SC-200 Manage a security operations environment Practice Test 22 — 15 Questions

Question 1

Your SOC uses Microsoft Sentinel with multiple workspaces for different business units. You want to create a single dashboard that shows key performance indicators (KPIs) across all workspaces. Which approach minimizes complexity and query latency?

Accepted Answer

Use cross-workspace queries in a single dashboard that references all workspaces.. Option B is correct because cross-workspace queries in a single dashboard are efficient and avoid data duplication. Option A is wrong because a separate workspace for dashboards adds complexity and latency. Option C is wrong because Azure Data Explorer is not needed for this simple aggregation. Option D is wrong because Power BI would require data export, adding latency.

Answer

Export data to Azure Data Explorer and build the dashboard there.

Answer

Ingest all logs into a single workspace and create the dashboard there.

Answer

Use Power BI to query each workspace separately and combine data.

Question 2

Your organization uses Microsoft Defender for Office 365 and Microsoft Sentinel. You discover that phishing emails are bypassing Defender for Office 365 and being reported by users. You need to ensure that user-reported emails are automatically analyzed and incidents are created in Sentinel for high-confidence phishing. What should you configure?

Accepted Answer

Enable the 'User reported messages' feature in Defender for Office 365 and ensure the Microsoft Defender XDR connector is enabled in Sentinel.. Option D is correct because the User Reported Messages feature in Defender for Office 365 can trigger automated analysis and, when integrated with Sentinel via the connector, can create incidents. Option A is wrong because a mail flow rule cannot create Sentinel incidents. Option B is wrong because creating a submission rule manually does not automate analysis. Option C is wrong because a custom connector would be more complex than using the built-in integration.

Answer

Set up a custom connector using Microsoft Graph API to ingest user-reported messages into Sentinel.

Answer

Use the Microsoft 365 Defender portal to create a submission rule for user-reported messages.

Answer

Configure a mail flow rule to forward user-reported messages to a dedicated mailbox monitored by Sentinel.

Question 3

Your SOC team uses Microsoft Sentinel and Microsoft Defender XDR. A junior analyst creates a custom analytics rule in Sentinel that generates an excessive number of incidents. The rule appears to be running but not producing any results. What is the most likely cause?

Accepted Answer

The rule's query syntax is invalid.. Option C is correct because if the query syntax is incorrect, the rule may run but return no results, thus no incidents. Option A is wrong because a disabled rule would not run. Option B is wrong because insufficient permissions would cause an error, not silent failure. Option D is wrong because low severity does not prevent incident creation.

Answer

The analyst does not have permissions to create incidents.

Answer

The rule is set to a low severity.

Answer

The rule is disabled.

Question 4

Which TWO actions are valid ways to reduce the number of false positive incidents in Microsoft Sentinel without disabling analytics rules?

Accepted Answer

Modify the rule's query to include additional filters.. Options B and D are correct. Option B: Automation rules can close incidents based on conditions. Option D: Tuning the rule's query logic (e.g., adding exclusions) reduces false positives. Option A is wrong because increasing run frequency does not reduce false positives. Option C is wrong because grouping alerts per-entity does not filter false positives. Option E is wrong because changing severity does not reduce incidents.

Answer

Configure the rule to group all alerts into a single incident per entity.

Answer

Increase the rule run frequency.

Answer

Change the incident severity to Informational.

Question 5

Which THREE are valid components of a Microsoft Sentinel automation rule?

Accepted Answer

Actions (e.g., Run playbook, Change severity). Option A is correct because automation rules in Microsoft Sentinel allow you to define actions such as running a playbook or changing the severity of an incident. These actions are executed automatically when the rule's trigger and conditions are met, enabling streamlined incident response without manual intervention.

Answer

Watchlist

Answer

KQL query

Question 6

Which TWO are supported data sources for Microsoft Sentinel?

