SC-200 Manage a security operations environment Practice Test 23 — 15 Questions

Question 1

You are configuring a Microsoft Sentinel automation rule to automatically assign incidents to a specific owner based on a custom property. Which action type should you use?

Accepted Answer

Assign owner. The 'Assign owner' action type is specifically designed to change the owner of an incident in Microsoft Sentinel. When you need to automatically assign incidents to a specific owner based on a custom property (e.g., a tag or custom field), this action directly modifies the incident's 'Owner' property. Other action types serve different purposes: 'Run playbook' executes a logic app, 'Change status' updates the incident's status (e.g., New, Active, Closed), and 'Create ticket (preview)' creates an external ticket in a connected ticketing system.

Answer

Run playbook

Answer

Change status

Answer

Create ticket (preview)

Question 2

Which TWO actions can be performed using Microsoft Sentinel automation rules? (Choose two.)

Accepted Answer

Change the severity of an incident. Automation rules in Microsoft Sentinel allow you to automate incident management tasks, including changing the severity of an incident and adding tags. These actions are part of the incident-handling workflow and can be triggered when an incident is created or updated, enabling consistent triage and enrichment without manual intervention.

Answer

Deploy a data connector

Answer

Modify a watchlist

Answer

Create a scheduled query rule

Question 3

Which TWO conditions must be met to enable Microsoft Sentinel UEBA? (Choose two.)

Accepted Answer

Microsoft Entra ID P2 licenses must be assigned to users.. Microsoft Sentinel UEBA requires the SecurityInsights solution to be installed in the Log Analytics workspace, as this solution provides the UEBA data connectors and analytics rules. Additionally, Microsoft Entra ID P2 licenses are required because UEBA relies on the identity protection and risk detection capabilities that are only available with P2 licensing, enabling the enrichment of entity behavior profiles with risk data.

Answer

KQL queries must be created for entity behavior.

Answer

Microsoft Defender XDR must be onboarded.

Answer

Azure SQL Database must be deployed.

Question 4

Which THREE permissions are required for a user to manage Microsoft Sentinel playbooks using Azure Logic Apps? (Choose three.)

Accepted Answer

Microsoft Sentinel Contributor. Microsoft Sentinel Contributor is required because it grants the necessary permissions to create, update, and delete playbooks within Microsoft Sentinel, which are built on Azure Logic Apps. This role allows the user to manage playbooks as part of the security operations environment, including assigning playbooks to automation rules and incident triggers.

Answer

Global Administrator in Microsoft Entra ID

Answer

Reader on the Logic App

Question 5

You are reviewing a Microsoft Sentinel analytics rule configuration. The rule is not generating incidents as expected. What is the most likely cause?

Accepted Answer

The query references a table that is not available in the Sentinel workspace.. If the query in an analytics rule references a table that does not exist in the Microsoft Sentinel workspace, the rule will fail to execute or return no results, preventing incident generation. This is a common misconfiguration when migrating or authoring rules that depend on specific data connectors or schema that have not been onboarded.

Answer

The queryFrequency and queryPeriod are mismatched.

Answer

The suppressionDuration is set to 5 hours, suppressing alerts.

Answer

The action type 'MFA disabled' is not supported in IdentityLogonEvents.

Question 6

Your organization has recently deployed Microsoft Sentinel and Microsoft Defender XDR. You are tasked with configuring the environment to ensure that incidents created by Microsoft Defender for Cloud Apps are automatically synchronized to Microsoft Sentinel. The security operations team wants to manage all incidents from within Sentinel. You have already connected the Microsoft Defender XDR connector to Sentinel. However, you notice that incidents from Defender for Cloud Apps are not appearing in Sentinel. You verify that the Defender for Cloud Apps connector is not listed in the data connectors blade. What should you do to resolve this issue?

Accepted Answer

Ensure the Microsoft Defender XDR connector is configured to include Defender for Cloud Apps incidents.. When Microsoft Defender XDR connector is enabled in Sentinel, it can ingest incidents from all Microsoft Defender products, including Defender for Cloud Apps, provided the connector's configuration includes the option to synchronize those incidents. Since the Defender for Cloud Apps connector is not listed separately, the correct approach is to verify and adjust the Microsoft Defender XDR connector's settings to include Defender for Cloud Apps incidents. Option D directly addresses this by ensuring the existing connector is configured to forward those incidents.

