SC-200 Manage a security operations environment Practice Test 20 — 15 Questions

Question 1

Your SOC uses Microsoft Sentinel and Microsoft Defender XDR. An incident is generated from a Microsoft Defender for Identity alert about a suspicious Kerberos ticket request. The incident is assigned the 'Medium' severity. You want to automatically increase the severity to 'High' if the user is in a privileged role, based on data from Microsoft Entra ID. What is the most efficient way to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an automation rule in Microsoft Sentinel triggered on incident creation, which runs a playbook that checks Microsoft Entra ID roles and updates the severity accordingly.. Automation rules in Microsoft Sentinel can trigger a playbook on incident creation, and that playbook can use the Microsoft Graph API to query Microsoft Entra ID for the user's role assignments. If the user holds a privileged role (e.g., Global Administrator), the playbook can programmatically update the incident's severity to 'High'. This approach is event-driven, efficient, and does not require modifying existing analytics rules or creating additional scheduled queries.

Answer

Enable automatic attack disruption in Microsoft Defender XDR to handle the incident.

Answer

Modify the analytics rule that generates the incident to check user roles during query execution.

Answer

Create a scheduled analytics rule that queries Microsoft Entra ID audit logs and updates incident severity via a watchlist.

Question 2

Your organization uses Microsoft Defender for Cloud Apps and Microsoft Sentinel. You notice that a large number of log entries from Defender for Cloud Apps are being dropped at ingestion due to 'malformed data' errors. The data connector shows a healthy status. What is the most likely cause?

Accepted Answer

The data volume exceeds the workspace's ingestion capacity, causing data truncation.. When the data volume exceeds the Log Analytics workspace's ingestion capacity, Defender for Cloud Apps log entries can be truncated mid-record, causing them to be malformed and dropped. The connector status remains healthy because the connector itself is still connected and receiving data, but the workspace's ingestion rate limit (typically 500 MB/min per workspace or 2 GB/min per workspace depending on pricing tier) causes truncation, not a connectivity or authentication failure.

Answer

The log type is not supported by Sentinel.

Answer

The Log Analytics workspace key has expired.

Answer

The Defender for Cloud Apps connector is blocked by a firewall.

Question 3

Your SOC uses Microsoft Sentinel and Microsoft Defender XDR. An incident is generated from a Microsoft Defender for Identity alert about a suspicious Kerberos ticket request. The incident is assigned the 'Medium' severity. You want to automatically increase the severity to 'High' if the user is in a privileged role, based on data from Microsoft Entra ID. What is the most efficient way to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an automation rule in Microsoft Sentinel that triggers a playbook with an approval step before executing device isolation.. It aligns with the recommended SOC workflow: an automation rule in Microsoft Sentinel triggers a playbook that includes an approval step, ensuring that device isolation only occurs after the SOC confirms the alert as a true positive. This approach maintains human oversight for low-priority incidents while leveraging automation for the response action.

Answer

Create a separate analytics rule that triggers on the same alert and uses a playbook to isolate the device.

Answer

Use automatic attack disruption in Microsoft Defender XDR to isolate the device automatically.

Answer

Configure an automated response in Defender for Endpoint to isolate the device immediately when an alert is generated.

Question 4

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You need to ensure that all incidents from Microsoft Defender XDR are synchronized to Microsoft Sentinel with the same status (e.g., 'Active', 'Resolved'). What should you configure?

Accepted Answer

Connect Microsoft Defender XDR to Microsoft Sentinel using the official data connector.. The official Microsoft Defender XDR data connector in Microsoft Sentinel automatically synchronizes incidents, including their status (e.g., 'Active', 'Resolved'), bidirectionally. This ensures that any status change in either system is reflected in the other without manual intervention or custom scripting. Option B is correct because it leverages the built-in integration that handles the synchronization natively.

Answer

Create a custom playbook to poll Defender XDR API and update Sentinel incidents.

Answer

Manually update status in both systems.

Answer

Disable the Microsoft Defender XDR connector and use separate connectors for each workload.

