SC-200 Manage a security operations environment Practice Test 21 — 15 Questions

Question 1

You are managing Microsoft Defender for Cloud Apps. You discover that a user is downloading large amounts of data from a sanctioned cloud app. You need to automatically suspend the user's access when the download exceeds 5 GB in 10 minutes. What should you create?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

An anomaly detection policy with a mass download detection template.. An anomaly detection policy in Microsoft Defender for Cloud Apps can detect unusual user behavior, such as mass file downloads, using predefined templates like 'Mass download by a single user'. This policy can be configured to trigger automatic governance actions, including suspending the user, when the download exceeds a threshold like 5 GB in 10 minutes. It directly addresses the need to automatically suspend access based on volume and time.

Answer

A session policy to block downloads.

Answer

An app connector for the cloud app.

Answer

A data loss prevention (DLP) policy in Microsoft Purview.

Question 2

Which THREE components are part of the Microsoft Defender XDR incident management process?

Accepted Answer

Entities. Entities are a core component of the Microsoft Defender XDR incident management process because they represent the assets (such as users, devices, mailboxes, and applications) that are involved in an incident. The incident graph automatically links related entities to provide a unified view of the attack story, enabling analysts to pivot from an alert to the affected resources for investigation and response.

Answer

User settings

Answer

Playbooks

Question 3

You are a security analyst for a multinational company with Microsoft Sentinel deployed in a central workspace. You need to grant a team of analysts in the European branch the ability to view incidents and run queries, but they should not be able to modify analytics rules or data connectors. The team already has Microsoft Sentinel Reader role assigned. However, they report that they cannot run KQL queries in the Logs blade. You need to provide the minimum additional permissions. What should you do?

Accepted Answer

Assign the Log Analytics Reader role to the team on the Sentinel workspace.. The Microsoft Sentinel Reader role grants read access to Sentinel data, including incidents, but does not include the ability to run KQL queries in the Logs blade because that requires read permissions on the underlying Log Analytics workspace. The Log Analytics Reader role provides the necessary read access to log data and the ability to execute queries without granting write permissions to analytics rules or data connectors, fulfilling the requirement with minimal privileges.

Answer

Assign the Log Analytics Contributor role to the team on the Sentinel workspace.

Answer

Assign the Microsoft Sentinel Contributor role to the team on the Sentinel workspace.

Answer

Assign the Reader role to the team on the Sentinel workspace.

Question 4

You are a security operations analyst at a company that uses Microsoft Defender XDR and Microsoft Sentinel. You have configured a custom detection rule in Microsoft Defender XDR that uses a KQL query to detect suspicious PowerShell activity. The rule triggers an alert, but you want to automatically create an incident in Microsoft Sentinel and run a playbook that isolates the affected device. You have already set up the Microsoft Defender XDR connector in Sentinel and enabled incident creation from Defender XDR alerts. However, the playbook does not run automatically when a Defender XDR incident is created. You have verified that the playbook is properly configured and has the correct permissions. What should you do?

Accepted Answer

Create an automation rule in Microsoft Sentinel that triggers on incident creation and runs the playbook.. In Microsoft Sentinel, automation rules are the mechanism to trigger playbooks automatically when incidents are created or updated. Since the Defender XDR connector is already enabled and creating incidents in Sentinel, the missing piece is an automation rule in Sentinel that runs the playbook on incident creation. The playbook itself is properly configured, so the automation rule bridges the gap between incident creation and playbook execution.

Answer

Create an automation rule in Microsoft Defender XDR to run the playbook.

Answer

Modify the Microsoft Defender XDR data connector in Sentinel to enable playbook execution.

Answer

Modify the custom detection rule in Defender XDR to include a 'run playbook' action.

Question 5

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. The security team wants to automatically create an incident in Microsoft Sentinel when a Microsoft Defender for Endpoint alert is triggered. What should you configure?

