SC-200 Manage a security operations environment Practice Test 21 — 15 Questions

Question 1

Your organization uses Microsoft Defender XDR. You need to configure a custom detection rule that runs every hour and alerts when a specific process is executed on multiple devices within 10 minutes. Which type of rule should you create?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Custom detection rule. Custom detection rules in Microsoft Defender XDR allow you to define a query that runs on a schedule (e.g., every hour) and triggers an alert based on aggregation over a specified time window (e.g., 10 minutes). This rule type supports the exact requirement: detecting a specific process executed on multiple devices within a short timeframe, using the `make_set` or `dcount` aggregation functions in KQL.

Answer

Hunting query saved as a detection

Answer

Behavioral rule

Answer

Advanced hunting query

Question 2

You are reviewing a KQL query used in a Microsoft Sentinel analytics rule. The query is intended to alert when there are more than 5 alerts of the same name for the same entity type within the last hour. However, the rule is not triggering as expected. What is the most likely issue?

Accepted Answer

The parsing of Entities array may fail if the first entity does not have a 'Type' field.. The most likely issue is that the KQL query parses the 'Entities' array, which is a dynamic JSON field in Microsoft Sentinel alerts. If the first entity in the array does not have a 'Type' field, the parsing logic (e.g., using 'mv-expand' or accessing array indices) will fail or return null, causing the query to produce no results. This prevents the rule from triggering even when conditions are otherwise met.

Answer

The 'summarize' operator does not support 'AlertCount' as a column name.

Answer

The query uses 'tostring' incorrectly.

Answer

The 'where TimeGenerated > ago(1h)' is outside the allowed range.

Question 3

Your organization uses Microsoft Defender XDR. You need to configure a custom detection rule that runs every hour and alerts when a specific process is executed on multiple devices within 10 minutes. Which type of rule should you create?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable the Microsoft Defender for Cloud Apps data connector in Microsoft Sentinel.. The Microsoft Defender for Cloud Apps data connector in Microsoft Sentinel is specifically designed to ingest alerts and anomalies from Defender for Cloud Apps and automatically create SecurityIncident records in Sentinel. Enabling this connector ensures that anomalous behavior alerts are converted to incidents without requiring custom playbooks or additional logic.

Answer

Enable the Microsoft Defender for Identity data connector in Microsoft Sentinel.

Answer

Enable the Microsoft 365 data connector in Microsoft Sentinel.

Answer

Create a playbook that triggers on Defender for Cloud Apps alerts and creates incidents in Sentinel.

Question 4

Which TWO actions can be performed using automation rules in Microsoft Sentinel?

Accepted Answer

Run a playbook. Automation rules in Microsoft Sentinel can trigger a playbook as an action when an incident is created or updated. Playbooks are automated workflows based on Azure Logic Apps, allowing for complex response actions such as threat containment, notification, or enrichment. This enables security teams to automate incident response without manual intervention.

Answer

Create an incident

Answer

Modify an analytics rule

Answer

Delete an incident

Question 5

Which THREE of the following are valid ways to ingest logs into Microsoft Sentinel?

Accepted Answer

Syslog. Syslog is a valid data connector in Microsoft Sentinel that ingests logs from Linux-based and network devices using the standard syslog protocol (RFC 5424 or RFC 3164). Sentinel collects these logs via the Log Analytics agent (or Azure Monitor Agent) listening on UDP port 514 or TCP port 6514, and parses them into the Syslog table for analysis. This makes option A correct because it is a native, supported ingestion method.

Answer

Windows Event Logs

Answer

Custom logs via direct API

Question 6

Which TWO roles are included in Microsoft Sentinel built-in roles? (Choose two.)

Accepted Answer

Microsoft Sentinel Responder. Microsoft Sentinel Responder is a built-in role that grants permissions to respond to incidents, including the ability to update incidents, dismiss alerts, and take response actions. This role is designed for security operations center (SOC) analysts who need to triage and remediate threats without full administrative access.

