SC-200 Manage a security operations environment Practice Test 21 — 15 Questions

Question 1

Your organization uses Microsoft Sentinel with Azure Policy. You need to ensure that new Log Analytics workspaces are automatically connected to Sentinel and configured with a standard set of data connectors. What should you use?

Accepted Answer

Create Azure Policy definitions that deploy Sentinel and data connectors.. Azure Policy can be used to automatically deploy and configure Microsoft Sentinel and its data connectors on new Log Analytics workspaces. By creating policy definitions with 'DeployIfNotExists' or 'Modify' effects, you ensure that any new workspace is automatically onboarded to Sentinel and has the required data connectors installed, meeting the requirement for automated, consistent configuration at scale.

Answer

Deploy an ARM template to each new workspace manually.

Answer

Use Sentinel automation rules to configure new workspaces.

Answer

Develop a Logic App that runs on a schedule to check for new workspaces.

Question 2

You have a Microsoft Sentinel automation rule as shown in the exhibit. The rule triggers a playbook that blocks a user in Microsoft Entra ID. The rule is enabled but never fires. What is the most likely reason?

Accepted Answer

The playbook does not have a Microsoft Sentinel trigger.. The automation rule trigger specifies 'severity: High' and 'status: New'. However, automation rules trigger on incident creation, but the status condition may be incorrect because incidents are typically created with status 'New' unless changed by another rule. The exhibit shows correct syntax. However, the most common issue is that automation rules require the playbook to have a Sentinel trigger; but the rule itself seems fine. Option D is a plausible misconfiguration: if the playbook doesn't have a Sentinel trigger, it won't run. Option A is wrong because the rule is enabled. Option B is wrong because the JSON is valid. Option C is wrong because high severity incidents exist.

Answer

The automation rule is disabled.

Answer

No incidents with High severity are created.

Answer

The JSON syntax is invalid.

Question 3

Your organization uses Microsoft Defender for Office 365. You need to ensure that suspicious email messages are automatically moved to quarantine and an incident is raised in Microsoft Sentinel. What should you configure?

Accepted Answer

Configure the Microsoft Defender for Office 365 data connector in Sentinel.. Defender for Office 365 can automatically quarantine emails based on policies. To raise an incident in Sentinel, you need to stream the alerts to Sentinel via a data connector. Option D is correct. Option A is wrong because the connector is for Defender for Cloud, not Office 365. Option B is wrong because the connector is for Defender for Endpoint. Option C is wrong because the connector is for identity alerts.

Answer

Configure the Microsoft Defender for Cloud data connector in Sentinel.

Answer

Use the Microsoft Defender for Identity data connector.

Answer

Enable the Microsoft Defender for Endpoint data connector.

Question 4

Your organization uses Microsoft Sentinel. You need to ensure that incident response times are monitored and reported. Which TWO capabilities should you use?

Accepted Answer

Automation rules. Sentinel workbooks can visualize response times, and automation rules can track timestamps. Option A and D are correct. Option B (playbooks) can perform actions but not directly monitor times. Option C (watchlists) are for reference data. Option E (UEBA) is for behavioral analytics.

Answer

Playbooks

Answer

UEBA

Answer

Watchlists

Question 5

Your organization uses Microsoft Defender XDR. You need to delegate incident management tasks to a team of analysts without granting full global admin permissions. Which THREE roles in Microsoft 365 Defender should you assign?

Accepted Answer

Security Administrator. Security Administrator is correct because this role in Microsoft 365 Defender provides full access to incident management features, including the ability to investigate, respond to, and resolve incidents, while not granting full global admin permissions. It allows analysts to manage alerts, perform advanced hunting, and configure security settings within the Defender portal, making it suitable for delegated incident management tasks.

Answer

Security Analyst

Answer

Compliance Administrator

Question 6

Your organization uses Microsoft Sentinel. You need to automatically classify incidents based on MITRE ATT&CK techniques. Which THREE methods can be used to accomplish this?

