SC-200 Manage a security operations environment Practice Test 23 — 15 Questions

Question 1

You are managing a Microsoft Sentinel environment. An analyst reports that a scheduled analytics rule is not generating alerts. The rule has been enabled for a week. What is the most likely cause?

Accepted Answer

The rule's query does not match any events in the workspace.. The most likely cause is that the rule's query does not match any events in the workspace. Since the rule has been enabled for a week, if the query logic is correct and data exists, alerts should have been generated. The absence of alerts strongly indicates that the query returns zero results, which is a common issue when the KQL query references tables, columns, or conditions that do not exist in the ingested data.

Answer

The rule is disabled due to a cost threshold.

Answer

The rule has a short lookback period that misses data.

Answer

The rule is configured as a real-time rule instead of scheduled.

Question 2

Which TWO of the following are valid methods to reduce Microsoft Sentinel data ingestion costs?

Accepted Answer

Configure basic logs for high-volume verbose data sources.. Microsoft Sentinel allows you to configure basic logs for high-volume, verbose data sources (e.g., DNS or firewall logs) to reduce costs. Basic logs are stored at a lower ingestion price and support only simple queries, making them ideal for debugging or compliance data that doesn't require advanced analytics.

Answer

Disable all analytics rules.

Answer

Switch all data sources to basic logs.

Answer

Increase the retention period for all tables.

Question 3

Which THREE of the following are capabilities of Microsoft Copilot for Security?

Accepted Answer

Summarize incidents from Microsoft Defender XDR.. Microsoft Copilot for Security can summarize incidents from Microsoft Defender XDR, providing a concise overview of alerts, affected assets, and attack chains. This capability leverages natural language processing to parse incident data and generate human-readable summaries, aiding analysts in rapid triage.

Answer

Manage Azure Policy assignments.

Answer

Automatically configure conditional access policies.

Question 4

Which TWO of the following are required to enable Microsoft Sentinel UEBA (User and Entity Behavior Analytics)?

Accepted Answer

Enable UEBA in the Microsoft Sentinel workspace settings.. UEBA must be explicitly enabled in the Microsoft Sentinel workspace settings under the 'Entity behavior analytics' blade. This activation allows Sentinel to start profiling user and entity behaviors using built-in machine learning models. Without this toggle, UEBA remains disabled regardless of other configurations.

Answer

Integrate Microsoft Defender for Cloud Apps.

Answer

Purchase a separate UEBA license.

Answer

Configure Azure Key Vault to store UEBA data.

Question 5

Refer to the exhibit. You have an automation rule in Microsoft Sentinel configured as shown. An analyst reports that low-severity incidents are not being closed automatically. The rule is enabled and has the highest order. What is the most likely reason?

Accepted Answer

The automation rule does not have the required permissions to modify incidents.. The automation rule requires an automation account with Microsoft Sentinel contributor permissions to run playbooks or modify incidents. Without these permissions, the rule cannot close incidents regardless of its order or enabled status. The rule being enabled and having the highest order does not override the missing permissions.

Answer

The rule is triggered by alerts, not incidents.

Answer

The rule is set to close incidents with classification 'TruePositive' but low-severity incidents are not true positives.

Answer

The rule is disabled due to a conflict with another rule.

Question 6

Refer to the exhibit. You are using this KQL query in a Microsoft Sentinel scheduled analytics rule to detect brute-force attacks. The rule has been running for a week but has never triggered an alert. What is the most likely reason?

Accepted Answer

The SecurityEvent table is not being populated because Windows event collection is not configured.. The SecurityEvent table is populated only if Windows Event Forwarding or agent-based collection is configured. Without that, the table is empty, so the query returns no results and the rule never fires. Option A is incorrect: a 24-hour lookback with a 5-minute run interval does not cause data loss; the rule’s query window includes the lookback, so all events within the last 24 hours are evaluated each run. Option B is incorrect: there is no indication of a syntax error; the query would produce an error if it were invalid, not just return zero results. Option C is incorrect: 'summarize' is fully supported in analytics rules and is commonly used for aggregation.

Answer

The query uses a 24-hour lookback and the rule runs every 5 minutes, so it misses data.

Answer

The query syntax is incorrect.

