SC-200 Manage a security operations environment Practice Test 20 — 15 Questions

Question 1

Your organization uses Microsoft Defender for Cloud Apps. You need to receive alerts when a user accesses a cloud app from a location that is not whitelisted. What should you configure?

Accepted Answer

Create an activity policy in Microsoft Defender for Cloud Apps.. Option D is correct because Defender for Cloud Apps allows creation of activity policies with location conditions. Option A is incorrect because conditional access policies govern access but not alerting. Option B is incorrect because access policies in Defender for Cloud Apps block or allow, but not alert. Option C is incorrect because session controls are for monitoring sessions, not creating alerts.

Answer

Create a conditional access policy in Microsoft Entra ID.

Answer

Set up a session policy in Microsoft Defender for Cloud Apps.

Answer

Configure an access policy in Microsoft Defender for Cloud Apps.

Question 2

Your SOC team uses Microsoft Sentinel incident management. You need to ensure that when an incident is created, it automatically runs a playbook to gather additional context from threat intelligence sources. What should you create?

Accepted Answer

Automation rule with a trigger on incident creation.. Option C is correct because Microsoft Sentinel automation rules can be configured with a trigger on incident creation to automatically run a playbook. This allows the SOC team to gather additional context from threat intelligence sources without manual intervention, directly addressing the requirement to execute a playbook when an incident is created.

Answer

Workbook that queries threat intelligence.

Answer

Watchlist that maps to the incident.

Answer

Analytics rule that generates an alert.

Question 3

Your organization uses Microsoft Defender for Identity. You need to receive alerts when suspicious LDAP queries are detected. What should you configure?

Accepted Answer

Configure alert rules in Microsoft Defender for Identity.. Option B is correct because Microsoft Defender for Identity includes a set of default alert rules that cover LDAP queries. Option A is incorrect because Microsoft Purview is for compliance. Option C is incorrect because Microsoft Defender for Cloud Apps is for cloud apps. Option D is incorrect because Microsoft Entra ID roles are for identity governance.

Answer

Set up an anomaly detection policy in Microsoft Defender for Cloud Apps.

Answer

Assign the Security Administrator role in Microsoft Entra ID.

Answer

Create a custom sensitivity label in Microsoft Purview.

Question 4

Which TWO actions are valid for automation rules in Microsoft Sentinel? (Choose two.)

Accepted Answer

Change the severity of an incident.. Options A and D are correct because automation rules can run playbooks and change incident severity. Option B is incorrect because automation rules do not modify analytics rules. Option C is incorrect because automation rules do not delete incidents. Option E is incorrect because automation rules do not add tags directly (tags can be added via playbooks).

Answer

Delete an incident.

Answer

Add tags to an incident.

Answer

Modify an existing analytics rule.

Question 5

Which THREE components are part of Microsoft Sentinel's SOAR capabilities? (Choose three.)

Accepted Answer

Incident management. Options A, B, and D are correct as they are core SOAR components. Option C is incorrect because workbooks are for visualization, not automation. Option E is incorrect because watchlists are for enrichment, not automation.

Answer

Workbooks

Answer

Watchlists

Question 6

Which TWO roles can be used to manage Microsoft Sentinel? (Choose two.)

Accepted Answer

Microsoft Sentinel Responder. Options A and C are correct as they are built-in roles for Sentinel management. Option B is incorrect because Compliance Administrator has limited Sentinel access. Option D is incorrect because Security Reader is read-only. Option E is incorrect because Global Administrator has wide access but is not the primary role for Sentinel management.

Answer

Compliance Administrator

Answer

Security Reader

Answer

Global Administrator

Question 7

Refer to the exhibit. You are creating an automation rule in Microsoft Sentinel. The rule is enabled but does not assign incidents. What is the most likely issue?

Accepted Answer

The action 'AssignIncident' is not a supported automation rule action.. Option C is correct because the action type 'AssignIncident' is not a valid automation rule action. Valid actions include 'RunPlaybook' and 'ChangeSeverity'. Option A is incorrect because the trigger type is valid. Option B is incorrect because the conditions are valid. Option D is incorrect because the action is not valid.

Answer

The condition 'Owner' property does not support 'Equals' operator.

Answer

The trigger type 'Microsoft.SecurityInsights/Incident' is incorrect.

Answer

The 'assignedTo' value should be a user principal name instead of an email alias.

Question 8

Your organization uses Microsoft Sentinel. You need to provide a SOC analyst with the ability to create and modify incident comments but not delete incidents. Which role should you assign?

Accepted Answer

Microsoft Sentinel Responder. Option B is correct because Microsoft Sentinel Responder role allows managing incidents including comments but not deletion. Option A is incorrect because Reader is read-only. Option C is incorrect because Contributor can delete incidents. Option D is incorrect because Global Administrator has full access.

Answer

Global Administrator

Answer

Microsoft Sentinel Contributor

Answer

Microsoft Sentinel Reader

Question 9

Your organization uses Microsoft Defender XDR. You need to ensure that when a user reports a phishing email in Outlook, it automatically triggers an investigation in Microsoft Defender XDR. What should you configure?

