SC-200 Manage a security operations environment Practice Test 2 — 15 Questions

Question 1

As a security operations analyst, you receive an alert from Microsoft Defender for Identity about a suspicious Kerberos activity. You need to investigate the alert and determine if it is a true positive. What should you use to pivot from the alert to the related user and device timeline?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

From the Microsoft 365 Defender portal, open the alert and click on the user or device name to view their timeline.. In the Microsoft 365 Defender portal, when you open a Microsoft Defender for Identity alert, you can directly click on the user or device name to pivot to their timeline. This timeline provides a consolidated view of activities, including Kerberos events, authentication attempts, and other related signals, enabling you to quickly assess whether the suspicious Kerberos activity is a true positive without leaving the portal.

Answer

Search for the user in Azure AD audit logs.

Answer

Open the alert in Microsoft Sentinel and use the investigation graph.

Answer

Use the Microsoft 365 compliance portal to run an eDiscovery search.

Question 2

Your organization uses Microsoft Defender for Endpoint and has enabled the 'Block at First Sight' feature. You notice that some legitimate executables are being blocked incorrectly. You need to temporarily allow these files while you submit them for analysis. What should you do?

Accepted Answer

Create an indicator of compromise (IoC) in Microsoft Defender for Endpoint to allow the file hash.. Creating an allow indicator (IoC) in Microsoft Defender for Endpoint explicitly overrides the cloud-based 'Block at First Sight' verdict for a specific file hash. This allows the legitimate executable to run while you submit it for analysis, without disabling the broader protection feature. The allow indicator takes precedence over automated blocking actions, providing a temporary, targeted exemption.

Answer

Add an application control policy in Microsoft Intune to allow the files.

Answer

Submit the files to Microsoft for analysis and wait for the verdict.

Answer

Disable the 'Block at First Sight' feature until the files are analyzed.

Question 3

Your SOC team uses Microsoft Sentinel to manage incidents. You want to improve the efficiency of incident triage by automatically enriching incidents with threat intelligence data from Microsoft Threat Intelligence. What should you configure?

Accepted Answer

Create a playbook that queries the Threat Intelligence API and adds a comment to the incident.. Playbooks in Microsoft Sentinel can be triggered by automation rules and can query the Microsoft Threat Intelligence API to retrieve threat indicators, then add a comment or tag to the incident for enrichment. Watchlists are static and cannot be directly referenced in automation rules for dynamic matching; they require a playbook to look up data. The TAXII connector only ingests indicators, and UEBA is unrelated to threat intelligence enrichment.

Answer

Enable the Threat Intelligence - TAXII connector to ingest threat indicators.

Answer

Create a watchlist containing threat intelligence data and use it in an automation rule to add tags or comments.

Answer

Enable User and Entity Behavior Analytics (UEBA) to detect anomalies.

Question 4

You are a security analyst at a company that uses Microsoft Defender for Cloud Apps. You receive an alert that an anomalous activity was detected from a user's device. You need to investigate the activity to determine if it is a true positive. What should you do first?

Accepted Answer

In the Microsoft Defender for Cloud Apps portal, open the alert and then click 'View activity' to see the detailed activity log.. The first step in investigating an anomalous activity alert in Microsoft Defender for Cloud Apps is to open the alert and click 'View activity' to examine the detailed activity log. This log provides the raw telemetry—such as IP address, user agent, timestamp, and activity type—needed to determine if the behavior is malicious or benign. Without reviewing this evidence, you cannot make an informed judgment about the alert's validity.

Answer

Use Microsoft Power BI to analyze user activity data.

Answer

Open the user's page in Microsoft Entra ID to review sign-in logs.

Answer

Create an IP address range policy to block the user's IP.

Question 5

Your company uses Microsoft Sentinel and has a workspace in the East US region. You need to ingest logs from a non-Azure Windows server located in a branch office in Europe. You have limited bandwidth and need to ensure that log ingestion does not impact network performance. What should you use?

Accepted Answer

Install the Azure Monitor Agent on the server and create a data collection rule to filter and compress logs before sending.. The Azure Monitor Agent (AMA) supports data collection rules (DCRs) that can filter logs at the source and compress data before transmission, reducing bandwidth usage. This is critical for the limited bandwidth scenario, and AMA is the modern replacement for the Log Analytics agent, designed for efficient log ingestion across regions.

