SC-200 Manage a security operations environment Practice Test 22 — 15 Questions

Question 1

Your organization uses Microsoft Defender for Cloud Apps. You need to block downloads from a specific app for users outside the corporate network. What should you configure?

Accepted Answer

A session policy. A session policy in Microsoft Defender for Cloud Apps allows you to monitor and control user activities in real time by leveraging reverse proxy architecture. To block downloads from a specific app for users outside the corporate network, you configure a session policy with the action 'Block' and apply a condition based on the IP address tag (e.g., 'Not corporate IP range'). This enforces the restriction at the moment the user attempts to download, without affecting other app activities.

Answer

An anomaly detection alert

Answer

A file policy

Answer

An access policy

Question 2

Your organization uses Microsoft Sentinel with multiple watchlists. You need to create a KQL query that joins log data with a watchlist to enrich alerts. Which KQL operator should you use?

Accepted Answer

_GetWatchlist. The `_GetWatchlist` function is specifically designed to retrieve a watchlist by name in Microsoft Sentinel KQL queries, enabling enrichment of log data with the watchlist's fields. Unlike `lookup` or `join`, it directly accesses the watchlist artifact without requiring explicit key matching, making it the correct operator for this enrichment scenario.

Answer

lookup

Answer

union

Answer

join

Question 3

Which TWO actions are part of managing a security operations environment in Microsoft Sentinel? (Select two.)

Accepted Answer

Creating automation rules to triage incidents. Automation rules in Microsoft Sentinel allow you to automatically triage incidents by applying actions such as assigning ownership, changing severity, or running playbooks. This is a core operational task within the security operations environment to streamline incident response and reduce manual effort.

Answer

Configuring physical access controls to the data center

Answer

Installing the Azure Monitor Agent on servers

Answer

Creating Microsoft Purview sensitivity labels

Question 4

Which THREE components are part of Microsoft Defender XDR? (Select three.)

Accepted Answer

Microsoft Defender for Endpoint. Microsoft Defender XDR (Extended Detection and Response) is a unified security operations suite that natively integrates signals from Microsoft Defender for Endpoint (endpoint detection and response), Microsoft Defender for Identity (identity threat detection), and Microsoft Defender for Office 365 (email and collaboration security). These three components share telemetry and automate incident correlation across endpoints, identities, and productivity workloads, forming the core of the XDR platform. Options B (Microsoft Entra ID) and D (Microsoft Defender for Cloud) are not part of the Defender XDR suite; Entra ID is the identity provider, and Defender for Cloud is a cloud security posture management tool.

Answer

Microsoft Entra ID

Answer

Microsoft Defender for Cloud

Question 5

Which TWO features in Microsoft Sentinel can help reduce alert fatigue by grouping related alerts into incidents? (Select two.)

Accepted Answer

Incident merging. Incident merging (Option A) is correct because it automatically combines multiple alerts that share common entities (such as IP addresses, hostnames, or user accounts) into a single incident. This reduces alert fatigue by preventing security analysts from having to triage dozens of separate alerts that are all part of the same attack chain, allowing them to focus on a single, consolidated incident.

Answer

Entity behavior analytics

Answer

Automation rules that run playbooks

Answer

Threat intelligence indicators

Question 6

Refer to the exhibit. You are reviewing an automation rule in Microsoft Sentinel. What will happen when a new incident is created?

Accepted Answer

The playbook 'BlockIPPlaybook' will be executed. The automation rule is configured to trigger a playbook when an incident is created. The rule's action specifies 'Run playbook' with 'BlockIPPlaybook' selected, and the trigger condition is set to 'When incident is created'. This means that upon incident creation, Sentinel will execute the playbook as an automated response.

Answer

The incident severity will be changed

Answer

A new analytics rule will be created

Answer

The incident will be automatically closed

Question 7

Refer to the exhibit. You run a PowerShell command to retrieve incidents from Microsoft Sentinel. How many active incidents are there?

Accepted Answer

2. The PowerShell command `Get-AzSentinelIncident` retrieves incidents from Microsoft Sentinel. The output shows two incidents with a status of 'Active' (one with Status 'New' and one with Status 'Active'), while the third incident has a Status of 'Closed'. Only incidents with a status of 'New' or 'Active' are considered active. Therefore, there are exactly 2 active incidents.

Answer

3

Answer

2

Answer

1

Question 8

Refer to the exhibit. You run this KQL query in Microsoft Sentinel. What is the purpose of the query?

Accepted Answer

To count alerts by severity over the last week. The KQL query uses the `SecurityAlert` table and summarizes alerts by `AlertSeverity` using the `count()` aggregation function. The `where TimeGenerated > ago(7d)` filter restricts results to the last 7 days, and the `project` clause outputs only the severity and count columns. This directly produces a count of alerts grouped by severity over the last week, matching option B.

Answer

To list all incidents in the last 7 days

Answer

To find the most recent high-severity alert

Answer

To identify hunting results

Question 9

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. A security analyst reports that incidents related to ransomware are not being automatically triaged by the SOC automation playbook. You confirm that the playbook is enabled and connected to the analytics rule. What is the most likely cause of the issue?

Accepted Answer

The automation rule that triggers the playbook is set to run only when the incident is created by a specific provider (e.g., Microsoft Defender XDR), but the incident is created by Microsoft Sentinel.. The automation rule that triggers the playbook is configured with a condition that restricts it to incidents created by a specific provider, such as Microsoft Defender XDR. However, the ransomware incident is being created by Microsoft Sentinel (e.g., via an analytics rule), not by Microsoft Defender XDR. This provider mismatch prevents the automation rule from firing, so the playbook never runs, even though the playbook itself is enabled and connected to the analytics rule.

