SC-200 Manage a security operations environment Practice Test 2 — 15 Questions

Question 1

Your organization has deployed Microsoft Sentinel and configured a workspace with data connectors for Microsoft 365 Defender, Azure Activity, and Office 365. You need to ensure that security incidents are automatically assigned to the appropriate analyst based on the incident type. What should you configure?

Accepted Answer

Create an automation rule that runs when an incident is created, with conditions on the incident title, and an action to assign the incident to a specific owner.. Option C is correct because automation rules in Microsoft Sentinel allow you to define conditions (e.g., incident title containing specific keywords) and actions (e.g., assign incident to a specific owner) that run automatically when an incident is created. This directly meets the requirement to assign incidents to the appropriate analyst based on incident type without manual intervention.

Answer

Create a playbook triggered by incident creation that assigns the incident to a user based on the incident title.

Answer

Add a watchlist that maps incident types to analyst email addresses and configure a scheduled analytics rule.

Answer

Configure a Microsoft 365 Defender incident assignment rule in the Microsoft 365 Defender portal.

Question 2

Your company uses Microsoft Defender for Cloud to assess the security posture of hybrid workloads. You are configuring a governance rule to automatically remediate a specific recommendation that is out of compliance. The recommendation is 'Virtual machines should be migrated to new Azure Resource Manager resources'. You need to ensure that the remediation is applied at scale across all subscriptions in the management group. What should you do?

Accepted Answer

Create a governance rule in Microsoft Defender for Cloud with scope set to the management group, condition on the recommendation, and action set to 'Automatic'.. Option C is correct because governance rules in Microsoft Defender for Cloud allow you to define automatic remediation actions for specific recommendations at scale. By setting the scope to the management group, the rule applies to all subscriptions within that group, and the 'Automatic' action triggers the built-in remediation script for the 'Virtual machines should be migrated to new Azure Resource Manager resources' recommendation without requiring custom scripting or policy assignments.

Answer

Create a PowerShell script that runs on each VM to migrate it, and execute it via Azure Automation.

Answer

Create an Azure Policy initiative that includes the recommendation and assign it with a remediation task at the management group level.

Answer

Create a governance rule in Microsoft Defender for Cloud with scope set to a single subscription and action set to 'Automatic'.

Question 3

As a security operations analyst, you receive an alert from Microsoft Defender for Identity about a suspicious Kerberos activity. You need to investigate the alert and determine if it is a true positive. What should you use to pivot from the alert to the related user and device timeline?

Accepted Answer

From the Microsoft 365 Defender portal, open the alert and click on the user or device name to view their timeline.. Option C is correct because in the Microsoft 365 Defender portal, when you open a Microsoft Defender for Identity alert, you can directly click on the user or device name to pivot to their timeline. This timeline provides a consolidated view of activities, including Kerberos events, authentication attempts, and other related signals, enabling you to quickly assess whether the suspicious Kerberos activity is a true positive without leaving the portal.

Answer

Search for the user in Azure AD audit logs.

Answer

Open the alert in Microsoft Sentinel and use the investigation graph.

Answer

Use the Microsoft 365 compliance portal to run an eDiscovery search.

Question 4

Your organization uses Microsoft Defender for Endpoint and has enabled the 'Block at First Sight' feature. You notice that some legitimate executables are being blocked incorrectly. You need to temporarily allow these files while you submit them for analysis. What should you do?

Accepted Answer

Create an indicator of compromise (IoC) in Microsoft Defender for Endpoint to allow the file hash.. Option A is correct because creating an allow indicator (IoC) in Microsoft Defender for Endpoint explicitly overrides the cloud-based 'Block at First Sight' verdict for a specific file hash. This allows the legitimate executable to run while you submit it for analysis, without disabling the broader protection feature. The allow indicator takes precedence over automated blocking actions, providing a temporary, targeted exemption.

Answer

Add an application control policy in Microsoft Intune to allow the files.

Answer

Submit the files to Microsoft for analysis and wait for the verdict.

Answer

Disable the 'Block at First Sight' feature until the files are analyzed.

Question 5

Your SOC team uses Microsoft Sentinel to manage incidents. You want to improve the efficiency of incident triage by automatically enriching incidents with threat intelligence data from Microsoft Threat Intelligence. What should you configure?