Accepted Answer

Microsoft Entra ID audit logs. Options A and D are correct. Microsoft Sentinel supports AWS CloudTrail via the Amazon Web Services connector and Microsoft Entra ID audit logs via the Azure Active Directory connector (now Microsoft Entra ID). Option B is wrong because on-premises syslog-ng is not directly supported; syslog is supported via a connector. Option C is wrong because Google Cloud VPC Flow Logs are not natively supported. Option E is wrong because Windows Server 2008 is out of support and not recommended.

Answer

Google Cloud VPC Flow Logs

Answer

Windows Server 2008 event logs

Answer

On-premises syslog-ng

Question 7

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You need to ensure that incidents created in Microsoft Defender XDR are automatically synchronized to Microsoft Sentinel with the least administrative effort. What should you configure?

Accepted Answer

Enable the Microsoft Defender XDR data connector in Microsoft Sentinel.. The Microsoft Defender XDR connector in Microsoft Sentinel automatically streams incidents and alerts from Defender XDR into Sentinel. Option A is correct because it enables bidirectional synchronization out of the box. Option B is wrong because Logic Apps would require custom workflows and more effort. Option C is wrong because the API connector is for custom integration, not automated synchronization. Option D is wrong because enabling raw data ingestion does not synchronize incidents.

Answer

Create a Logic App that uses the Microsoft Defender XDR API to fetch incidents and push them to Microsoft Sentinel.

Answer

Use the Microsoft Sentinel API to pull incidents from Microsoft Defender XDR.

Answer

Enable raw data ingestion from Microsoft Defender for Endpoint to Microsoft Sentinel.

Question 8

You are reviewing an analytics rule configuration in Microsoft Sentinel using ARM template JSON. The rule is enabled and incident creation is set to true. However, when alerts are generated, they are not being grouped into a single incident. What is the most likely reason?

Accepted Answer

The groupingConfiguration is disabled.. The grouping configuration has enabled set to false. This means that even though incident creation is enabled, alerts will not be grouped; each alert will create its own incident. Option A correctly identifies this. Option B is wrong because matchingMethod is set but grouping is disabled. Option C is wrong because grouping is disabled, not because of lookbackDuration. Option D is wrong because the rule is enabled and incident creation is true.

Answer

The lookbackDuration is set to 5 hours which is too short.

Answer

The matchingMethod is set to 'AllEntities' which is not supported.

Answer

The rule is not enabled properly.

Question 9

Your organization uses Microsoft Sentinel. You need to ensure that only users with the appropriate permissions can run playbooks from within the incident investigation interface. What role should you assign to the security operations team?

Accepted Answer

Microsoft Sentinel Contributor. The Microsoft Sentinel Contributor role is required to run playbooks from the incident interface. Option B is correct because it includes permissions to use playbooks. Option A is wrong because Reader cannot run playbooks. Option C is wrong because Responder can triage but not run playbooks. Option D is wrong because Global Admin is overly privileged and not recommended.

Answer

Microsoft Sentinel Reader

Answer

Microsoft Sentinel Responder

Answer

Global Administrator in Microsoft Entra ID

Question 10

Your company uses Microsoft Sentinel and has enabled the Microsoft Defender XDR connector. You notice that incidents from Microsoft Defender for Cloud Apps are not appearing in Microsoft Sentinel. All other Defender XDR incidents appear correctly. What is the most likely cause?

Accepted Answer

The Microsoft Defender for Cloud Apps data connector is not enabled in Microsoft Sentinel.. Microsoft Defender for Cloud Apps incidents are ingested into Microsoft Sentinel via the Microsoft Defender XDR connector, but only if the data connector for Microsoft Defender for Cloud Apps is also enabled separately in Sentinel. Option A is correct. Option B is wrong because license requirements are for other connectors. Option C is wrong because roles are not the issue. Option D is wrong because the connector is for Defender XDR, not for Cloud Apps specifically.

Answer

The security operations team does not have the appropriate permissions.

Answer

The Microsoft Defender XDR connector only ingests incidents from Microsoft Defender for Endpoint.

