SC-200 Manage a security operations environment Practice Test 22 — 15 Questions

Question 1

Your organization, Fabrikam, has a hybrid environment with on-premises Active Directory and Microsoft Entra ID. You are using Microsoft Sentinel and Microsoft Defender XDR. You have enabled Microsoft Defender for Identity (MDI) to protect on-premises Active Directory. Recently, you received an incident in Microsoft Sentinel indicating a potential DCSync attack from a domain controller. The incident was generated from an MDI alert. You need to investigate the incident and determine if the attack was successful. You have the following options: A) Use the Microsoft Sentinel incident investigation graph to view entities and relationships. Then query the IdentityDirectoryEvents table for the domain controller to see if any directory replication requests were made. B) Use the Microsoft Defender XDR advanced hunting to query the IdentityLogonEvents table for the domain controller. C) Use the Microsoft Sentinel workbook for MDI to visualize the attack timeline. D) Use the Microsoft Defender for Cloud Apps activity log to review the domain controller's activities. Which option should you choose?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the Microsoft Sentinel incident investigation graph to view entities and relationships. Then query the IdentityDirectoryEvents table for the domain controller to see if any directory replication requests were made.. A DCSync attack involves an attacker impersonating a domain controller to request directory replication via the MS-DRSR protocol. The IdentityDirectoryEvents table in Microsoft Defender for Identity captures directory service replication activities, including the DirectoryReplication request action. Querying this table for the domain controller allows you to confirm if unauthorized replication requests were made, directly indicating a successful DCSync attack.

Answer

Use the Microsoft Sentinel workbook for MDI to visualize the attack timeline.

Answer

Use the Microsoft Defender XDR advanced hunting to query the IdentityLogonEvents table for the domain controller.

Answer

Use the Microsoft Defender for Cloud Apps activity log to review the domain controller's activities.

Question 2

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You need to ensure that an external user from a partner organization can access a specific Sentinel workbook without having access to the entire Log Analytics workspace. What should you do?

Accepted Answer

Use Azure AD B2B collaboration to invite the external user and assign the Sentinel Reader role on the workbook.. Microsoft Entra B2B collaboration allows you to invite an external user from a partner organization into your Microsoft Entra ID tenant. By assigning the Sentinel Reader role specifically on the workbook resource (not the workspace), the user can view the workbook without gaining access to the underlying Log Analytics workspace data or other Sentinel resources. This meets the requirement of granular, scoped access.

Answer

Create a new Log Analytics workspace dedicated to the external partner and deploy the workbook there.

Answer

Share the workbook as a shared dashboard in the Azure portal.

Answer

Add the external user to the resource group containing the workspace with Reader role.

Question 3

Refer to the exhibit. An automation rule in Microsoft Sentinel is configured as shown. When a high-severity incident is created, what is the expected behavior?

Accepted Answer

The task is created, then the playbook runs, but the incident modification fails because the owner is incorrectly formatted.. The automation rule in Microsoft Sentinel executes actions sequentially. The task creation and playbook run succeed, but the incident modification fails because the owner field is incorrectly formatted. Sentinel expects the incident owner to be specified as a user principal name (UPN) or object ID, not a plain text string like 'SOC-Tier1'.

Answer

All actions execute successfully: task created, playbook runs, incident owner set to SOC-Tier1.

Answer

The rule fails to run because the actions are not in valid JSON format.

Answer

The playbook runs first, then the task is created, then the incident is modified.

Question 4

Your organization wants to use Microsoft Copilot for Security to generate incident summaries. What is the minimum license required?

Accepted Answer

Microsoft Copilot for Security standalone or add-on. Microsoft Copilot for Security is a standalone product that can be licensed independently or as an add-on to existing security subscriptions. It is not included in any Microsoft 365 or Defender plan by default; therefore, the minimum license required is either the standalone Copilot for Security SKU or the add-on license. This ensures the organization has the necessary entitlements to generate incident summaries using Copilot for Security.

Answer

Microsoft 365 E5

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Office 365 P2

Question 5

Your organization uses Microsoft Sentinel. You need to configure a playbook that automatically responds to incidents by creating a support ticket in ServiceNow. Which connector should you use?

