?

Accepted Answer

Configure a lifecycle management policy in Azure Storage to transition logs to the archive tier after the retention period.. The correct action is to configure a lifecycle management policy in Azure Storage to transition logs to the archive tier after the retention period. Microsoft Sentinel can export data to Azure Storage for long-term retention, and lifecycle management policies automatically move blobs to cooler tiers (Cool, Archive) based on age, significantly reducing storage costs for rarely accessed logs. This approach preserves the data for compliance or occasional investigation while optimizing cost, aligning with the requirement to archive older logs.

Answer

Switch the Log Analytics workspace to Basic Logs tier for the Sentinel tables.

Answer

Reduce the workspace retention period from 90 days to 30 days.

Answer

Create a Data Collection Rule to filter out logs before ingestion.

Question 10

Your organization uses Microsoft Defender for Cloud Apps and Microsoft Sentinel. You discover that a user is performing unusual bulk downloads from SharePoint. You need to automatically create an incident in Sentinel and suspend the user in Microsoft Entra ID. What should you use?

Accepted Answer

Create a scheduled analytics rule in Sentinel and use automation rules to trigger a playbook that suspends the user.. A scheduled analytics rule in Sentinel can detect the unusual bulk download behavior from SharePoint (via ingested logs from Defender for Cloud Apps or Office 365 connector). An automation rule on that analytics rule triggers a playbook (Azure Logic App) that uses the Microsoft Graph API to suspend the user in Microsoft Entra ID, creating an incident automatically as part of the rule's configuration.

Answer

Configure a Microsoft Entra ID Protection policy to require password reset for risky users.

Answer

Use a playbook triggered by an incident creation rule to suspend the user.

Answer

Configure a policy in Defender for Cloud Apps with a governance action to suspend the user.

Question 11

Your Microsoft Sentinel workspace has multiple analytics rules generating incidents. You need to automatically group related incidents from different rules into a single incident to reduce analyst workload. The grouping should occur within 30 minutes of the first incident creation. What should you do?

Accepted Answer

Create an incident creation rule that groups alerts from multiple analytics rules based on entity matching.. Incident creation rules in Microsoft Sentinel can aggregate alerts from multiple analytics rules into a single incident based on entity matching and a time window. This meets the requirement to group related incidents from different rules within 30 minutes. Option B is incorrect because incident grouping in analytics rule settings only groups alerts within the same rule, not across different rules. Option A could work with a custom playbook but is more complex and not the native solution. Option D is manual and does not automate the grouping.

Answer

Use an automation rule with a playbook that queries for related incidents and merges them.

Answer

Configure incident grouping in the analytics rule settings with a matching condition and a 30-minute time window.

Answer

Create a workbook to display related incidents and manually merge them.

Question 12

Refer to the exhibit. You deploy this ARM template to deploy a saved search in a Microsoft Sentinel workspace. After deployment, the saved search does not appear in Sentinel. What is the most likely reason?

Accepted Answer

The apiVersion is outdated for saved searches in Sentinel.. The apiVersion specified in the ARM template is outdated for saved searches in Microsoft Sentinel. Saved searches require a specific apiVersion (e.g., '2021-04-01' or later) that supports the 'Microsoft.OperationalInsights/workspaces/savedSearches' resource type. An outdated apiVersion can cause the deployment to fail silently or not register the saved search in Sentinel, even if the template syntax is otherwise valid.

Answer

The query syntax is invalid.

Answer

The resource type is incorrect.

Answer

The name parameter is incorrectly formatted.

Question 13

Which TWO are valid methods to ingest syslog data into Microsoft Sentinel?

Accepted Answer

Use the Syslog data connector from the Content hub. Option A is correct because Microsoft Sentinel provides a Syslog data connector (available via the Content hub) that uses the Log Analytics agent/AMA to collect syslog events from Linux devices into the Syslog table in the workspace. Option C is correct because the Log Analytics agent (MMA/OMS agent) installed on Linux machines can be configured to collect syslog facilities and severities and forward them to the Log Analytics workspace that backs Microsoft Sentinel. Option B is incorrect because a syslog forwarder is used with CEF/AMA for CEF ingestion, and Cisco ASIM parsers are for normalizing Cisco logs, not a standalone ingestion method for raw syslog. Option D is incorrect because a Splunk Universal Forwarder sends data to Splunk, not natively to Microsoft Sentinel. Option E is incorrect because syslog ingestion is Linux-based via the Log Analytics/AMA agent, not a Windows-based collector forwarding through Azure Monitor agent as a supported syslog ingestion path.

Answer

Configure a syslog forwarder with the Cisco ASIM parser

Answer

Deploy a Splunk Universal Forwarder to send syslog to Sentinel

Answer

Install a Windows-based syslog collector and forward to Sentinel using the Azure Monitor agent

Question 14

Your organization uses Microsoft Defender for Office 365. You need to configure a policy that automatically moves emails containing malware to quarantine before delivery. Which policy type should you use?

Accepted Answer

Antimalware policy.. Antimalware policies in Microsoft Defender for Office 365 are specifically designed to scan inbound and outbound email messages for malware (e.g., viruses, worms, trojans) and automatically quarantine detected threats before delivery. This policy type uses the built-in malware detection engine to inspect attachments and message bodies, ensuring malicious content is blocked at the transport layer.

Answer

Anti-spam policy.

Answer

Safe Attachments policy.

Answer

Anti-phishing policy.

Question 15

Your organization uses Microsoft Sentinel with a workspace in the East US region. You have a playbook that runs an automation rule to create a support ticket in ServiceNow. The playbook fails intermittently with a timeout error. You have verified that the playbook's managed identity has the correct permissions. What should you check next?

Accepted Answer

Verify that the logic app's network connectivity allows outbound traffic to the ServiceNow endpoint, including any regional restrictions.. The playbook is a Logic App, and intermittent timeout errors when calling an external API (ServiceNow) often indicate network connectivity issues. Since the managed identity permissions are correct, the next logical step is to verify that the Logic App's outbound traffic is allowed to the ServiceNow endpoint, including any regional restrictions that might block or delay traffic from the East US region. This directly addresses the root cause of the timeout.

Answer

Ensure the playbook is assigned to an Azure Policy that allows outbound connections.

Answer

Check if the ServiceNow API has rate limits that are being exceeded.

Answer

Verify that the logic app's workflow is configured to use asynchronous operations.