Question 5

Your SOC uses Microsoft Sentinel with multiple workspaces for different business units. You want to create a single dashboard that shows key performance indicators (KPIs) across all workspaces. Which approach minimizes complexity and query latency?

Accepted Answer

Use cross-workspace queries in a single dashboard that references all workspaces.. Cross-workspace queries in Microsoft Sentinel allow you to query multiple workspaces in a single KQL query using the `workspace()` expression, enabling a unified dashboard without data duplication or additional infrastructure. This minimizes complexity by avoiding data movement and reduces query latency by leveraging the existing indexing and caching within each workspace.

Answer

Export data to Azure Data Explorer and build the dashboard there.

Answer

Ingest all logs into a single workspace and create the dashboard there.

Answer

Use Power BI to query each workspace separately and combine data.

Question 6

Your organization uses Microsoft Defender for Office 365 and Microsoft Sentinel. You discover that phishing emails are bypassing Defender for Office 365 and being reported by users. You need to ensure that user-reported emails are automatically analyzed and incidents are created in Sentinel for high-confidence phishing. What should you configure?

Accepted Answer

Enable the 'User reported messages' feature in Defender for Office 365 and ensure the Microsoft Defender XDR connector is enabled in Sentinel.. Enabling the 'User reported messages' feature in Defender for Office 365 allows user-reported phishing emails to be automatically submitted to Microsoft for analysis. When the Microsoft Defender XDR connector is enabled in Sentinel, high-confidence phishing verdicts from this analysis are ingested as incidents, creating a seamless automated pipeline without custom infrastructure.

Answer

Set up a custom connector using Microsoft Graph API to ingest user-reported messages into Sentinel.

Answer

Use the Microsoft 365 Defender portal to create a submission rule for user-reported messages.

Answer

Configure a mail flow rule to forward user-reported messages to a dedicated mailbox monitored by Sentinel.

Question 7

Your SOC team uses Microsoft Sentinel and Microsoft Defender XDR. A junior analyst creates a custom analytics rule in Sentinel that generates an excessive number of incidents. The rule appears to be running but not producing any results. What is the most likely cause?

Accepted Answer

The rule's query syntax is invalid.. The most likely cause is an invalid query syntax (Option C). When a custom analytics rule in Microsoft Sentinel has a KQL syntax error, the rule will appear as 'running' in the UI but will fail to execute properly, producing zero results and therefore no incidents. The mention of 'excessive number of incidents' in the scenario is a misdirection; the analyst may have observed high incident volumes from other rules, but this particular rule is not functioning due to the syntax error. Thus, the rule is not creating any incidents despite appearing active.

Answer

The analyst does not have permissions to create incidents.

Answer

The rule is set to a low severity.

Answer

The rule is disabled.

Question 8

Which TWO actions are valid ways to reduce the number of false positive incidents in Microsoft Sentinel without disabling analytics rules?

Accepted Answer

Modify the rule's query to include additional filters.. Modifying the rule's query to include additional filters directly reduces false positives by narrowing the conditions that trigger an alert. This approach refines the detection logic without disabling the rule, ensuring only events that more precisely match the intended threat pattern generate incidents.

Answer

Configure the rule to group all alerts into a single incident per entity.

Answer

Increase the rule run frequency.

Answer

Change the incident severity to Informational.

Question 9

Which THREE are valid components of a Microsoft Sentinel automation rule?

Accepted Answer

Actions (e.g., Run playbook, Change severity). Automation rules in Microsoft Sentinel allow you to define actions such as running a playbook or changing the severity of an incident. These actions are executed automatically when the rule's trigger and conditions are met, enabling streamlined incident response without manual intervention.

Answer

Watchlist

Answer

KQL query

Question 10

Which TWO are supported data sources for Microsoft Sentinel?

Accepted Answer

Microsoft Entra ID audit logs. Microsoft Entra ID audit logs (Option C) are a native data source for Microsoft Sentinel because Sentinel is built on Azure Monitor Logs and directly ingests Entra ID (formerly Azure AD) diagnostic settings via the Azure portal or API. This integration requires no additional connectors or agents, as Entra ID audit logs are automatically forwarded to a Log Analytics workspace when configured under 'Diagnostic settings' in the Entra ID blade.