Accepted Answer

Enable the Microsoft Defender XDR connector in Microsoft Sentinel and select the incident creation settings.. The Microsoft Defender XDR connector in Microsoft Sentinel is specifically designed to ingest alerts and incidents from Microsoft Defender for Endpoint and other Defender products. By enabling this connector and configuring its incident creation settings, Sentinel automatically creates incidents when Defender for Endpoint alerts are triggered, without requiring custom logic or manual polling.

Answer

Set up a Logic App custom connector to poll Defender alerts.

Answer

Configure the Security Events connector to forward Defender alerts.

Answer

Create analytics rules in Microsoft Sentinel for each Defender alert type.

Question 6

Your security operations team uses Microsoft Sentinel workbooks to monitor security posture. You notice that a workbook query is timing out when run against a large workspace. What is the best way to optimize the query without changing its results?

Accepted Answer

Use the workspace() function to query specific workspaces only.. The `workspace()` function in KQL allows you to explicitly scope a query to specific workspaces, reducing the data scanned and improving performance. By targeting only the necessary workspaces, you avoid the overhead of querying the entire large workspace, which is the root cause of the timeout. This optimization does not alter the query logic or results, as it simply restricts the data source.

Answer

Remove some filter conditions to simplify the query.

Answer

Add a summarize operator at the end of the query.

Answer

Reduce the time range of the query.

Question 7

Your organization is implementing Microsoft Sentinel in a multi-tenant environment using Azure Lighthouse. The SOC team needs to investigate incidents across all tenants from a single interface. Which configuration is required?

Accepted Answer

Onboard multiple workspaces to Azure Lighthouse and use a central workspace for investigation.. Azure Lighthouse enables cross-tenant management by allowing the SOC team to delegate access to multiple Sentinel workspaces from a single control plane. This configuration lets investigators view and manage incidents across all tenants without needing separate sign-ins or duplicating data, which is essential for a multi-tenant SOC environment.

Answer

Use Azure AD B2B to grant users from other tenants access to the workspace.

Answer

Create a single workspace and have all tenants send logs to it.

Answer

Assign custom roles in each tenant's Sentinel workspace.

Question 8

Your organization has Microsoft Defender for Cloud Apps (MDA) connected to Microsoft Sentinel. The SOC team wants to receive alerts when a user accesses a sanctioned cloud app from an anonymous IP address. What should you configure?

Accepted Answer

Create an activity policy in Defender for Cloud Apps and connect it to Sentinel.. An activity policy in Defender for Cloud Apps can be configured to trigger alerts on specific user activities, such as accessing a sanctioned app from an anonymous IP address. This policy can then be connected to Microsoft Sentinel via the Defender for Cloud Apps data connector, which ingests alerts as incidents for SOC review. File policies (A) focus on file-level actions like sharing or malware detection, not user access events, while session policies (D) control real-time access but do not generate alerts for historical or post-access monitoring.

Answer

Create a file policy in Defender for Cloud Apps.

Answer

Enable the Defender for Cloud Apps connector in Sentinel without additional configuration.

Answer

Create a session policy in Defender for Cloud Apps.

Question 9

Your Microsoft Sentinel workspace is experiencing high ingestion costs. Which of the following actions will most effectively reduce costs while maintaining security visibility?

Accepted Answer

Configure Basic Logs for verbose logs like Windows events from non-critical servers.. Configuring Basic Logs for verbose logs (e.g., Windows Event ID 4688 from non-critical servers) reduces ingestion costs by storing them in a lower-cost tier while still retaining them for security investigations. Basic Logs are charged at a lower ingestion rate and support simple queries and search jobs, preserving visibility for incident response without the full cost of Analytics Logs.

Answer

Delete unused analytics rules to reduce log ingestion.

Answer

Disable collection of all informational logs.

Answer

Reduce the data retention period to 30 days.

Question 10

Your organization uses Microsoft Sentinel with UEBA (User and Entity Behavior Analytics) enabled. The SOC team notices that UEBA is not generating any anomalies for a specific user group. What is the most likely cause?