Accepted Answer

Enable the MITRE ATT&CK data connector.. Analytics rules can map to MITRE techniques, the MITRE ATT&CK connector can enrich incidents, and automation rules can add tags. Option A, B, and E are correct. Option C (watchlists) can store mappings but not automatically classify. Option D (UEBA) doesn't classify incidents by MITRE techniques.

Answer

Create a watchlist with MITRE techniques.

Answer

Use UEBA to detect techniques.

Question 7

Your organization uses Microsoft Sentinel with multiple workspaces. You need to create a unified incident queue across all workspaces. Which TWO solutions should you consider?

Accepted Answer

Consolidate all data into a single Log Analytics workspace.. Using a single workspace is the simplest approach, and incident grouping rules can combine alerts from different workspaces into one incident. Option A and D are correct. Option B (cross-workspace queries) can query but not unify the queue. Option C (multiple playbooks) doesn't unify. Option E (Azure Policy) doesn't create a unified queue.

Answer

Use cross-workspace queries in workbooks.

Answer

Use Azure Policy to enforce workspace configuration.

Answer

Deploy multiple playbooks to synchronize incidents.

Question 8

You are managing Microsoft Defender for Cloud Apps. Which TWO actions can be performed using the Microsoft Defender XDR integration?

Accepted Answer

Investigate user activities across cloud apps.. Defender for Cloud Apps integrated with Defender XDR allows governing apps and investigating user activities. Option B and D are correct. Option A (onboarding devices) is for Defender for Endpoint. Option C (quarantining emails) is for Office 365. Option E (managing Intune devices) is separate.

Answer

Quarantine malicious emails.

Answer

Manage device compliance policies in Microsoft Intune.

Answer

Onboard devices to Microsoft Defender for Endpoint.

Question 9

Your organization uses Microsoft Sentinel. You need to ensure that an alert is created when a user accesses a sensitive SharePoint site from an unusual location. What should you create?

Accepted Answer

An analytics rule. An analytics rule can be created to detect user access from unusual locations using Sentinel's built-in templates or custom KQL. Option B is correct. Option A (automation rule) responds to incidents, not creates alerts. Option C (playbook) is for response. Option D (watchlist) stores data but doesn't generate alerts.

Answer

A watchlist

Answer

A playbook

Answer

An automation rule

Question 10

Your organization uses Microsoft Defender XDR and Microsoft Sentinel. The security operations center (SOC) team frequently receives false positive alerts for a specific user login pattern from a legacy application. You need to reduce alert fatigue without disabling the underlying detection rule. What should you configure?

Accepted Answer

Configure an automated investigation and remediation rule in Microsoft Defender XDR to suppress alerts matching the legacy application pattern.. Option C is correct because automated investigation and remediation rules in Microsoft Defender XDR allow you to take action on alerts, including suppressing false positives based on conditions. Option A is wrong because modifying the analytics rule in Sentinel would affect all detections of that rule, not just the legacy app pattern. Option B is wrong because a watchlist in Sentinel is used for correlation, not suppression. Option D is wrong because bookmarks are for preserving evidence, not suppressing alerts.

Answer

Use Microsoft Sentinel bookmarks to mark the alerts as false positives.

Answer

Create a watchlist in Microsoft Sentinel containing the legacy application's user accounts and use it in the rule.

Answer

Modify the analytics rule in Microsoft Sentinel to exclude the legacy application IP range.

Question 11

Your company is deploying Microsoft Sentinel in a multi-tenant environment using Azure Lighthouse. You need to ensure that SOC analysts can triage incidents across all tenants from a single workspace. What is the minimum configuration required?

Accepted Answer

Onboard each tenant as a delegated resource under Azure Lighthouse, then route all logs to a single Sentinel workspace in the managing tenant.. Option B is correct because Azure Lighthouse enables cross-tenant management by delegating permissions to a managing tenant, allowing a single Sentinel workspace to ingest logs from multiple tenants. Option A is wrong because Azure AD B2B is for user access, not workspace management. Option C is wrong because Azure Policy can enforce settings but does not enable cross-tenant incident viewing. Option D is wrong because a second workspace is unnecessary and would fragment visibility.

Answer

Create a second Sentinel workspace in the managing tenant and configure cross-workspace queries.