Answer

The Microsoft 365 E5 license is not assigned to the users.

Question 11

Your organization is using Microsoft Sentinel and you are responsible for managing the security operations environment. You need to ensure that a new security analyst can triage incidents but cannot modify analytics rules. Which role should you assign?

Accepted Answer

Microsoft Sentinel Responder. The Microsoft Sentinel Responder role allows triaging of incidents (changing status, assigning) but cannot modify analytics rules. Option C is correct. Option A is wrong because Reader cannot triage (cannot change status). Option B is wrong because Contributor can modify analytics rules. Option D is wrong because although it allows triage, it also allows modifying rules, which is not desired.

Answer

Microsoft Sentinel Reader

Answer

Microsoft Sentinel Contributor

Answer

Microsoft Sentinel Contributor with a custom role denying rule modification

Question 12

Your organization uses Microsoft Defender XDR. You need to configure a custom detection rule that runs every hour and alerts when a specific process is executed on multiple devices within 10 minutes. Which type of rule should you create?

Accepted Answer

Custom detection rule. Custom detection rules in Microsoft Defender XDR allow you to create scheduled queries that run on a schedule (e.g., every hour) and can use aggregations like count of devices within a time window. Option A is correct. Option B is wrong because hunting queries are one-time or scheduled but not custom detection rules. Option C is wrong because advanced hunting is a query interface, not a rule type. Option D is wrong because behavioral rules are for specific behaviors, not scheduled queries.

Answer

Hunting query saved as a detection

Answer

Behavioral rule

Answer

Advanced hunting query

Question 13

Your organization uses Microsoft Sentinel. You need to ensure that an incident is automatically assigned to the appropriate team based on the type of alert. What should you configure?

Accepted Answer

Automation rule. Automation rules in Microsoft Sentinel allow you to automatically assign incidents to a specific owner or team based on conditions such as alert type. Option A is correct. Option B is wrong because playbooks can take actions but assignment is typically done by automation rules. Option C is wrong because workbooks are for visualization. Option D is wrong because analytics rules create alerts, not assign incidents.

Answer

Workbook

Answer

Playbook

Answer

Analytics rule

Question 14

You are reviewing a KQL query used in a Microsoft Sentinel analytics rule. The query is intended to alert when there are more than 5 alerts of the same name for the same entity type within the last hour. However, the rule is not triggering as expected. What is the most likely issue?

Accepted Answer

The parsing of Entities array may fail if the first entity does not have a 'Type' field.. The most likely issue is that the KQL query parses the 'Entities' array, which is a dynamic JSON field in Microsoft Sentinel alerts. If the first entity in the array does not have a 'Type' field, the parsing logic (e.g., using 'mv-expand' or accessing array indices) will fail or return null, causing the query to produce no results. This prevents the rule from triggering even when conditions are otherwise met.

Answer

The 'summarize' operator does not support 'AlertCount' as a column name.

Answer

The query uses 'tostring' incorrectly.

Answer

The 'where TimeGenerated > ago(1h)' is outside the allowed range.

Question 15

Your organization uses Microsoft Defender for Cloud Apps and Microsoft Sentinel. You need to ensure that anomalous behavior alerts from Defender for Cloud Apps are automatically converted to incidents in Sentinel. What should you configure?

Accepted Answer

Enable the Microsoft Defender for Cloud Apps data connector in Microsoft Sentinel.. The Microsoft Defender for Cloud Apps connector in Microsoft Sentinel allows you to ingest alerts and convert them to incidents. Option B is correct. Option A is wrong because the Microsoft 365 connector does not include Cloud Apps alerts. Option C is wrong because a playbook would be an extra step. Option D is wrong because the Defender for Identity connector is for identity alerts.

Answer

Enable the Microsoft Defender for Identity data connector in Microsoft Sentinel.

Answer

Enable the Microsoft 365 data connector in Microsoft Sentinel.

Answer

Create a playbook that triggers on Defender for Cloud Apps alerts and creates incidents in Sentinel.