Accepted Answer

Enable user-reported message settings in Microsoft Defender for Office 365 and configure automated investigation.. Option D is correct because Microsoft Defender for Office 365's reporting and automation can trigger automated investigation and response (AIR) when users report phishing. Option A is incorrect because Microsoft Sentinel is not directly integrated with Outlook reporting. Option B is incorrect because Microsoft Purview is for compliance. Option C is incorrect because Microsoft Defender for Cloud Apps focuses on cloud apps.

Answer

Create a playbook in Microsoft Sentinel triggered by a custom connector.

Answer

Configure a data loss prevention policy in Microsoft Purview.

Answer

Set up a session policy in Microsoft Defender for Cloud Apps.

Question 10

Your organization uses Microsoft Sentinel with multiple workspaces. You need to ensure that incidents involving the same alert in different workspaces are automatically grouped into a single incident. What should you configure?

Accepted Answer

Configure an incident grouping rule in Microsoft Sentinel.. Incident grouping rules in Sentinel allow grouping of alerts from different workspaces into a single incident based on matching entities or alert details. Option B is correct. Option A is wrong because analytics rules are per workspace. Option C is wrong because automation rules act on incidents, not grouping. Option D is wrong because UEBA doesn't group incidents.

Answer

Enable UEBA to correlate alerts across workspaces.

Answer

Set up an automation rule to merge incidents.

Answer

Create an analytics rule that runs across all workspaces.

Question 11

You are managing Microsoft Defender XDR. The security team reports that some automated investigations are closing prematurely without sufficient evidence. You need to ensure that investigations only close when a minimum confidence level is reached. What should you modify?

Accepted Answer

Adjust the automation level in the Microsoft 365 Defender security settings.. In Defender XDR, you can set the automation level for investigations, including the confidence level required for automatic closure. Option A is correct. Option B is wrong because action center handles manual actions. Option C is wrong because it's not a tenant-level setting in that location. Option D is wrong because rules don't control investigation closure confidence.

Answer

Change the action center settings to require manual approval.

Answer

Modify the tenant-level advanced features in Microsoft Defender XDR.

Answer

Create a custom detection rule to override default behavior.

Question 12

Your organization uses Microsoft Sentinel. You need to ensure that an incident is automatically assigned to a specific analyst when it is created. What should you create?

Accepted Answer

An automation rule with an 'Assign incident' action.. Automation rules in Sentinel can trigger on incident creation and include actions like assigning owner. Option A is correct. Option B is wrong because playbooks require a trigger; automation rules are simpler. Option C is wrong because watchlists are for reference data. Option D is wrong because analytics rules create alerts, not assign incidents.

Answer

An analytics rule with an output to a specific user.

Answer

A playbook triggered by incident creation.

Answer

A watchlist that maps incident types to owners.

Question 13

You have a Microsoft Sentinel automation rule that triggers a playbook. The playbook definition is shown in the exhibit. The playbook runs but no email is sent. What is the most likely cause?

Accepted Answer

The playbook uses a recurrence trigger instead of a Microsoft Sentinel trigger.. The playbook definition shows a 'Recurrence' trigger, but automation rules in Sentinel use 'MicrosoftSentinelIncident' or 'MicrosoftSentinelAlert' triggers. A recurrence trigger is for scheduled playbooks, not incident-triggered. Option C is correct. Option A is wrong because connection names are typically 'office365' and valid. Option B is wrong because the JSON is valid. Option D is wrong because the operation 'SendEmailV2' is valid.

Answer

The JSON syntax is invalid.

Answer

The email operation 'SendEmailV2' is deprecated.

Answer

The connection name 'office365' is incorrect.

Question 14

Your organization uses Microsoft Sentinel and Microsoft Defender for Cloud. You need to ensure that security alerts from Defender for Cloud are automatically ingested into Sentinel. What should you configure?

Accepted Answer

Add the 'Microsoft Defender for Cloud' data connector in Microsoft Sentinel.. Sentinel can ingest alerts from Defender for Cloud via a data connector specifically for that purpose. Option B is correct. Option A is wrong because diagnostic settings export logs, not alerts directly. Option C is wrong because automation rules work on incidents, not ingestion. Option D is wrong because the connector is for Azure Activity, not Defender for Cloud alerts.

Answer

Enable diagnostic settings on the Defender for Cloud subscription.

Answer

Configure the 'Azure Activity' data connector.

Answer

Create an automation rule in Sentinel to fetch alerts from Defender for Cloud.

Question 15

Your organization uses Microsoft Defender for Endpoint. You need to ensure that when a malware alert is generated, an automated investigation is triggered. What should you configure?

Accepted Answer

Enable automated investigation and remediation in the Microsoft 365 Defender portal.. Defender for Endpoint has automated investigation and remediation settings that can be enabled. Option C is correct. Option A is wrong because action center is for reviewing actions, not configuring automation. Option B is wrong because indicators are for blocking, not automated investigations. Option D is wrong because threat analytics provides reports, not automated investigation triggers.

Answer

Configure the Action center settings.

Answer

Create custom indicators of compromise (IOCs).

Answer

Use threat analytics to trigger investigations.