Answer

Configure Azure AD B2B collaboration to grant external users access to each tenant's Sentinel workspace.

Answer

Use Azure Policy to enforce a standard analytics rule across all tenants.

Question 12

Your SOC uses Microsoft Sentinel and Microsoft Defender XDR. An incident is generated from a Microsoft Defender for Identity alert about a suspicious Kerberos ticket request. The incident is assigned the 'Medium' severity. You want to automatically increase the severity to 'High' if the user is in a privileged role, based on data from Microsoft Entra ID. What is the most efficient way to achieve this?

Accepted Answer

Create an automation rule in Microsoft Sentinel triggered on incident creation, which runs a playbook that checks Microsoft Entra ID roles and updates the severity accordingly.. Option D is correct because Sentinel automation rules can be triggered on incident creation and can call a playbook (via Azure Logic Apps) to look up user roles in Microsoft Entra ID and then update the incident severity. Option A is wrong because analytics rules generate incidents, not modify existing ones. Option B is wrong because a custom KQL query after ingestion would not update an already created incident. Option C is wrong because automatic attack disruption is for containing attacks, not adjusting severity.

Answer

Enable automatic attack disruption in Microsoft Defender XDR to handle the incident.

Answer

Modify the analytics rule that generates the incident to check user roles during query execution.

Answer

Create a scheduled analytics rule that queries Microsoft Entra ID audit logs and updates incident severity via a watchlist.

Question 13

Your organization uses Microsoft Defender for Cloud Apps and Microsoft Sentinel. You notice that a large number of log entries from Defender for Cloud Apps are being dropped at ingestion due to 'malformed data' errors. The data connector shows a healthy status. What is the most likely cause?

Accepted Answer

The data volume exceeds the workspace's ingestion capacity, causing data truncation.. Option A is correct because excessive data volume can cause throttling or truncation, leading to malformed data errors even if the connector appears healthy. Option B is wrong because an expired workspace key would cause authentication failures, not malformed data. Option C is wrong because a firewall block would prevent connectivity entirely. Option D is wrong because unsupported log types would result in schema errors, not malformed data.

Answer

The log type is not supported by Sentinel.

Answer

The Log Analytics workspace key has expired.

Answer

The Defender for Cloud Apps connector is blocked by a firewall.

Question 14

Your SOC uses Microsoft Sentinel and Microsoft Defender XDR. An incident is created from a Defender for Endpoint alert about a malware detection on a device. The incident has low priority, but you want to automatically isolate the device from the network if the alert is confirmed as a true positive by the SOC. What is the recommended approach?

Accepted Answer

Create an automation rule in Microsoft Sentinel that triggers a playbook with an approval step before executing device isolation.. Option C is correct because automation rules can trigger a playbook that requires manual approval before isolating the device, ensuring a human confirms the alert. Option A is wrong because immediate isolation without confirmation could impact productivity. Option B is wrong because automatic attack disruption may isolate based on severity but does not wait for SOC confirmation. Option D is wrong because a separate analytics rule cannot isolate devices; it only generates incidents.

Answer

Create a separate analytics rule that triggers on the same alert and uses a playbook to isolate the device.

Answer

Use automatic attack disruption in Microsoft Defender XDR to isolate the device automatically.

Answer

Configure an automated response in Defender for Endpoint to isolate the device immediately when an alert is generated.

Question 15

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You need to ensure that all incidents from Microsoft Defender XDR are synchronized to Microsoft Sentinel with the same status (e.g., 'Active', 'Resolved'). What should you configure?

Accepted Answer

Connect Microsoft Defender XDR to Microsoft Sentinel using the official data connector.. Option A is correct because bi-directional synchronization is built-in when you connect Microsoft Defender XDR to Sentinel. Option B is wrong because a playbook would be unnecessary and could cause duplicates. Option C is wrong because manual synchronization is not practical. Option D is wrong because the Microsoft Defender XDR connector does sync status by default.

Answer

Create a custom playbook to poll Defender XDR API and update Sentinel incidents.

Answer

Manually update status in both systems.

Answer

Disable the Microsoft Defender XDR connector and use separate connectors for each workload.