SC-200 Manage a security operations environment Practice Test 20 — 15 Questions

Question 1

You are configuring Microsoft Sentinel automation rules to handle incidents from multiple analytics rules. You need to ensure that incidents from a specific rule are automatically assigned to the 'SOC Tier 2' group and have a severity of 'High' regardless of the original severity. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure an automation rule with 'Add tag' and 'Set severity' actions, plus 'Assign owner'. Automation rules in Microsoft Sentinel can directly modify incident properties such as severity and owner without requiring external logic apps or playbooks. Option D correctly uses the 'Set severity' action to override the original severity to 'High' and the 'Assign owner' action to assign the incident to the 'SOC Tier 2' group, fulfilling both requirements in a single, efficient rule.

Answer

Use a logic app trigger to change severity

Answer

Create a playbook to modify the incident properties

Answer

Create a separate analytics rule to override the incident

Question 2

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You want to ensure that incidents generated in Microsoft 365 Defender are automatically synchronized to Microsoft Sentinel. What should you configure?

Accepted Answer

Enable the Microsoft Defender XDR data connector in Microsoft Sentinel. The Microsoft Defender XDR data connector in Microsoft Sentinel is specifically designed to synchronize incidents from Microsoft 365 Defender into Sentinel. When enabled, this connector uses the Microsoft Graph Security API to ingest incidents, alerts, and evidence, ensuring automatic and bidirectional synchronization without requiring additional automation rules or analytics queries.

Answer

Set up an automation rule to import incidents

Answer

Configure the Microsoft Sentinel connector in Microsoft Defender XDR

Answer

Create an analytics rule to query Defender XDR data

Question 3

You are investigating a security incident in Microsoft Sentinel. You need to preserve a snapshot of the investigation including comments, bookmarks, and entities for future reference. What should you do?

Accepted Answer

Create a bookmark with the relevant data. Bookmarks in Microsoft Sentinel allow you to preserve a snapshot of an investigation, including comments, bookmarks, and entities, for future reference. Bookmarks capture the state of an investigation at a specific point in time, enabling you to revisit and share the context later.

Answer

Create an automation rule to tag the incident

Answer

Add the entities to a watchlist

Answer

Close the incident as a false positive

Question 4

Your organization uses Microsoft Defender XDR and Microsoft Sentinel. You need to ensure that when a device is identified as compromised by Defender for Endpoint, an incident is automatically created in Sentinel with high severity. What should you configure?

Accepted Answer

Create an automation rule that triggers when an incident is created and set severity to High. Automation rules in Microsoft Sentinel can be configured to run when an incident is created, and they can set the severity of the incident to High. In this scenario, when Defender for Endpoint identifies a compromised device, the Defender XDR connector creates an incident in Sentinel. The automation rule then immediately elevates the severity to High, meeting the requirement without additional manual steps or complex logic.

Answer

Configure the Defender XDR connector to create incidents

Answer

Write an analytics rule that queries Defender for Endpoint data

Answer

Create a playbook to create an incident from the alert

Question 5

Which THREE actions can be performed by automation rules in Microsoft Sentinel?

Accepted Answer

Assign an incident to a specific owner. Automation rules in Microsoft Sentinel are designed to triage and manage incidents, so option C is correct because they can assign an incident to a specific owner (for example, setting the Owner field to a user or group) as part of incident handling. Option D is correct because automation rules can trigger a playbook on an incident, which is a core capability used to run automated response logic when an incident is created or updated. Option E is correct because automation rules can add tags to an incident, enabling classification, filtering, and later automation based on those tags. Options A and B are not correct: automation rules cannot modify a data connector to ingest more logs, and they cannot create a new analytics rule; those are configuration tasks performed through the Sentinel data connectors and analytics rule creation interfaces, not through incident automation rules.

Answer

Modify a data connector to ingest more logs

Answer

Create a new analytics rule

Question 6

Which TWO are required to enable Microsoft Sentinel to use AI-generated incident summaries?

Accepted Answer

The Security Reader role assigned to the user. Microsoft Sentinel's AI-generated incident summaries require Microsoft Copilot for Security to be enabled, as this feature leverages Copilot's natural language processing capabilities to summarize incidents. Additionally, the user must have the Security Reader role assigned to access and view these summaries within Sentinel, ensuring proper permissions for security data.

Answer

An Azure OpenAI service instance deployed

Answer

A Log Analytics workspace with a premium pricing tier

Answer

A Power BI Pro license

Question 7

Refer to the exhibit. You are reviewing a playbook configuration for Microsoft Sentinel. What does this playbook do?

Accepted Answer

It runs when a high severity incident is created. The playbook is configured with a trigger condition that specifies 'When a high severity incident is created'. This means the playbook will only execute when an incident with a severity level of 'High' is generated in Microsoft Sentinel. The condition filters out incidents of other severity levels, ensuring the playbook runs exclusively for high-severity incidents.

Answer

It runs only on medium severity incidents

Answer

It runs when a new alert is generated with high severity

Answer

It runs on all incidents regardless of severity

Question 8

Refer to the exhibit. You are analyzing high severity alerts from Microsoft Defender for Endpoint in Microsoft Sentinel. What does this KQL query do?

Accepted Answer

It lists high severity Defender for Endpoint alerts, grouped by name and day, ordered by frequency. The KQL query uses `summarize` with `count()` to group alerts by `AlertName` and `startofday(TimeGenerated)`, then sorts by `count_` descending. This directly produces a list of high severity Defender for Endpoint alerts grouped by name and day, ordered by frequency, matching option C.

Answer

It counts alerts for a specific alert name

Answer

It displays detailed properties of each alert

Answer

It shows all alerts from Defender for Endpoint in the last week

Question 9

Refer to the exhibit. A security administrator runs this PowerShell script. What is the effect?