Answer

The query uses 'summarize' which is not allowed in analytics rules.

Question 7

Refer to the exhibit. You have a Microsoft Sentinel playbook created as shown. When you test the playbook manually, it sends an email successfully. However, when an incident triggers the playbook via an automation rule, the email is not sent. What is the most likely cause?

Accepted Answer

The playbook uses an HTTP trigger instead of a Microsoft Sentinel trigger.. The exhibit shows a playbook that begins with an HTTP trigger, not a Microsoft Sentinel trigger. When an incident triggers the playbook via an automation rule, Sentinel expects the playbook to start with a Microsoft Sentinel trigger (e.g., 'When a response to a Microsoft Sentinel incident is triggered'). An HTTP trigger requires an external HTTP request to start the playbook, which the automation rule does not provide, so the playbook never executes the email action.

Answer

The playbook does not have permission to read incidents.

Answer

The email action is not configured correctly.

Answer

The Office 365 connection is not authorized.

Question 8

Your organization uses Microsoft Defender for Cloud Apps. You need to ensure that alerts from Defender for Cloud Apps are forwarded to Microsoft Sentinel. Which connector should you use in Sentinel?

Accepted Answer

Microsoft Defender for Cloud Apps connector. The Microsoft Defender for Cloud Apps connector in Microsoft Sentinel is specifically designed to ingest alerts and logs from Defender for Cloud Apps, including anomaly detection, policy violations, and threat intelligence alerts. This connector uses the Microsoft Graph API to pull data directly from the Defender for Cloud Apps service, ensuring that all relevant security alerts are forwarded to Sentinel for centralized monitoring and incident response.

Answer

Windows Security Events via AMA connector

Answer

Microsoft 365 Defender connector

Answer

Azure Activity connector

Question 9

Your SOC team uses Microsoft Sentinel. You receive a high volume of false positive incidents from a specific analytics rule. The rule uses a scheduled query that runs every 5 minutes. What is the most efficient way to reduce false positives without disabling the rule?

Accepted Answer

Modify the rule to use entity mapping and alert grouping. Modifying the rule to use entity mapping and alert grouping consolidates related alerts into a single incident, reducing noise and false positives. Option A is wrong because reducing the run frequency to every hour would not address the false positive issue and could delay detection. Option B is wrong because disabling and recreating the rule is disruptive and unnecessary; modifying the existing rule is more efficient. Option C is wrong because using a suppression rule to automatically close incidents would hide true positives alongside false positives, potentially missing real threats.

Answer

Increase the query run frequency to every hour

Answer

Disable the rule and create a new one with a different query

Answer

Use a suppression rule to close incidents automatically for 24 hours

Question 10

You are configuring Microsoft Sentinel to use automation rules for incident response. You need to ensure that when an incident is created with a severity of High, a playbook is triggered to isolate the affected device. However, the playbook should not run if the incident is created by a specific analytics rule (RuleID: '12345'). What is the best way to implement this?

Accepted Answer

Create two automation rules: one for High severity from rule '12345' with no action, and one for High severity with condition 'Analytics rule name not equals 12345' that triggers the playbook. This approach uses two automation rules with different conditions and order of evaluation. The first rule handles incidents from rule ID '12345' with High severity but takes no action, effectively excluding them from further processing. The second rule applies to all other High severity incidents (where analytics rule name is not '12345') and triggers the playbook to isolate the device. Automation rules are evaluated in order, and the first matching rule's actions are executed, so incidents from rule '12345' will be caught by the first rule and will not trigger the playbook. Option A is incorrect because although a playbook could check the rule ID, the requirement is to prevent the playbook from running at all for those incidents; using a playbook to filter after triggering adds unnecessary complexity and latency. Option C is incorrect because automation rules cannot directly filter on analytics rule ID; they can filter on analytics rule name, but even then, a single condition group cannot combine 'High severity' and 'rule name not equals 12345' effectively because the condition logic is AND within a group, but you would need to exclude a specific rule which is not straightforward. Option D is incorrect because using OR would trigger the playbook for all High severity incidents as well as all incidents not from rule '12345', which is not the desired outcome.