Answer

Enable the Microsoft Sentinel integration in the Defender for Cloud Apps portal.

Answer

Configure a data collection rule in Microsoft Purview to forward alerts to Sentinel.

Answer

Install the Microsoft Defender for Cloud Apps connector from Sentinel data connectors.

Question 7

You are the security operations lead for a multinational company using Microsoft Sentinel. You have deployed a custom analytics rule that uses a KQL query to detect anomalous outbound network traffic. The rule runs every hour and looks back 24 hours. Recently, the rule has been generating a high number of false positives. You need to tune the rule to reduce false positives without missing genuine threats. The rule currently triggers when the count of outbound connections to a single IP exceeds 100 in an hour. You analyze the data and find that legitimate cloud services often trigger the rule. What should you do?

Accepted Answer

Modify the KQL query to exclude traffic to known benign IP ranges.. The most effective way to reduce false positives without missing genuine threats is to refine the KQL query to exclude traffic to known benign IP ranges, such as those belonging to legitimate cloud services. This preserves the detection logic for suspicious IPs while eliminating noise from trusted sources. It is a targeted tuning approach that maintains threat coverage.

Answer

Disable the rule and create a new one with a different query.

Answer

Increase the threshold to 200 connections per hour.

Answer

Configure a suppression rule to automatically close incidents from those IPs.

Question 8

Your organization uses Microsoft Sentinel with UEBA enabled. You are investigating a suspicious incident where a user's account is reported to have accessed an unusual amount of data from a SharePoint site. The incident alert points to the user 'jdoe@contoso.com'. You open the incident and see that the entity timeline for jdoe shows several activities, including file downloads. However, you notice that the timeline does not include any Azure AD sign-in events for this user. You need to include sign-in events in the entity timeline to get a complete picture. What should you do?

Accepted Answer

Install the Azure Active Directory connector to ingest sign-in logs.. The entity timeline in Microsoft Sentinel relies on data already ingested into the workspace. Since Microsoft Entra ID sign-in events are not appearing, the most likely cause is that the Microsoft Entra ID connector has not been installed or configured. Installing this connector ingests sign-in logs (and audit logs) into Sentinel, which then populates the entity timeline with sign-in activities for users like jdoe.

Answer

Enable UEBA for Azure AD in the Sentinel settings.

Answer

Install the Office 365 connector to ingest Azure AD logs.

Answer

Configure the entity timeline to include Azure AD events manually.

Question 9

You are a security analyst at a company that uses Microsoft Defender XDR. You receive an alert about a potential ransomware activity on a workstation. The alert is generated by Microsoft Defender for Endpoint. You need to contain the threat by isolating the workstation from the network while allowing forensic analysis to proceed. You want to use Microsoft Defender XDR's built-in actions. What should you do?

Accepted Answer

Use the 'Isolate device' action from the Microsoft Defender XDR portal.. The 'Isolate device' action in Microsoft Defender XDR (specifically from the Microsoft Defender for Endpoint component) disconnects the device from all network traffic except for the Defender for Endpoint service and a few authorized services (such as Windows Update and the Microsoft Update Service). This allows forensic analysis tools (like Live Response) to continue communicating with the device while preventing the ransomware from spreading laterally or communicating with command-and-control servers. This is the built-in, recommended containment action for such scenarios.

Answer

Create a firewall rule in Microsoft Defender for Cloud Apps to block the device's IP.

Answer

Unenroll the device from Microsoft Intune.

Answer

Disable the network adapter on the workstation remotely.

Question 10

Your company uses Microsoft Sentinel to monitor security events. You have configured a daily email report that summarizes the top 10 incidents from the past 24 hours. The report is sent using a Logic App playbook triggered by a scheduled query. Recently, the report has stopped being delivered. You check the Logic App run history and see that the last run failed with an HTTP 403 error when connecting to the Microsoft Sentinel API. The Logic App uses a managed identity for authentication. What is the most likely cause of the failure?