Accepted Answer

ServiceNow connector. The ServiceNow connector is the correct choice because it provides a direct, pre-built integration between Microsoft Sentinel and ServiceNow, enabling automated creation of incidents or tickets in ServiceNow when a Sentinel incident is triggered. This connector uses the ServiceNow REST API to map Sentinel fields to ServiceNow ticket fields, eliminating the need for custom HTTP calls or additional middleware.

Answer

HTTP connector

Answer

Azure Monitor connector

Answer

Office 365 Outlook connector

Question 6

Your organization uses Microsoft Defender for Cloud. You need to view a list of all security recommendations for your Azure subscriptions. Which blade should you use?

Accepted Answer

Recommendations. The Recommendations blade in Microsoft Defender for Cloud is the centralized hub that lists all security recommendations for your Azure subscriptions, including those from Azure Security Benchmark and custom initiatives. It provides a prioritized view of security posture improvements, such as remediating vulnerabilities or enabling encryption, directly actionable from the blade.

Answer

Workbooks

Answer

Regulatory Compliance

Answer

Inventory

Question 7

Your organization uses Microsoft Defender XDR. You want to ensure that all incidents with severity 'High' are automatically assigned to the 'Tier1' group and have a playbook executed. What should you use?

Accepted Answer

Automation rules in Microsoft Sentinel. Automation rules in Microsoft Sentinel allow you to automatically assign incidents to a specific group (e.g., 'Tier1') and trigger a playbook based on incident properties such as severity. This directly meets the requirement to assign 'High' severity incidents to the 'Tier1' group and execute a playbook without manual intervention.

Answer

Microsoft Defender XDR incident assignment manually by analysts

Answer

Custom analytics rules in Microsoft Sentinel

Answer

Playbooks in Microsoft Sentinel

Question 8

Your organization has deployed Microsoft Sentinel in multiple regions. You need to ensure that incidents created in one workspace are available for correlation in a central workspace. What should you implement?

Accepted Answer

Sentinel workspace manager (incident replication). Sentinel Workspace Manager (incident replication) is the correct choice because it provides native, built-in replication of incidents from multiple workspaces to a central workspace without requiring custom code or external automation. This feature ensures that incidents created in regional workspaces are automatically synchronized to a designated central workspace, enabling unified correlation and investigation across regions.

Answer

Cross-workspace queries in KQL

Answer

Automated export of incidents to central workspace using Logic Apps

Answer

Azure Lighthouse

Question 9

Your organization uses Microsoft Defender for Identity. You need to create a role that allows analysts to view security alerts but not modify them. Which built-in role should you assign?

Accepted Answer

Security Reader. The Security Reader role (D) is the correct choice because it provides read-only access to security-related features in Microsoft 365 Defender, including the ability to view security alerts from Microsoft Defender for Identity without the ability to modify or respond to them. This aligns directly with the requirement to allow analysts to view alerts but not modify them, as the role grants no write permissions to security configurations or alert states.

Answer

Security Administrator

Answer

Compliance Administrator

Answer

Global Administrator

Question 10

Which TWO actions can you perform using Microsoft Sentinel automation rules? (Select two.)

Accepted Answer

Create a task on an incident. Option A is correct because Microsoft Sentinel automation rules support the "Create task" action, which adds a task to an incident for analyst follow-up. Option B is correct because automation rules can trigger a playbook (Logic App) to run against an incident, which is one of their primary purposes. Option C is not correct because incident creation is handled by analytics rules, not automation rules. Option D is not correct because automation rules cannot create other automation rules. Option E is not correct because sending an email is done by a playbook, not directly by an automation rule action.

Answer

Create an incident automatically

Answer

Create a new automation rule

Answer

Send an email notification

Question 11

Which THREE are valid ways to ingest data into Microsoft Sentinel? (Select three.)

Accepted Answer

Configuring Syslog using Azure Monitor Agent (AMA). The Azure Monitor Agent (AMA) can collect Syslog events from Linux-based sources and forward them to a Log Analytics workspace, which is the underlying data store for Microsoft Sentinel. By configuring a Data Collection Rule (DCR) that specifies the Syslog facility and severity levels, AMA streams these logs into the Syslog table in the workspace, making them available for detection and analysis within Sentinel.