Answer

Microsoft Sentinel Administrator

Answer

Microsoft Sentinel Operator

Answer

Global Administrator

Question 7

Which THREE of the following are features of Microsoft Defender XDR that help manage a security operations environment?

Accepted Answer

Automated investigation and response. Automated Investigation and Response (AIR) in Microsoft Defender XDR uses AI-driven playbooks to automatically investigate alerts and take remediation actions, such as isolating a compromised device or blocking a malicious file, without requiring manual intervention. This directly supports managing a security operations environment by reducing alert fatigue and accelerating incident response.

Answer

Sentinel SIEM integration

Answer

Threat analytics

Question 8

You are the security operations analyst for a large enterprise that uses Microsoft Sentinel and Microsoft Defender XDR. The environment includes:

- 10,000 Windows 11 devices managed by Microsoft Intune
- 5,000 macOS devices managed by Jamf Pro
- 2,000 Linux servers running Ubuntu 22.04
- Microsoft 365 E5 licenses for all users
- Microsoft Sentinel in the East US region
- Microsoft Defender for Cloud Apps enabled
- Microsoft Defender for Identity deployed
- Microsoft Defender for Office 365 configured

You need to design a solution to meet the following requirements:

1. Ingest security events from all devices (Windows, macOS, Linux) into Microsoft Sentinel.
2. Ensure that all alerts from Microsoft Defender XDR components (including Defender for Endpoint, Defender for Identity, Defender for Office 365, and Defender for Cloud Apps) are automatically correlated into incidents in Microsoft Sentinel.
3. Minimize latency between alert generation in Defender XDR and incident creation in Sentinel.
4. Use the least amount of administrative overhead.

What should you implement?

Accepted Answer

Enable the Microsoft Defender XDR connector for incident correlation. For Windows devices, use the Windows Security Events via AMA connector. For Linux and macOS, use the Syslog via AMA connector.. The Microsoft Defender XDR connector streams incidents from all Defender products into Sentinel with low latency and minimal overhead, meeting requirement 2 and 3. For device logs (requirement 1), the Windows Security Events via AMA connector ingests Windows events, and Syslog via AMA ingests Linux and macOS logs (since Jamf Pro can forward logs via Syslog). Option B is correct because it uses the native AMA connectors, which are the current standard and not deprecated. Option A uses the Log Analytics agent, which is deprecated and not recommended. Option C uses a Logic App, which adds latency and administrative overhead. Option D using direct Graph API ingestion is complex and not scalable.

Answer

Enable the Microsoft Defender XDR connector for incident correlation. Deploy the Log Analytics agent on all devices to collect events.

Answer

Use a Logic App to fetch incidents from Microsoft Defender XDR and create incidents in Sentinel. Install the Azure Monitor Agent on all devices.

Answer

Enable the Microsoft Defender XDR connector and use the Microsoft Graph API to ingest logs from all devices directly into Sentinel.

Question 9

You are deploying an ARM template to create a saved search in a Log Analytics workspace. The template fails with an error that the resource type is not valid for Microsoft Sentinel. What is the most likely reason?

Accepted Answer

The resource type should be Microsoft.SecurityInsights/alertRules, not OperationalInsights/workspaces/savedSearches.. Microsoft Sentinel does not use the OperationalInsights/workspaces/savedSearches resource type for its analytics rules. Instead, Sentinel uses the Microsoft.SecurityInsights/alertRules resource type to define detection rules. The ARM template fails because the resource type specified is not recognized as valid for Sentinel deployments.

Answer

The query is invalid KQL.

Answer

The apiVersion is incorrect.

Answer

The name format is incorrect.

Question 10

Your organization uses Microsoft Sentinel. You need to ensure that an Azure function app can send custom logs to a Log Analytics workspace. What should you configure?