Accepted Answer

It creates an automation rule that runs a playbook on medium severity incidents. The PowerShell script uses the `New-AzSentinelAutomationRule` cmdlet to create an automation rule in Microsoft Sentinel. The `-TriggerType` parameter is set to `IncidentCreated`, and the `-Action` parameter specifies a playbook to run. The `-TriggeringLogic` parameter filters for incidents with a severity of `Medium`, so the automation rule triggers the playbook only when a medium-severity incident is created.

Answer

It creates a playbook that runs daily for high severity incidents

Answer

It schedules a daily report generation for all incidents

Answer

It creates a playbook named 'DailySummaryReport'

Question 10

You are a security analyst at a company that uses Microsoft Sentinel. You need to ensure that only users with a specific tag in Microsoft Entra ID can access the Sentinel workspace. Which Azure feature should you use?

Accepted Answer

Configure a Conditional Access policy in Microsoft Entra ID.. Conditional Access policies in Microsoft Entra ID can enforce access controls based on user attributes, including tags. By configuring a Conditional Access policy that grants access to Microsoft Sentinel only if the user has a specific tag, you can restrict workspace access at the authentication layer before any Azure RBAC evaluation occurs. This is the correct approach because Conditional Access operates at the identity level, directly controlling which users can authenticate to the Sentinel workspace.

Answer

Assign Azure RBAC roles with a condition on the tag.

Answer

Use Microsoft Entra Privileged Identity Management (PIM) to require approval for access.

Answer

Apply an Azure Policy to deny access if the user does not have the tag.

Question 11

Your organization uses Microsoft Defender XDR. You notice that automated investigations are being blocked for certain devices due to high-severity alerts. You need to ensure that automated actions can proceed for devices with a risk score below 30. What should you configure?

Accepted Answer

Configure a device group with an automated investigation and response rule that excludes devices with a risk score above 30.. Device groups in Microsoft Defender XDR allow you to scope automated investigation and response (AIR) rules based on device risk scores. By creating a device group that excludes devices with a risk score above 30, you ensure that automated actions proceed only for devices meeting your threshold, directly addressing the requirement.

Answer

Disable automated investigation for all devices and rely on manual investigation.

Answer

Adjust the Microsoft Defender for Cloud Apps policy to allow automated actions for low-risk devices.

Answer

Modify the attack surface reduction rules to allow automated actions on low-risk devices.

Question 12

You are configuring Microsoft Sentinel to ingest logs from a third-party firewall via Syslog. The data connector shows 'Connected' but no events are being received. You have verified network connectivity and firewall configuration. What should you check next?

Accepted Answer

Validate that the Data Collection Rule (DCR) is properly configured to ingest the Syslog facility and severity.. When a Syslog data connector shows 'Connected' but no events are received, the most common cause is a misconfigured Data Collection Rule (DCR). The DCR defines which Syslog facilities and severities to collect; if it does not match the firewall's actual Syslog output (e.g., facility 'local0' with severity 'informational'), events will be filtered out before ingestion. Network connectivity and firewall configuration are already verified, so the DCR is the next logical check.

Answer

Verify that the connector has the necessary OAuth permissions in Microsoft Entra ID.

Answer

Check that the user who configured the connector has the Microsoft Sentinel Contributor role.

Answer

Ensure the firewall is registered in Azure Policy as a compliant resource.

Question 13

Your organization uses Microsoft Defender for Cloud to manage security posture. You need to assign a custom initiative to a specific management group to track compliance. Which two components must you create?

Accepted Answer

A policy definition and an initiative definition.. To track compliance for a custom initiative in Microsoft Defender for Cloud, you must first create a custom policy definition that specifies the rules or effects to enforce. Then, you must create an initiative definition (a group of policy definitions) that can be assigned to a management group. This assignment enables Defender for Cloud to evaluate resources against the custom initiative and report compliance.

Answer

An Azure Blueprint and a role assignment.

Answer

An Azure RBAC role and a Log Analytics workspace.

Answer

An Azure Monitor workbook and an alert rule.

Question 14

You are a security operations analyst at a company that uses Microsoft Sentinel. You have enabled User and Entity Behavior Analytics (UEBA) to detect anomalies. A new alert fires indicating a user is logging in from an unusual location. However, the user is a known traveler. How can you reduce false positives without disabling the UEBA rule?

Accepted Answer

Add the user to the entity behavior analytics exclusion list.. Microsoft Sentinel's UEBA allows you to add specific users to an entity behavior analytics exclusion list. This prevents the UEBA engine from generating alerts for that user's anomalous activities, such as logins from unusual locations, without disabling the underlying detection rule. This approach maintains detection coverage for other users while suppressing false positives for known travelers.

Answer

Disable the UEBA anomaly rule for unusual locations.

Answer

Change the alert severity to Informational.

Answer

Increase the lookback period for the anomaly detection.

Question 15

You are reviewing an analytics rule in Microsoft Sentinel. The rule is supposed to alert when a Confidential sensitivity label file is accessed. However, no alerts have been generated despite known accesses. What is the most likely reason?

Accepted Answer

The required data connector for Microsoft Purview Information Protection is not connected.. The query should reference the MicrosoftPurviewInformationProtection table (populated by the Microsoft Purview Information Protection data connector), not a nonexistent 'SensitivityLabelEvent' table. With the connector disconnected, that table is empty, which is why the rule's query returns zero rows and no alert fires despite the query logic, schedule, and trigger threshold all being otherwise correct.

Answer

The suppression duration is set to 5 hours, which suppresses alerts.

Answer

The query frequency and period are too short to capture the events.

Answer

The trigger condition is set to 'GreaterThan' 0, which should fire on any event.