Answer

Use Microsoft Defender for Endpoint to collect logs from the server and forward them to Sentinel.

Answer

Install the Log Analytics agent (MMA) on the server and configure it to send logs directly to the workspace.

Answer

Configure the server to send logs to an Azure Event Hub, then stream to Sentinel.

Question 6

Your organization has a Microsoft Sentinel workspace that ingests data from multiple sources. You notice that the cost of data ingestion is higher than expected. You need to reduce costs without affecting security visibility. Which action should you take?

Accepted Answer

Configure specific tables to use the Basic Logs tier instead of Analytics Logs.. Configuring specific tables to use the Basic Logs tier reduces ingestion costs for high-volume, low-security-value data (e.g., verbose diagnostics or debug logs) while retaining full analytical capabilities for security-critical tables in the Analytics Logs tier. Basic Logs are charged at a lower ingestion rate and support simple queries, but they lack the full KQL and indexing features of Analytics Logs, so you must carefully select which tables to downgrade to avoid impacting security visibility.

Answer

Reduce the data retention period for all tables to 30 days.

Answer

Disable the collection of Windows event logs from domain controllers.

Answer

Export logs to Azure Storage and use Azure Data Explorer for analysis.

Question 7

Your SOC uses Microsoft Defender for Office 365. You need to configure a policy that automatically moves malicious email attachments to quarantine before they reach user mailboxes. What should you configure?

Accepted Answer

Create a Safe Attachments policy in the Microsoft 365 Defender portal.. Safe Attachments is a Microsoft Defender for Office 365 feature specifically designed to detonate email attachments in a virtual sandbox environment before delivery. By creating a Safe Attachments policy in the Microsoft 365 Defender portal, you can automatically quarantine malicious attachments, preventing them from reaching user mailboxes. This directly addresses the requirement to handle malicious attachments, not phishing or spam.

Answer

Create an anti-phishing policy to detect phishing attempts.

Answer

Create an anti-spam policy with a high confidence spam filter.

Answer

Create an anti-malware policy in the Microsoft 365 Defender portal.

Question 8

Which THREE capabilities are provided by Microsoft Defender for Cloud's Cloud Security Posture Management (CSPM) plan? (Select THREE.)

Accepted Answer

Compliance dashboard that shows your posture against regulatory standards.. Microsoft Defender for Cloud's CSPM plan includes a compliance dashboard that continuously assesses your cloud resources against regulatory standards such as SOC 2, ISO 27001, and PCI DSS. This dashboard provides a real-time view of your compliance posture, mapping security controls to specific regulatory requirements and highlighting non-compliant resources.

Answer

Endpoint detection and response for on-premises machines.

Answer

Integrated vulnerability assessment for virtual machines.

Question 9

Which TWO data sources can you connect to Microsoft Sentinel to ingest security logs? (Select TWO.)

Accepted Answer

Azure Active Directory (Microsoft Entra ID) audit logs. Azure Active Directory (Microsoft Entra ID) audit logs are a native data source for Microsoft Sentinel. They can be connected directly via the Azure AD connector, which ingests sign-in logs, audit logs, and provisioning logs into the Log Analytics workspace. This integration is essential for monitoring identity-related security events and is a standard requirement for SC-200 scenarios.

Answer

Google Cloud Platform audit logs

Answer

Trello activity logs

Answer

GitHub Actions logs

Question 10

You are reviewing an automation rule in Microsoft Sentinel with the configuration shown in the exhibit. The rule is intended to delete a custom analytics rule when an incident is created. What is the most likely issue with this configuration?

Accepted Answer

Automation rules cannot delete analytics rules; they are designed to automate incident response.. Automation rules in Microsoft Sentinel are designed to automate incident response actions, such as assigning ownership, changing status, or running playbooks. They cannot directly delete or modify analytics rules; that capability is not part of the automation rule schema or actions. The intended action in the exhibit (deleting a custom analytics rule) is outside the scope of what automation rules can perform.

Answer

The displayName should not contain spaces.

Answer

The playbook does not have permissions to delete analytics rules.

Answer

The incidentType should be set to 'AnalyticsRule' instead of 'Alert'.

