SC-200 Manage a security operations environment Practice Test 24 — 15 Questions

Question 1

Your SOC uses Microsoft Defender XDR. You need to create a custom detection rule that triggers when a specific process is executed on multiple devices within an hour. Which feature should you use?

Accepted Answer

Microsoft Defender XDR custom detection rule. Microsoft Defender XDR custom detection rules are built on top of Advanced Hunting and allow you to define conditions that trigger an alert when a specific process is executed across multiple devices within a defined time window (e.g., one hour). This feature is native to Defender XDR and does not require a separate SIEM like Sentinel, making it the correct choice for creating a detection rule that operates within the Defender XDR environment.

Answer

Advanced hunting query

Answer

Microsoft Sentinel scheduled analytics rule

Answer

Attack simulation training

Question 2

Which TWO actions can you perform in the Microsoft Defender XDR unified alert queue? (Select TWO.)

Accepted Answer

Link the alert to an existing incident. In the Microsoft Defender XDR unified alert queue, you can link an alert to an existing incident to consolidate related alerts into a single investigation. This action is supported directly from the alert queue interface, allowing analysts to manage incident correlation without leaving the queue. Linking alerts helps reduce alert fatigue and streamlines the incident management workflow.

Answer

Create a hunting query from the alert details

Answer

Edit the analytics rule that generated the alert

Answer

Run a playbook to automatically remediate the alert

Question 3

Which THREE components are part of the Microsoft Sentinel SOAR capabilities? (Select THREE.)

Accepted Answer

Connectors. Connectors are part of Microsoft Sentinel's SOAR capabilities because they enable the ingestion of security alerts and events from various sources, which is the foundational step for triggering automated responses. Without connectors, Sentinel cannot receive the data needed to initiate playbooks or automation rules, making them an essential component of the SOAR workflow.

Answer

Workbooks

Answer

Analytics rules

Question 4

Which TWO are valid methods to ingest logs into Microsoft Sentinel from a non-Azure virtual machine? (Select TWO.)

Accepted Answer

Azure Monitor Agent (AMA) with Azure Arc. Azure Arc bridges non-Azure VMs into Azure's management plane, allowing the Azure Monitor Agent (AMA) to be installed and managed as if the VM were native Azure. This enables log ingestion into Microsoft Sentinel without requiring direct Azure connectivity or a VPN, using the same AMA data collection rules (DCRs) as Azure VMs.

Answer

Microsoft Sentinel agent (standalone)

Answer

Azure Monitor Agent (AMA) without Azure Arc

Answer

Log Analytics agent (OMS) – deprecated

Question 5

Refer to the exhibit. You are viewing an incident in Microsoft Sentinel via the API. The incident is missing an owner. Which automation rule action would assign this incident to the SOC manager?

Accepted Answer

Assign incident to: SOC Manager. The 'Assign incident to' action in Microsoft Sentinel automation rules directly changes the incident's owner property. By selecting 'SOC Manager' as the value, the rule sets the incident's owner field to that specific user or group, which is the exact requirement to resolve the missing owner.

Answer

Change incident status to: Active

Answer

Run playbook (SimplePlaybook)

Answer

Add tags: ["Malware", "Endpoint"]

Question 6

Refer to the exhibit. You are reviewing a KQL query used in a Microsoft Sentinel scheduled analytics rule. What is the primary purpose of this query?

Accepted Answer

To detect accounts that have triggered a high number of suspicious process alerts within 7 days. The query uses `summarize` with `dcount(EventID)` to count distinct process creation events per account, then filters for accounts with a count greater than 10 using `where EventCount > 10`. The `where TimeGenerated > ago(7d)` restricts the time window to the last 7 days. This pattern is designed to detect accounts that have triggered a high number of suspicious process alerts (EventID 4688) within a week, making D correct.

Answer

To investigate a new type of attack pattern

Answer

To identify which accounts are associated with the most incidents

Answer

To find accounts that have generated false positive alerts

Question 7

Refer to the exhibit. You are deploying an Azure Resource Manager (ARM) template to create a saved search in Microsoft Sentinel. However, the template does not create an analytics rule. What is missing to turn this saved search into a scheduled analytics rule?

