SC-200 Manage a security operations environment Practice Test 21 — 15 Questions

Question 1

Your company uses Microsoft Sentinel and has enabled the Microsoft Defender XDR connector. You notice that incidents from Microsoft Defender for Cloud Apps are not appearing in Microsoft Sentinel. All other Defender XDR incidents appear correctly. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Microsoft Defender for Cloud Apps data connector is not enabled in Microsoft Sentinel.. The Microsoft Defender XDR connector ingests incidents from all Microsoft Defender products, including Defender for Cloud Apps, but only if the corresponding data connector is enabled in Microsoft Sentinel. Option D is correct because the Microsoft Defender for Cloud Apps data connector must be explicitly enabled to allow incident ingestion from that source; without it, incidents from Defender for Cloud Apps will not appear even though the XDR connector is active.

Answer

The security operations team does not have the appropriate permissions.

Answer

The Microsoft Defender XDR connector only ingests incidents from Microsoft Defender for Endpoint.

Answer

The Microsoft 365 E5 license is not assigned to the users.

Question 2

Your organization is using Microsoft Sentinel and you are responsible for managing the security operations environment. You need to ensure that a new security analyst can triage incidents but cannot modify analytics rules. Which role should you assign?

Accepted Answer

Microsoft Sentinel Responder. The Microsoft Sentinel Responder role provides the necessary permissions to triage incidents (view, investigate, respond) while explicitly excluding write access to analytics rules. This matches the requirement for a security analyst who needs to handle incidents but cannot modify detection logic.

Answer

Microsoft Sentinel Reader

Answer

Microsoft Sentinel Contributor

Answer

Microsoft Sentinel Contributor with a custom role denying rule modification

Question 3

Your organization uses Microsoft Defender XDR. You need to configure a custom detection rule that runs every hour and alerts when a specific process is executed on multiple devices within 10 minutes. Which type of rule should you create?

Accepted Answer

Custom detection rule. Custom detection rules in Microsoft Defender XDR allow you to define a query that runs on a schedule (e.g., every hour) and triggers an alert based on aggregation over a specified time window (e.g., 10 minutes). This rule type supports the exact requirement: detecting a specific process executed on multiple devices within a short timeframe, using the `make_set` or `dcount` aggregation functions in KQL.

Answer

Hunting query saved as a detection

Answer

Behavioral rule

Answer

Advanced hunting query

Question 4

Your organization uses Microsoft Sentinel. You need to ensure that an incident is automatically assigned to the appropriate team based on the type of alert. What should you configure?

Accepted Answer

Automation rule. Automation rules in Microsoft Sentinel allow you to automatically assign incidents to specific teams based on conditions such as alert type or severity. This is the correct configuration because automation rules can trigger actions like incident assignment, tagging, or status changes without requiring a complex logic app or custom code.

Answer

Workbook

Answer

Playbook

Answer

Analytics rule

Question 5

You are reviewing a KQL query used in a Microsoft Sentinel analytics rule. The query is intended to alert when there are more than 5 alerts of the same name for the same entity type within the last hour. However, the rule is not triggering as expected. What is the most likely issue?

Accepted Answer

The parsing of Entities array may fail if the first entity does not have a 'Type' field.. The most likely issue is that the KQL query parses the 'Entities' array, which is a dynamic JSON field in Microsoft Sentinel alerts. If the first entity in the array does not have a 'Type' field, the parsing logic (e.g., using 'mv-expand' or accessing array indices) will fail or return null, causing the query to produce no results. This prevents the rule from triggering even when conditions are otherwise met.

Answer

The 'summarize' operator does not support 'AlertCount' as a column name.

Answer

The query uses 'tostring' incorrectly.

Answer

The 'where TimeGenerated > ago(1h)' is outside the allowed range.

Question 6

Your organization uses Microsoft Defender for Cloud Apps and Microsoft Sentinel. You need to ensure that anomalous behavior alerts from Defender for Cloud Apps are automatically converted to incidents in Sentinel. What should you configure?