Answer

Google Cloud VPC Flow Logs

Answer

Windows Server 2008 event logs

Answer

On-premises syslog-ng

Question 11

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You need to ensure that incidents created in Microsoft Defender XDR are automatically synchronized to Microsoft Sentinel with the least administrative effort. What should you configure?

Accepted Answer

Enable the Microsoft Defender XDR data connector in Microsoft Sentinel.. The Microsoft Defender XDR data connector in Microsoft Sentinel provides a built-in, one-click integration that automatically synchronizes incidents from Microsoft Defender XDR to Microsoft Sentinel with no custom development required. This connector uses the Microsoft Graph Security API to ingest incidents, alerts, and evidence, ensuring seamless bidirectional synchronization with the least administrative effort.

Answer

Create a Logic App that uses the Microsoft Defender XDR API to fetch incidents and push them to Microsoft Sentinel.

Answer

Use the Microsoft Sentinel API to pull incidents from Microsoft Defender XDR.

Answer

Enable raw data ingestion from Microsoft Defender for Endpoint to Microsoft Sentinel.

Question 12

You are reviewing an analytics rule configuration in Microsoft Sentinel using ARM template JSON. The rule is enabled and incident creation is set to true. However, when alerts are generated, they are not being grouped into a single incident. What is the most likely reason?

Accepted Answer

The groupingConfiguration is disabled.. The groupingConfiguration in Microsoft Sentinel analytics rules controls whether alerts are grouped into a single incident. When this configuration is disabled, each alert generates its own separate incident, even if the rule is enabled and incident creation is set to true. Therefore, the most likely reason alerts are not being grouped is that the groupingConfiguration is disabled.

Answer

The lookbackDuration is set to 5 hours which is too short.

Answer

The matchingMethod is set to 'AllEntities' which is not supported.

Answer

The rule is not enabled properly.

Question 13

Your organization uses Microsoft Sentinel. You need to ensure that only users with the appropriate permissions can run playbooks from within the incident investigation interface. What role should you assign to the security operations team?

Accepted Answer

Microsoft Sentinel Contributor. The Microsoft Sentinel Contributor role includes the ability to create and edit playbooks, as well as run them from the incident investigation interface. This role grants the necessary permissions to manage automation rules and execute playbooks, which is required for the security operations team to respond to incidents effectively.

Answer

Microsoft Sentinel Reader

Answer

Microsoft Sentinel Responder

Answer

Global Administrator in Microsoft Entra ID

Question 14

Your company uses Microsoft Sentinel and has enabled the Microsoft Defender XDR connector. You notice that incidents from Microsoft Defender for Cloud Apps are not appearing in Microsoft Sentinel. All other Defender XDR incidents appear correctly. What is the most likely cause?

Accepted Answer

The Microsoft Defender for Cloud Apps data connector is not enabled in Microsoft Sentinel.. The Microsoft Defender XDR connector ingests incidents from all Microsoft Defender products, including Defender for Cloud Apps, but only if the corresponding data connector is enabled in Microsoft Sentinel. Option D is correct because the Microsoft Defender for Cloud Apps data connector must be explicitly enabled to allow incident ingestion from that source; without it, incidents from Defender for Cloud Apps will not appear even though the XDR connector is active.

Answer

The security operations team does not have the appropriate permissions.

Answer

The Microsoft Defender XDR connector only ingests incidents from Microsoft Defender for Endpoint.

Answer

The Microsoft 365 E5 license is not assigned to the users.

Question 15

Your organization is using Microsoft Sentinel and you are responsible for managing the security operations environment. You need to ensure that a new security analyst can triage incidents but cannot modify analytics rules. Which role should you assign?

Accepted Answer

Microsoft Sentinel Responder. The Microsoft Sentinel Responder role provides the necessary permissions to triage incidents (view, investigate, respond) while explicitly excluding write access to analytics rules. This matches the requirement for a security analyst who needs to handle incidents but cannot modify detection logic.

Answer

Microsoft Sentinel Reader

Answer

Microsoft Sentinel Contributor

Answer

Microsoft Sentinel Contributor with a custom role denying rule modification