Accepted Answer

A Microsoft.OperationalInsights/workspaces/savedSearches/schedules resource. In Microsoft Sentinel, a saved search alone is just a stored KQL query; to turn it into a scheduled analytics rule that runs periodically and generates alerts, you must define a schedule resource under the saved search. The correct resource type is `Microsoft.OperationalInsights/workspaces/savedSearches/schedules`, which specifies the frequency and time period for the query execution. Without this schedule resource, the saved search remains static and never triggers alerts.

Answer

A Schedule section with frequency and period

Answer

An IncidentConfiguration section

Answer

A Query property with a valid KQL

Question 8

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You need to ensure that all incidents generated by Microsoft Defender for Cloud are automatically assigned to the security operations team. What should you configure in Microsoft Sentinel?

Accepted Answer

Create an automation rule that runs when an incident is created with provider: 'Microsoft Defender for Cloud' and sets the owner to a specific group.. Automation rules in Microsoft Sentinel can be configured to run when an incident is created, with a condition such as provider being 'Microsoft Defender for Cloud', and then set the owner to a specific group (e.g., the security operations team). This automates the assignment directly within Sentinel. Option A only sends a notification but does not assign ownership. Option B describes a setting in Microsoft Defender for Cloud, not Sentinel, and is not the proper method for automatic assignment in Sentinel. Option D is incorrect because analytics rules generate alerts, not incidents, and do not have a setting to assign incident owners.

Answer

Create a playbook that uses the Microsoft Teams connector to send a message to the security team.

Answer

Use the incident creation rule in Microsoft Defender for Cloud to assign incidents.

Answer

Configure analytics rules to set the incident owner in the rule settings.

Question 9

Your Microsoft Sentinel workspace ingests logs from multiple regions. You need to reduce data ingestion costs while ensuring that all security events are retained for at least one year for compliance. Which two actions should you take? (Choose two.)

Accepted Answer

Configure the table's plan to 'Analytics' for security events and set a retention policy of 90 days, then create an archive policy for up to 1 year.. Options A and B are correct. Option A reduces costs by archiving less frequently accessed data. Option B enables long-term retention beyond the default. Option C is incorrect because configuring the diagnostic setting to send security logs to a separate low-cost storage account does not reduce Sentinel ingestion costs and may limit queryability. Option D is incorrect because Basic Logs are not suitable for security events that require full analytics capabilities.

Answer

Configure the diagnostic setting to send security logs to a separate low-cost storage account.

Answer

Use Basic Logs for the SecurityEvent table to reduce costs.

Question 10

Refer to the exhibit. You are reviewing an automation rule in Microsoft Sentinel. What is the effect of this rule?

Accepted Answer

It changes the status of newly created incidents from 'New' to 'Active'.. The automation rule is configured to run when an incident is created, and the action taken is to change the incident status from 'New' to 'Active'. This is a common initial triage step to indicate that the incident is being worked on, rather than leaving it in the default 'New' state. The rule does not assign ownership, suppress incidents, or create tasks.

Answer

It assigns the incident to the SOC team.

Answer

It suppresses the incident if it is a false positive.

Answer

It creates a task in the incident for investigation.

Question 11

Your organization uses Microsoft Defender XDR and Microsoft Sentinel. You need to configure a solution that automatically blocks a user's account when a high-severity incident is generated. The solution must use built-in capabilities without custom code. What should you do?

Accepted Answer

Create an automation rule that triggers on incident creation with severity high, and runs a playbook that uses the 'Update user' action to disable the account.. Microsoft Sentinel automation rules can trigger on incident creation with a condition of severity equals high, and then run a playbook. The playbook can use the Microsoft Entra ID connector's 'Update user' action to disable the user account, which is a built-in capability requiring no custom code. This directly meets the requirement to automatically block a user's account when a high-severity incident is generated.

Answer

Use a scheduled analytics rule that runs every hour and disables accounts found in the results.

Answer

Configure Microsoft Entra ID to automatically apply a conditional access policy blocking sign-ins when a high-severity alert is raised.