Accepted Answer

Create a watchlist containing threat intelligence data and use it in an automation rule to add tags or comments.. Option C is correct because watchlists in Microsoft Sentinel allow you to store and reference static threat intelligence data directly within automation rules. By creating a watchlist with threat indicators and configuring an automation rule to add tags or comments based on matches, you can enrich incidents without requiring external API calls or complex playbooks, thus improving triage efficiency.

Answer

Enable the Threat Intelligence - TAXII connector to ingest threat indicators.

Answer

Create a playbook that queries the Threat Intelligence API and adds a comment to the incident.

Answer

Enable User and Entity Behavior Analytics (UEBA) to detect anomalies.

Question 6

You are a security analyst at a company that uses Microsoft Defender for Cloud Apps. You receive an alert that an anomalous activity was detected from a user's device. You need to investigate the activity to determine if it is a true positive. What should you do first?

Accepted Answer

In the Microsoft Defender for Cloud Apps portal, open the alert and then click 'View activity' to see the detailed activity log.. Option B is correct because the first step in investigating an anomalous activity alert in Microsoft Defender for Cloud Apps is to open the alert and click 'View activity' to examine the detailed activity log. This log provides the raw telemetry—such as IP address, user agent, timestamp, and activity type—needed to determine if the behavior is malicious or benign. Without reviewing this evidence, you cannot make an informed judgment about the alert's validity.

Answer

Use Microsoft Power BI to analyze user activity data.

Answer

Open the user's page in Microsoft Entra ID to review sign-in logs.

Answer

Create an IP address range policy to block the user's IP.

Question 7

Your company uses Microsoft Sentinel and has a workspace in the East US region. You need to ingest logs from a non-Azure Windows server located in a branch office in Europe. You have limited bandwidth and need to ensure that log ingestion does not impact network performance. What should you use?

Accepted Answer

Install the Azure Monitor Agent on the server and create a data collection rule to filter and compress logs before sending.. Option C is correct because the Azure Monitor Agent (AMA) supports data collection rules (DCRs) that can filter logs at the source and compress data before transmission, reducing bandwidth usage. This is critical for the limited bandwidth scenario, and AMA is the modern replacement for the Log Analytics agent, designed for efficient log ingestion across regions.

Answer

Use Microsoft Defender for Endpoint to collect logs from the server and forward them to Sentinel.

Answer

Install the Log Analytics agent (MMA) on the server and configure it to send logs directly to the workspace.

Answer

Configure the server to send logs to an Azure Event Hub, then stream to Sentinel.

Question 8

Your organization has a Microsoft Sentinel workspace that ingests data from multiple sources. You notice that the cost of data ingestion is higher than expected. You need to reduce costs without affecting security visibility. Which action should you take?

Accepted Answer

Configure specific tables to use the Basic Logs tier instead of Analytics Logs.. Basic Logs in Microsoft Sentinel are a lower-cost option for high-volume, verbose logs that are used for infrequent querying. Option B is correct because you can move verbose logs (e.g., from VMs) to Basic Logs tier. Option A (reducing retention) affects visibility. Option C (turning off connectors) reduces visibility. Option D (using Azure Storage) is not integrated with Sentinel for queries.

Answer

Reduce the data retention period for all tables to 30 days.

Answer

Disable the collection of Windows event logs from domain controllers.

Answer

Export logs to Azure Storage and use Azure Data Explorer for analysis.

Question 9

Your SOC uses Microsoft Defender for Office 365. You need to configure a policy that automatically moves malicious email attachments to quarantine before they reach user mailboxes. What should you configure?

Accepted Answer

Create a Safe Attachments policy in the Microsoft 365 Defender portal.. Safe Attachments is a Microsoft Defender for Office 365 feature specifically designed to detonate email attachments in a virtual sandbox environment before delivery. By creating a Safe Attachments policy in the Microsoft 365 Defender portal, you can automatically quarantine malicious attachments, preventing them from reaching user mailboxes. This directly addresses the requirement to handle malicious attachments, not phishing or spam.

Answer

Create an anti-phishing policy to detect phishing attempts.

Answer

Create an anti-spam policy with a high confidence spam filter.

Answer

Create an anti-malware policy in the Microsoft 365 Defender portal.

Question 10

Which TWO actions can be performed using automation rules in Microsoft Sentinel? (Select TWO.)