Answer

Connecting to Azure DevOps directly

Answer

Importing from Power BI datasets

Question 12

Which TWO roles in Microsoft Entra ID can manage Microsoft Defender for Cloud Apps? (Select two.)

Accepted Answer

Security Administrator. The Security Administrator role in Microsoft Entra ID has the necessary permissions to manage Microsoft Defender for Cloud Apps, including configuring policies, investigating alerts, and managing app permissions. This role is specifically designed for security-related tasks within Microsoft 365 security products, making it a correct choice for managing Defender for Cloud Apps.

Answer

Compliance Administrator

Answer

Security Reader

Answer

Application Administrator

Question 13

You are a SOC analyst at Contoso. The environment includes Microsoft Sentinel in a single workspace, Microsoft Defender XDR (including Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps), Microsoft Entra ID, and Microsoft Intune. You need to design a solution to automatically triage and respond to phishing incidents detected by Defender for Office 365. The requirements are: 1) When a phishing alert is generated with high confidence, an incident should be automatically created in Sentinel. 2) The incident should be assigned to the 'Phishing' team and have a severity of High. 3) A playbook should run that will send a Teams message to the Phishing team and also block the sender in Exchange Online. 4) The incident should be automatically closed if the playbook successfully executes. What should you do?

Accepted Answer

Enable the Microsoft 365 Defender connector to synchronize incidents, create an automation rule triggered on incident creation with conditions for 'Phishing' and high confidence, assigning to 'Phishing' team, running a playbook, and enabling auto-closure.. It leverages the Microsoft 365 Defender connector to synchronize incidents from Defender for Office 365 into Microsoft Sentinel, which is the recommended approach for ingesting high-confidence phishing alerts. An automation rule triggered on incident creation with conditions for 'Phishing' and high confidence can assign the incident to the 'Phishing' team, run a playbook to send a Teams message and block the sender in Exchange Online, and enable auto-closure upon successful playbook execution.

Answer

Use the Office 365 connector to ingest alerts, then create an analytics rule to generate incidents, and use automation rules to assign and run playbooks.

Answer

Use a Logic App to continuously poll Defender for Office 365 APIs for alerts, create incidents via the Sentinel API, and assign them.

Answer

Create a custom analytics rule with KQL to detect phishing in Defender for Office 365 logs, generate incidents, and use automation rules.

Question 14

Your organization has recently deployed Microsoft Sentinel and wants to ensure that all critical Azure resources are monitored for security misconfigurations. You have already enabled Microsoft Defender for Cloud on all subscriptions. You need to configure a solution that will automatically create a Sentinel incident whenever a new security recommendation with severity 'High' is generated in Defender for Cloud. The incident should be assigned to the 'Infrastructure' team. Additionally, you want to run a playbook that will open a ticket in your IT Service Management (ITSM) tool. What should you do?

Accepted Answer

Enable the Defender for Cloud connector, then create an automation rule that triggers on incident creation from the connector, assigns to 'Infrastructure', and runs a playbook.. The Defender for Cloud connector in Microsoft Sentinel ingests security recommendations and alerts as incidents. By creating an automation rule that triggers on incident creation from this connector, you can automatically assign incidents to the 'Infrastructure' team and run a playbook to open a ticket in your ITSM tool, fulfilling all requirements without custom queries or workbooks.

Answer

Use the Azure Activity connector to ingest recommendations, then create an analytics rule to generate incidents.

Answer

Enable the Defender for Cloud connector and create a workbook to monitor recommendations.

Answer

Create a custom analytics rule that queries the SecurityRecommendation table in the Log Analytics workspace.

Question 15

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You need to ensure that a new SOC analyst can triage incidents without being able to delete or modify analytics rules. Which role should you assign?

Accepted Answer

Microsoft Sentinel Reader. Microsoft Sentinel Reader provides read-only access to Sentinel data, including incidents, workbooks, and analytics rules, but explicitly prevents any modifications or deletions. This role is ideal for SOC analysts who need to triage incidents without altering detection configurations. Security Reader and Global Reader lack Sentinel-specific incident triage permissions, while Security Operator allows modification of incidents, which exceeds the required scope.

Answer

Security Reader

Answer

Global Reader

Answer

Security Operator