Question 11

You are analyzing sign-in logs in Microsoft Sentinel. The KQL query shown in the exhibit returns a list of users who have signed into Office 365 Exchange Online more than 10 times in the last 24 hours. You need to identify potential brute-force attacks. What additional information should you add to the query to improve detection?

Accepted Answer

Include both successful and failed sign-in attempts, then filter for users with a high number of failed attempts and at least one successful attempt.. To detect brute-force attacks, you need to look for multiple failed sign-in attempts followed by a success. The current query only shows successful sign-ins. Option A is correct because adding a condition to include failed attempts (ResultType != 0) and then filtering for users with many failures and at least one success would better indicate brute-force. Option B (changing the time window to 1 hour) may help detect rapid attempts but does not consider the success pattern. Option C (filtering by unusual geographic locations) may reduce false positives but does not directly detect brute-force. Option D (excluding users with MFA) is not relevant because MFA reduces risk but does not prevent brute-force detection.

Answer

Change the time window to 1 hour to detect rapid attempts.

Answer

Add a condition to only include sign-ins from unusual geographic locations.

Answer

Add a condition to exclude users who have multi-factor authentication (MFA) enabled.

Question 12

You run the PowerShell command shown in the exhibit to enable diagnostics on an Azure VM. The VM is running Windows Server 2022. You want to collect security events and send them to a Log Analytics workspace. What should you include in the diagnostics.json configuration file?

Accepted Answer

A WindowsEventLog element with ProviderName set to 'Security' and a query of '*'.. The Azure Diagnostics extension for Windows VMs uses a WindowsEventLog element in the diagnostics.json configuration to specify which Windows Event Log channels to collect. Setting ProviderName to 'Security' and query to '*' collects all security events from the Security log, which are then forwarded to the Log Analytics workspace.

Answer

An EtwProvider element with provider GUID for Microsoft-Windows-Security-Auditing.

Answer

A Syslog element with facility set to 'auth' and severity set to 'info'.

Answer

A PerformanceCounter element with a counter for security incidents.

Question 13

Your organization uses Microsoft Defender for Cloud with enhanced security features enabled. You need to ensure that all Azure subscriptions are covered by a single Defender for Cloud policy that enforces specific security standards. The policy must be automatically applied to new subscriptions. What should you do?

Accepted Answer

Create a custom policy initiative and assign it to the root management group.. Assigning a custom policy initiative to the root management group ensures that the policy is inherited by all subscriptions under that management group, including new subscriptions as they are added. This approach enforces consistent security standards across the entire Azure environment without requiring manual intervention for each subscription.

Answer

Enable the default Defender for Cloud policy from the Azure portal.

Answer

Manually assign the policy to each subscription using PowerShell.

Answer

Configure the security contact email for each subscription.

Question 14

You are configuring Microsoft Sentinel SOAR capabilities. You need to create an automated response that, when a critical incident is created, triggers a playbook that sends a message to a Teams channel. Which connector should you use in the playbook?

Accepted Answer

Microsoft Teams connector. The Microsoft Teams connector is the correct choice because it enables the playbook to post messages directly to a Teams channel via an HTTP trigger and the Teams webhook action. This connector is specifically designed for sending notifications and messages to Teams, which aligns with the requirement to alert a channel when a critical incident is created.

Answer

Microsoft Exchange connector

Answer

Azure DevOps connector

Answer

Microsoft Entra ID connector

Question 15

Your organization uses Microsoft Defender XDR. You need to configure automatic attack disruption for identity-related threats. The solution should automatically contain a compromised user by disabling their account. Which setting should you enable?

Accepted Answer

Enable automatic attack disruption in the Microsoft Defender XDR settings.. Microsoft Defender XDR's automatic attack disruption feature is specifically designed to contain identity-related threats by automatically disabling compromised user accounts. This setting, found in the Microsoft Defender XDR settings under 'Automated investigation and response', triggers when high-confidence identity attacks (e.g., password spray, lateral movement) are detected, without requiring manual intervention or additional infrastructure.

Answer

Configure Conditional Access policies to block the user.

Answer

Use Microsoft Sentinel automation rules to disable the user.

Answer

Create a custom detection rule to alert on suspicious sign-ins.