Accepted Answer

Assign an incident to a specific owner.. Option C is correct because automation rules in Microsoft Sentinel can perform actions such as assigning an incident to a specific owner. This is a built-in action within the automation rule configuration, allowing you to automatically set the owner field of an incident based on conditions like severity or rule ID, without requiring a playbook.

Answer

Create a new incident from an alert.

Answer

Modify the query of an existing analytics rule.

Answer

Delete an incident automatically.

Question 11

Which THREE capabilities are provided by Microsoft Defender for Cloud's Cloud Security Posture Management (CSPM) plan? (Select THREE.)

Accepted Answer

Compliance dashboard that shows your posture against regulatory standards.. Option A is correct because Microsoft Defender for Cloud's CSPM plan includes a compliance dashboard that continuously assesses your cloud resources against regulatory standards such as SOC 2, ISO 27001, and PCI DSS. This dashboard provides a real-time view of your compliance posture, mapping security controls to specific regulatory requirements and highlighting non-compliant resources.

Answer

Endpoint detection and response for on-premises machines.

Answer

Integrated vulnerability assessment for virtual machines.

Question 12

Which TWO data sources can you connect to Microsoft Sentinel to ingest security logs? (Select TWO.)

Accepted Answer

Azure Active Directory (Microsoft Entra ID) audit logs. Azure Active Directory (Microsoft Entra ID) audit logs are a native data source for Microsoft Sentinel. They can be connected directly via the Azure AD connector, which ingests sign-in logs, audit logs, and provisioning logs into the Log Analytics workspace. This integration is essential for monitoring identity-related security events and is a standard requirement for SC-200 scenarios.

Answer

Google Cloud Platform audit logs

Answer

Trello activity logs

Answer

GitHub Actions logs

Question 13

You are reviewing an automation rule in Microsoft Sentinel with the configuration shown in the exhibit. The rule is intended to delete a custom analytics rule when an incident is created. What is the most likely issue with this configuration?

Accepted Answer

Automation rules cannot delete analytics rules; they are designed to automate incident response.. Automation rules in Microsoft Sentinel are designed to automate incident response actions, such as assigning ownership, changing status, or running playbooks. They cannot directly delete or modify analytics rules; that capability is not part of the automation rule schema or actions. The intended action in the exhibit (deleting a custom analytics rule) is outside the scope of what automation rules can perform.

Answer

The displayName should not contain spaces.

Answer

The playbook does not have permissions to delete analytics rules.

Answer

The incidentType should be set to 'AnalyticsRule' instead of 'Alert'.

Question 14

You are analyzing sign-in logs in Microsoft Sentinel. The KQL query shown in the exhibit returns a list of users who have signed into Office 365 Exchange Online more than 10 times in the last 24 hours. You need to identify potential brute-force attacks. What additional information should you add to the query to improve detection?

Accepted Answer

Include both successful and failed sign-in attempts, then filter for users with a high number of failed attempts and at least one successful attempt.. To detect brute-force attacks, you need to look for multiple failed sign-in attempts followed by a success. The current query only shows successful sign-ins. Option A is correct because adding a condition to include failed attempts (ResultType != 0) and then filtering for users with many failures and at least one success would better indicate brute-force. Option B (excluding MFA) does not help. Option C (filtering by location) may reduce false positives but not detect brute-force. Option D (time bin) is already there.

Answer

Change the time window to 1 hour to detect rapid attempts.

Answer

Add a condition to only include sign-ins from unusual geographic locations.

Answer

Add a condition to exclude users who have multi-factor authentication (MFA) enabled.

Question 15

You run the PowerShell command shown in the exhibit to enable diagnostics on an Azure VM. The VM is running Windows Server 2022. You want to collect security events and send them to a Log Analytics workspace. What should you include in the diagnostics.json configuration file?

Accepted Answer

A WindowsEventLog element with ProviderName set to 'Security' and a query of '*'.. Option B is correct because the Azure Diagnostics extension for Windows VMs uses a WindowsEventLog element in the diagnostics.json configuration to specify which Windows Event Log channels to collect. Setting ProviderName to 'Security' and query to '*' collects all security events from the Security log, which are then forwarded to the Log Analytics workspace.

Answer

An EtwProvider element with provider GUID for Microsoft-Windows-Security-Auditing.

Answer

A Syslog element with facility set to 'auth' and severity set to 'info'.

Answer

A PerformanceCounter element with a counter for security incidents.