Answer

The Microsoft Sentinel workspace is in a different region than Microsoft Defender XDR.

Answer

The incident is not being created by the analytics rule.

Answer

The playbook is not associated with the correct analytics rule in the automation rule.

Question 10

You are designing a Microsoft Sentinel deployment for a multinational organization that must comply with GDPR and local data residency requirements. They have offices in the US, EU, and Asia. They want to use a single Microsoft Sentinel workspace for global visibility but need to ensure that data from EU sources remains within the EU. What is the best approach to meet these requirements?

Accepted Answer

Deploy separate Microsoft Sentinel workspaces in the US, EU, and Asia, and use cross-workspace queries and Azure Lighthouse to manage them centrally.. Deploying separate Microsoft Sentinel workspaces in each required region (US, EU, Asia) ensures that data from EU sources remains within the EU, satisfying GDPR and local data residency requirements. Cross-workspace queries and Azure Lighthouse allow centralized management and global visibility across these workspaces without moving data between regions.

Answer

Deploy a single Microsoft Sentinel workspace in the US and use Azure Policy to restrict data ingestion from EU sources.

Answer

Deploy a single workspace in the EU and enable UEBA to analyze all data.

Answer

Use Azure Lighthouse to project a single workspace into multiple regions, which automatically separates data storage.

Question 11

A security operations center (SOC) uses Microsoft Sentinel. They want to automatically block a user's account when a high-severity incident is created. Which automation action should you use in a playbook?

Accepted Answer

Run a playbook that calls the Microsoft Graph API to disable the user account.. Disabling the user account via Microsoft Graph API is the most direct and effective way to prevent further access when a high-severity incident is created. This action immediately blocks the user from authenticating across all services, which aligns with the requirement to automatically block the account. Other options either do not block the account (e.g., revoking sessions or resetting password) or are indirect and less reliable (e.g., updating Conditional Access policies).

Answer

Run a playbook that revokes the user's current sessions using Microsoft Graph API.

Answer

Run a playbook that resets the user's password.

Answer

Run a playbook that updates a conditional access policy in Microsoft Entra ID.

Question 12

Your Microsoft Sentinel workspace is ingesting logs from multiple sources. You notice that the data ingestion cost is higher than expected. You want to reduce costs without losing security value. Which action should you take?

Accepted Answer

Configure basic logs ingestion for verbose data sources such as firewall logs.. Basic logs are designed for high-volume, verbose data sources (e.g., firewall logs, syslog) that have lower security value. They are stored at a reduced cost and support only summary queries, not full KQL analytics. By routing verbose logs to basic logs, you reduce ingestion costs while retaining the ability to perform threat hunting and incident response on high-value analytics logs.

Answer

Reduce the retention period for all data to 30 days.

Answer

Switch the pricing tier from Capacity Reservations to Pay-as-you-go.

Answer

Disable analytics rules that generate high volume of alerts.

Question 13

Your organization uses Microsoft Defender XDR incident queue. You want to automatically assign incidents related to a specific campaign to a dedicated SOC group. What should you create?

Accepted Answer

A custom detection rule in Microsoft Defender XDR that includes an incident assignment action.. Microsoft Defender XDR allows you to create custom detection rules that can include automated incident assignment actions. This enables you to automatically assign incidents related to a specific campaign to a dedicated SOC group directly within the Defender XDR incident queue, without relying on external tools or manual processes.

Answer

A standard rule in Microsoft Defender for Endpoint.

Answer

An automation rule in Microsoft Sentinel.

Answer

A custom role in Microsoft Defender XDR.

Question 14

You are configuring Microsoft Sentinel to send email notifications to the SOC manager when a high-severity incident is created. What should you use?

Accepted Answer

Create a playbook that sends an email and assign it to an automation rule.. Automation rules in Microsoft Sentinel can trigger a playbook (an Azure Logic Apps workflow) when an incident is created. The playbook can include an action to send an email notification, enabling automated response to high-severity incidents without manual intervention.

Answer

Configure an analytics rule to send an email when an incident is created.

Answer

Use a workbook to track incidents and configure an alert for email.

Answer

Add the SOC manager's email to a watchlist and configure a scheduled query.

Question 15

Your organization uses Microsoft Sentinel. You need to ensure that only specific IP addresses from your corporate network can access the Sentinel workspace via the Azure portal. What should you configure?

Accepted Answer

Enable Azure Private Link for the workspace.. To restrict access to a Microsoft Sentinel workspace to specific IP addresses, you must control access to the Log Analytics workspace backend endpoint. Azure Private Link creates a private endpoint in a virtual network, allowing only traffic from that network (or specific subnets with NSGs) to reach the workspace. This effectively restricts IP-based access. Conditional Access policies control user access to the Azure portal but do not directly restrict network access to the workspace endpoint. NSGs on the subnet hosting the Log Analytics workspace are ineffective because the workspace is a PaaS service and not a resource within that subnet. Azure Firewall controls outbound traffic and does not restrict inbound access to the workspace.

Answer

Configure network security groups (NSGs) on the subnet hosting the Log Analytics workspace.

Answer

Configure a conditional access policy in Microsoft Entra ID.

Answer

Use Azure Firewall to restrict outbound traffic from the workspace.