Accepted Answer

Enable the Microsoft Defender for Cloud Apps data connector in Microsoft Sentinel.. The Microsoft Defender for Cloud Apps data connector in Microsoft Sentinel is specifically designed to ingest alerts and anomalies from Defender for Cloud Apps and automatically create SecurityIncident records in Sentinel. Enabling this connector ensures that anomalous behavior alerts are converted to incidents without requiring custom playbooks or additional logic.

Answer

Enable the Microsoft Defender for Identity data connector in Microsoft Sentinel.

Answer

Enable the Microsoft 365 data connector in Microsoft Sentinel.

Answer

Create a playbook that triggers on Defender for Cloud Apps alerts and creates incidents in Sentinel.

Question 7

Which TWO actions can be performed using automation rules in Microsoft Sentinel?

Accepted Answer

Run a playbook. Automation rules in Microsoft Sentinel can trigger a playbook as an action when an incident is created or updated. Playbooks are automated workflows based on Azure Logic Apps, allowing for complex response actions such as threat containment, notification, or enrichment. This enables security teams to automate incident response without manual intervention.

Answer

Create an incident

Answer

Modify an analytics rule

Answer

Delete an incident

Question 8

Which THREE of the following are valid ways to ingest logs into Microsoft Sentinel?

Accepted Answer

Syslog. Syslog is a valid data connector in Microsoft Sentinel that ingests logs from Linux-based and network devices using the standard syslog protocol (RFC 5424 or RFC 3164). Sentinel collects these logs via the Log Analytics agent (or Azure Monitor Agent) listening on UDP port 514 or TCP port 6514, and parses them into the Syslog table for analysis. This makes option A correct because it is a native, supported ingestion method.

Answer

Windows Event Logs

Answer

Custom logs via direct API

Question 9

Which TWO roles are included in Microsoft Sentinel built-in roles? (Choose two.)

Accepted Answer

Microsoft Sentinel Responder. Microsoft Sentinel Responder is a built-in role that grants permissions to respond to incidents, including the ability to update incidents, dismiss alerts, and take response actions. This role is designed for security operations center (SOC) analysts who need to triage and remediate threats without full administrative access.

Answer

Microsoft Sentinel Administrator

Answer

Microsoft Sentinel Operator

Answer

Global Administrator

Question 10

Which THREE of the following are features of Microsoft Defender XDR that help manage a security operations environment?

Accepted Answer

Automated investigation and response. Automated Investigation and Response (AIR) in Microsoft Defender XDR uses AI-driven playbooks to automatically investigate alerts and take remediation actions, such as isolating a compromised device or blocking a malicious file, without requiring manual intervention. This directly supports managing a security operations environment by reducing alert fatigue and accelerating incident response.

Answer

Sentinel SIEM integration

Answer

Threat analytics

Question 11

You are the security operations analyst for a large enterprise that uses Microsoft Sentinel and Microsoft Defender XDR. The environment includes:

- 10,000 Windows 11 devices managed by Microsoft Intune
- 5,000 macOS devices managed by Jamf Pro
- 2,000 Linux servers running Ubuntu 22.04
- Microsoft 365 E5 licenses for all users
- Microsoft Sentinel in the East US region
- Microsoft Defender for Cloud Apps enabled
- Microsoft Defender for Identity deployed
- Microsoft Defender for Office 365 configured

You need to design a solution to meet the following requirements:

1. Ingest security events from all devices (Windows, macOS, Linux) into Microsoft Sentinel.
2. Ensure that all alerts from Microsoft Defender XDR components (including Defender for Endpoint, Defender for Identity, Defender for Office 365, and Defender for Cloud Apps) are automatically correlated into incidents in Microsoft Sentinel.
3. Minimize latency between alert generation in Defender XDR and incident creation in Sentinel.
4. Use the least amount of administrative overhead.

What should you implement?