Accepted Answer

Data collection rule (DCR) with Azure Monitor Agent. To send custom logs from an Azure function app to a Log Analytics workspace, you need a Data Collection Rule (DCR) configured with the Azure Monitor Agent (AMA). The DCR defines how the custom log data is ingested, transformed, and routed to the workspace, while the AMA collects the logs from the function app. This is the standard method for custom log ingestion in Microsoft Sentinel, as it supports the Log Analytics Ingestion API and allows for schema customization.

Answer

Threat intelligence data connector

Answer

Diagnostic settings on the function app

Answer

Microsoft Sentinel automation rule

Question 11

Your organization uses Microsoft Defender for Cloud. You need to recommend a solution to automatically remediate misconfigurations in Azure VMs without manual intervention. What should you use?

Accepted Answer

Enable 'Remediate' option in Defender for Cloud recommendations. Microsoft Defender for Cloud provides a 'Remediate' button on security recommendations that can automatically apply the necessary configuration changes to Azure resources, such as VMs, without manual intervention. This feature leverages Azure Policy's 'deployIfNotExists' effect to enforce compliance by running remediation tasks at scale, directly addressing misconfigurations like open management ports or missing disk encryption.

Answer

Use Azure Advisor recommendations

Answer

Configure Azure Backup

Answer

Set up Update Management in Azure Automation

Question 12

Your organization uses Microsoft Sentinel and has multiple workspaces for different business units. You need to enable cross-workspace querying for the security operations center (SOC) analysts. What should you do?

Accepted Answer

Use the workspace() expression in KQL queries. The `workspace()` expression in KQL allows a query to reference tables from multiple Log Analytics workspaces within a single query. This enables SOC analysts to perform cross-workspace queries without moving data, which is the correct approach for a multi-workspace Sentinel deployment.

Answer

Configure a data connector for each workspace

Answer

Enable incident merging across workspaces

Answer

Create a single workspace and migrate all data

Question 13

Your organization uses Microsoft Defender XDR. You need to configure a custom detection rule that runs every hour and alerts when a specific process is executed on multiple devices within 10 minutes. Which type of rule should you create?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Defender XDR incident correlation is enabled. Microsoft Defender XDR incident correlation is the feature that automatically aggregates alerts from different Microsoft Defender workloads—including Defender for Identity and Defender for Endpoint—into a single unified incident. When this setting is enabled, the correlation engine analyzes alert telemetry and entities (such as user accounts, devices, and IP addresses) to merge related alerts, reducing alert fatigue and providing a consolidated view. Without this setting enabled, alerts from different workloads remain isolated and are not automatically correlated in the unified incidents queue.

Answer

Microsoft Defender for Office 365 is enabled

Answer

Microsoft Sentinel is connected to Microsoft Defender XDR

Answer

Custom detection rules are created in Microsoft 365 Defender

Question 14

Your organization uses Microsoft Sentinel. An analyst reports that a scheduled analytics rule is not firing. You verify that the rule is enabled and the query returns results when run manually. What is the most likely cause?

Accepted Answer

The alert threshold is set too high. The most likely cause is that the alert threshold is set too high. Even though the query returns results when run manually, the rule's threshold condition (e.g., 'Number of results greater than X') may not be met by the volume of results returned during each scheduled run. If the threshold is higher than the typical result count, the rule will not trigger an alert despite the query being valid.

Answer

The data connector is disconnected

Answer

The workspace is in a different region

Answer

The query uses unsupported KQL functions

Question 15

Your organization uses Microsoft Sentinel with UEBA enabled. You need to identify anomalous user behavior that indicates a potential compromise. Which entity behavior analytics feature should you use?

Accepted Answer

Entity behavior analytics peer comparison. Entity behavior analytics peer comparison (option C) is the correct feature because it uses UEBA to compare a user's activities against their historical baseline and peer group behavior to detect anomalies indicative of compromise. This directly addresses the requirement to identify anomalous user behavior, as peer comparison highlights deviations like unusual access patterns or data exfiltration attempts that single-entity baselines might miss.

Answer

Automation rules

Answer

Hunting queries

Answer

Anomaly rules in analytics