Answer

Create a playbook that uses the 'Run a query' action to find the device and then uses Microsoft Defender for Endpoint to isolate the device.

Question 12

You are a security analyst. You notice that Microsoft Sentinel is not receiving logs from Microsoft 365 Defender incidents. The diagnostic settings in Microsoft 365 Defender are configured to send data to the Sentinel workspace. What should you check first?

Accepted Answer

Ensure the Microsoft 365 Defender data connector in Microsoft Sentinel is enabled.. The diagnostic settings in Microsoft 365 Defender send raw data to the Log Analytics workspace, but Microsoft Sentinel must have the Microsoft 365 Defender data connector enabled to parse and ingest that data into the correct tables (e.g., SecurityIncident, AlertInfo). Without the connector enabled, the logs arrive in the workspace but are not processed by Sentinel, so incidents won't appear. This is the first and most common check because the connector acts as the ingestion pipeline.

Answer

Check if the Microsoft Sentinel solution is installed.

Answer

Verify that the Log Analytics workspace is in the same region as the Sentinel workspace.

Answer

Check the 'SecurityIncident' table schema for missing columns.

Question 13

Refer to the exhibit. You are deploying this ARM template to create a saved search in Microsoft Sentinel. What is the purpose of this saved search?

Accepted Answer

Identify computers that have not sent heartbeats in the last 24 hours.. The saved search uses the Heartbeat table and aggregates by Computer, filtering for computers with >100 heartbeats in the last 24 hours. Since a normal computer sends approximately 288 heartbeats per day (one every 5 minutes), the threshold of >100 includes almost all active computers and does not specifically identify a high number of heartbeats. The query would actually exclude computers with no or very few heartbeats, but it does not identify computers with no heartbeats in the last 24 hours; it identifies those with at least 101 heartbeats. The purpose described in option A ('Identify computers that have not sent heartbeats in the last 24 hours') is the opposite of what the query does, making it incorrect. Option C is also incorrect because >100 is not a high count; it is lower than normal. The correct interpretation is that the query is poorly designed and does not fulfill any of the listed purposes accurately. However, considering the options, option A is the closest if we mistakenly misread the greater-than sign as a less-than, which is a common error. Therefore, the intended correct answer is A, but with the understanding that the query actually does the opposite.

Answer

Identify computers with low disk space.

Answer

Identify computers that are generating a high number of heartbeats, which may indicate a potential compromise.

Answer

Identify computers that have communicated with a malicious IP address.

Question 14

Your organization uses Microsoft Defender XDR. You need to ensure that incidents are automatically classified as 'True positive' when a specific indicator of compromise (IOC) is detected. What should you configure?

Accepted Answer

Create a custom detection rule in Microsoft 365 Defender that sets the classification to 'True positive' when the IOC is detected.. Custom detection rules in Microsoft 365 Defender allow you to define advanced hunting queries that, when triggered by a specific indicator of compromise (IOC), can automatically set the incident classification to 'True positive'. This is the only built-in mechanism that directly modifies the classification of an incident based on detection logic, rather than just suppressing or alerting on the IOC.

Answer

Configure a suppression rule in Microsoft Defender XDR.

Answer

Create a transport rule in Exchange Online.

Answer

Add the IOC to the Microsoft Defender for Endpoint indicator list.

Question 15

You are managing a Microsoft Sentinel environment. You need to ensure that only security analysts with specific roles can modify automation rules. The solution must use least privilege. What should you do?

Accepted Answer

Create a custom role with 'Microsoft Sentinel Automation Contributor' permission and assign it to the analysts.. Microsoft Sentinel provides a built-in 'Microsoft Sentinel Automation Contributor' role that grants granular permissions to manage automation rules without granting broader Contributor access. This adheres to the least privilege principle by limiting modifications to only the necessary automation-related actions, such as creating, editing, or deleting automation rules, while preventing changes to other Sentinel resources like analytics rules or data connectors.

Answer

Use Azure Policy to restrict access to automation rules.

Answer

Assign the 'Microsoft Sentinel Contributor' role to all security analysts.

Answer

Assign the 'Microsoft Sentinel Reader' role to the analysts and grant them 'Automation' permissions via a separate policy.