Answer

Create an automation rule for all High severity incidents, then use a playbook to check the rule ID and skip if needed

Answer

Create one automation rule with condition: Severity equals High and Analytics rule ID not equals '12345'

Answer

Create one automation rule with conditions: Severity equals High OR Analytics rule name not equals '12345'

Question 11

Your organization has Microsoft Defender for Office 365. You need to review a user's reported phishing email in Microsoft Defender XDR. Which section of the Microsoft Defender portal should you check?

Accepted Answer

Submissions. The Submissions page in the Microsoft Defender portal is the dedicated section for reviewing user-reported phishing emails. It allows security operators to view, analyze, and take action on messages that users have reported as suspicious or malicious, directly integrating with Microsoft Defender for Office 365's threat intelligence pipeline.

Answer

Threat Explorer

Answer

Alerts

Answer

Action center

Question 12

Your organization uses Microsoft Sentinel and has a large number of incidents daily. You need to automatically assign incidents to the correct SOC tier based on severity: Low severity to Tier 1, Medium to Tier 2, High and Critical to Tier 3. Which approach should you use?

Accepted Answer

Create three separate automation rules, each with a condition on severity and a playbook that assigns to the appropriate group. Automation rules in Microsoft Sentinel can be configured with separate conditions for each severity level, and each rule can trigger a distinct playbook that assigns incidents to the appropriate SOC tier. This approach is simple, scalable, and avoids unnecessary complexity or single points of failure, aligning with best practices for incident routing.

Answer

Configure custom details in the analytics rule to include severity, then use a playbook to assign

Answer

Create one automation rule with multiple conditions and trigger a playbook that uses a switch statement on severity

Answer

Use incident grouping to combine incidents by severity and assign the group

Question 13

You are a SOC analyst using Microsoft Sentinel. You receive an incident with high severity. You need to quickly gather additional context about the affected user account, including recent sign-in logs and role assignments. Which feature should you use?

Accepted Answer

Entity pages. Entity pages in Microsoft Sentinel provide a centralized, pre-built view of a specific entity (such as a user account), aggregating related alerts, incidents, and data from connected sources like Azure Active Directory sign-in logs and role assignments. This allows a SOC analyst to quickly gather contextual information without manually querying multiple data sources, making it the ideal feature for high-severity incidents requiring rapid investigation.

Answer

Sentinel Workbooks

Answer

Analytics rules

Answer

Hunting queries

Question 14

Your organization uses Microsoft Defender for Identity (MDI) and Microsoft Sentinel. You notice that MDI alerts are not appearing in Sentinel. You have already installed the MDI data connector and configured the workspace. What is the most likely cause?

Accepted Answer

The data connector is not enabled, even though it is installed. The most likely cause is that the MDI data connector, although installed, is not enabled. In Microsoft Sentinel, installing a data connector only makes it available; you must explicitly enable it to start ingesting data. Without enabling the connector, alerts from Microsoft Defender for Identity will not flow into Sentinel, even if the workspace is correctly configured.

Answer

The workspace is in a different region than MDI

Answer

The Microsoft 365 Defender connector is not installed

Answer

Microsoft Defender for Identity is not licensed

Question 15

You are designing a Microsoft Sentinel deployment. You need to minimize ingestion costs while ensuring that all security-relevant events are collected. Which strategy should you use?

Accepted Answer

Use Basic Logs for verbose data sources like Windows firewall logs, and Analytic Logs for high-value security logs. In Microsoft Sentinel, Basic Logs are a lower-cost option for data sources that generate high volumes of verbose data (e.g., Windows firewall logs, DNS logs) but do not require full query capabilities or advanced analytics. Analytic Logs, while more expensive, provide full KQL querying and are reserved for high-value security logs (e.g., security events, Microsoft 365 Defender alerts) that need deep investigation. Option B correctly balances cost and coverage. Option A is wrong because using Analytic Logs for all data sources would be unnecessarily expensive. Option C is wrong because short retention may cause loss of critical data for compliance or forensics; export to storage is a retention tool, not a cost-optimization strategy. Option D is wrong because ignoring other sources (e.g., network, endpoints, firewalls) creates security gaps.

Answer

Use Analytic Logs for all data sources to ensure full query capabilities

Answer

Set short retention periods for all logs and export to storage

Answer

Collect only logs from Microsoft 365 Defender and ignore other sources