Accepted Answer

Enable the Microsoft Defender XDR connector for incident correlation. For Windows devices, use the Windows Security Events via AMA connector. For Linux and macOS, use the Syslog via AMA connector.. The Microsoft Defender XDR connector streams incidents from all Defender products into Sentinel with low latency and minimal overhead, meeting requirement 2 and 3. For device logs (requirement 1), the Windows Security Events via AMA connector ingests Windows events, and Syslog via AMA ingests Linux and macOS logs (since Jamf Pro can forward logs via Syslog). Option B is correct because it uses the native AMA connectors, which are the current standard and not deprecated. Option A uses the Log Analytics agent, which is deprecated and not recommended. Option C uses a Logic App, which adds latency and administrative overhead. Option D using direct Graph API ingestion is complex and not scalable.

Answer

Enable the Microsoft Defender XDR connector for incident correlation. Deploy the Log Analytics agent on all devices to collect events.

Answer

Use a Logic App to fetch incidents from Microsoft Defender XDR and create incidents in Sentinel. Install the Azure Monitor Agent on all devices.

Answer

Enable the Microsoft Defender XDR connector and use the Microsoft Graph API to ingest logs from all devices directly into Sentinel.

Question 12

You are deploying an ARM template to create a saved search in a Log Analytics workspace. The template fails with an error that the resource type is not valid for Microsoft Sentinel. What is the most likely reason?

Accepted Answer

The resource type should be Microsoft.SecurityInsights/alertRules, not OperationalInsights/workspaces/savedSearches.. Microsoft Sentinel does not use the OperationalInsights/workspaces/savedSearches resource type for its analytics rules. Instead, Sentinel uses the Microsoft.SecurityInsights/alertRules resource type to define detection rules. The ARM template fails because the resource type specified is not recognized as valid for Sentinel deployments.

Answer

The query is invalid KQL.

Answer

The apiVersion is incorrect.

Answer

The name format is incorrect.

Question 13

Your organization uses Microsoft Sentinel. You need to ensure that an Azure function app can send custom logs to a Log Analytics workspace. What should you configure?

Accepted Answer

Data collection rule (DCR) with Azure Monitor Agent. To send custom logs from an Azure function app to a Log Analytics workspace, you need a Data Collection Rule (DCR) configured with the Azure Monitor Agent (AMA). The DCR defines how the custom log data is ingested, transformed, and routed to the workspace, while the AMA collects the logs from the function app. This is the standard method for custom log ingestion in Microsoft Sentinel, as it supports the Log Analytics Ingestion API and allows for schema customization.

Answer

Threat intelligence data connector

Answer

Diagnostic settings on the function app

Answer

Microsoft Sentinel automation rule

Question 14

Your organization uses Microsoft Defender for Cloud. You need to recommend a solution to automatically remediate misconfigurations in Azure VMs without manual intervention. What should you use?

Accepted Answer

Enable 'Remediate' option in Defender for Cloud recommendations. Microsoft Defender for Cloud provides a 'Remediate' button on security recommendations that can automatically apply the necessary configuration changes to Azure resources, such as VMs, without manual intervention. This feature leverages Azure Policy's 'deployIfNotExists' effect to enforce compliance by running remediation tasks at scale, directly addressing misconfigurations like open management ports or missing disk encryption.

Answer

Use Azure Advisor recommendations

Answer

Configure Azure Backup

Answer

Set up Update Management in Azure Automation

Question 15

Your organization uses Microsoft Sentinel and has multiple workspaces for different business units. You need to enable cross-workspace querying for the security operations center (SOC) analysts. What should you do?

Accepted Answer

Use the workspace() expression in KQL queries. The `workspace()` expression in KQL allows a query to reference tables from multiple Log Analytics workspaces within a single query. This enables SOC analysts to perform cross-workspace queries without moving data, which is the correct approach for a multi-workspace Sentinel deployment.

Answer

Configure a data connector for each workspace

Answer

Enable incident merging across workspaces

Answer

Create a single workspace and migrate all data