Accepted Answer

The managed identity does not have the required permissions on the Sentinel workspace.. The HTTP 403 error indicates a permissions failure when the Logic App attempted to call the Microsoft Sentinel API. Since the Logic App uses a managed identity for authentication, the most likely cause is that the managed identity lacks the necessary role assignments on the Sentinel workspace, such as 'Microsoft Sentinel Contributor' or 'Microsoft Sentinel Reader', which are required to query incidents via the API.

Answer

The managed identity's client ID has changed.

Answer

The Logic App is not connected to Microsoft Entra ID.

Answer

The scheduled query is no longer running.

Question 11

Your company uses Microsoft Defender for Cloud Apps to monitor cloud applications. You have discovered that a user is accessing a sanctioned cloud storage app from an IP address that belongs to a known malicious botnet. You need to automatically block the user's access to the app and require them to re-authenticate. You have already configured session policies in Defender for Cloud Apps. What should you do next?

Accepted Answer

Configure a session policy in Defender for Cloud Apps with the action 'Block' and 'Require re-authentication'.. Session policies in Defender for Cloud Apps can enforce real-time controls on sanctioned apps. By configuring a session policy with the actions 'Block' and 'Require re-authentication', you can immediately terminate the user's session and force them to re-authenticate, which effectively blocks access from the malicious IP while ensuring the user re-verifies their identity.

Answer

Create an access policy in Defender for Cloud Apps to block the user.

Answer

Create an app governance policy in Microsoft Purview to block the app.

Answer

Create a device compliance policy in Microsoft Intune to block the device.

Question 12

You are a security operations analyst for a company that uses Microsoft Sentinel. You need to ensure that incidents are automatically assigned to the appropriate team based on the incident type. Which two actions should you take?

Accepted Answer

Define custom details in the analytics rule to include the team name, then use an automation rule to assign.. Custom details in an analytics rule allow you to extract and store the team name from the incident data, and then an automation rule can use that custom detail as a condition to automatically assign the incident to the appropriate owner. This approach ensures dynamic assignment based on the incident type without requiring a playbook or manual intervention.

Answer

Modify the analytics rule to set the incident owner directly.

Answer

Create a playbook that assigns incidents based on the incident type.

Answer

Create a workbook that filters incidents by type and assigns them manually.

Question 13

Your organization uses Microsoft Defender XDR and Microsoft Sentinel. You need to ensure that high-severity incidents are automatically escalated to the on-call security engineer via Microsoft Teams. Which three components should you configure?

Accepted Answer

A playbook that uses a condition to check severity and then sends a Teams message.. A playbook in Microsoft Sentinel can contain a condition action that evaluates the incident severity. If the severity is 'High', the playbook then uses a Microsoft Teams connector to send a message to the on-call security engineer, automating the escalation process.

Answer

An analytics rule that sends a Teams message when a high-severity alert fires.

Answer

A workbook that displays high-severity incidents for manual escalation.

Question 14

Your organization uses Microsoft Defender for Cloud and Microsoft Sentinel. You need to ensure that security alerts from Defender for Cloud are automatically synchronized to Sentinel and assigned to the cloud security team. Which three actions should you take?

Accepted Answer

Create an automation rule that sets the incident owner to the cloud security team.. Automation rules in Microsoft Sentinel allow you to automatically assign incident owners based on conditions such as alert severity or source connector. By creating an automation rule that sets the incident owner to the cloud security team, you ensure that every Defender for Cloud alert synchronized to Sentinel is immediately assigned to the appropriate team without manual intervention.

Answer

Manually export alerts from Defender for Cloud to Sentinel daily.

Answer

Create a playbook that periodically pulls alerts from Defender for Cloud.

Question 15

You are a security analyst at a company that uses Microsoft Sentinel. You need to create a custom analytics rule that detects failed logon attempts from multiple IP addresses within 5 minutes. Which two KQL operators should you use?

Accepted Answer

bin. The `bin` operator is correct because it groups timestamps into fixed-size time buckets (e.g., 5-minute intervals), which is essential for detecting patterns like failed logon attempts from multiple IPs within a specific time window. The `summarize` operator is correct because it aggregates data (e.g., counting distinct IP addresses) per each time bucket, enabling the rule to identify when the count exceeds a threshold.

Answer

where

Answer

project

Answer

join