Accepted Answer

The data history for that user group is less than the required baseline period.. UEBA in Microsoft Sentinel requires a baseline period of historical data (typically 14 days minimum, often up to 30 days) before it can establish normal behavior patterns and generate meaningful anomalies. If a user group was recently added or their identity data has only been ingested for a short time, Sentinel lacks the behavioral baseline needed to flag deviations, so no anomalies appear. This is expected behavior, not a misconfiguration.

Answer

The user group is excluded from Identity Protection.

Answer

The user group is not being monitored by any data connector.

Answer

The analytics rules for UEBA are not enabled.

Question 11

Your organization uses Microsoft Defender for Office 365. You want to automatically isolate a user's mailbox if a high-confidence phishing email is detected. Which Microsoft Sentinel automation should you use?

Accepted Answer

Create a playbook that uses the Microsoft Graph API to apply a mailbox litigation hold or block access.. Microsoft Sentinel playbooks, built on Azure Logic Apps, can use the Microsoft Graph API to perform automated remediation actions like applying a mailbox litigation hold or blocking user access. This enables automatic isolation of a user's mailbox when a high-confidence phishing email is detected, which is a key incident response capability in Defender for Office 365.

Answer

Configure a workbook to display the alert and manually isolate the mailbox.

Answer

Enable the Office 365 connector and configure automatic response in the data connector.

Answer

Create a scheduled analytics rule that isolates the mailbox when triggered.

Question 12

Your SOC team uses Microsoft Sentinel incident management. They want to automatically assign high-severity incidents to a senior analyst and send a notification to Microsoft Teams. What should you use?

Accepted Answer

Create an automation rule that triggers on incident creation, assigns the incident, and runs a playbook to post to Teams.. Automation rules in Microsoft Sentinel can trigger on incident creation (e.g., when severity is 'High'), automatically assign the incident to a specific owner (senior analyst), and then invoke a playbook (Azure Logic App) to post a message to Microsoft Teams. This combines assignment logic with automated notification in a single, manageable rule.

Answer

Create a playbook and attach it directly to the analytics rule.

Answer

Create a watchlist to define assignment rules and configure a workbook for notifications.

Answer

Create an analytics rule with incident grouping and assignment.

Question 13

Your organization uses Microsoft Sentinel and Microsoft Copilot for Security. You want to improve incident response efficiency. Which THREE features should you implement? (Choose three.)

Accepted Answer

Enable Microsoft Copilot for Security to assist with incident investigations.. Microsoft Copilot for Security integrates directly with Microsoft Sentinel to provide AI-driven natural language assistance for incident investigations, enabling analysts to query data, summarize incidents, and generate KQL queries without manual scripting. This directly improves incident response efficiency by reducing investigation time and cognitive load.

Answer

Use watchlists to track known malicious IP addresses.

Answer

Configure workbooks to display real-time incident trends.

Question 14

Your organization plans to implement Microsoft Sentinel. Which THREE components are required for a basic deployment? (Choose three.)

Accepted Answer

Analytics rules to generate incidents.. Analytics rules are required to generate incidents from the data ingested into Microsoft Sentinel. Without analytics rules, the raw log data remains unprocessed and no security incidents are created, making the deployment non-functional for detection and response.

Answer

User and Entity Behavior Analytics (UEBA) enabled.

Answer

Bookmarks for incident investigations.

Question 15

Refer to the exhibit. You are reviewing an Azure Resource Manager (ARM) template for a Microsoft Sentinel analytics rule. Based on the exhibit, which statement is true?

Accepted Answer

The rule will generate one alert per user that has MFA disabled.. The ARM template configures a Microsoft Sentinel scheduled analytics rule that runs every hour, queries for users with MFA disabled, and uses the 'Alert Per Result' event grouping setting. This setting generates a separate alert for each unique result returned by the query, meaning each user who has MFA disabled triggers its own alert.

Answer

The rule will create one incident per alert and group alerts by entity.

Answer

The rule will only trigger if more than 5 users have MFA disabled.

Answer

The rule runs every hour and looks back 5 hours.