SC-200 Manage a security operations environment Practice Test 24 — 15 Questions

Question 1

Your organization uses Microsoft Sentinel with UEBA enabled. You need to investigate a potential insider threat where a user is accessing sensitive data outside of business hours. Which three built-in UEBA entities should you review?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

User account. User account (B) is correct because UEBA in Microsoft Sentinel profiles user behavior to detect anomalies such as accessing sensitive data outside business hours. The user account entity is the primary identity used to correlate activities, logon events, and data access patterns, enabling the detection of insider threats based on deviations from established baselines.

Answer

Azure subscription

Answer

Resource group

Question 2

You are the security operations lead for a multinational company that uses Microsoft Sentinel in a single workspace. You have recently onboarded 10 new business units, each with their own analytics rules and automation. The security team is overwhelmed by the number of low-fidelity incidents generated. You need to reduce noise without disabling critical detections. You must ensure that each business unit retains ownership of their incidents and can customize their own suppression rules. You also need centralized reporting on incident trends across all business units. You have identified that many low-fidelity alerts come from a common set of data sources. What should you do?

Accepted Answer

Create a separate analytics rule for low-fidelity alerts that uses alert suppression to group similar alerts.. Creating a separate analytics rule for low-fidelity alerts with alert suppression enabled allows you to group similar alerts into a single incident, reducing noise without disabling the underlying data connectors or critical detections. This approach preserves each business unit's ownership of their incidents and enables them to customize suppression rules via automation rules or analytics rule settings, while centralized reporting on incident trends remains intact because the workspace still ingests all alerts.

Answer

Disable the data connectors that produce the most noise.

Answer

Create an automation rule that automatically closes low-severity incidents.

Answer

Create a workbook that filters out low-severity incidents from the dashboard.

Question 3

You are a security analyst for a company that uses Microsoft Defender XDR. You receive a high-severity incident indicating that a user's device has been compromised with a remote access trojan (RAT). The incident is automatically generated by Microsoft Defender XDR. You need to contain the threat immediately while preserving forensic data. You also need to ensure that the user can continue working with minimal disruption. What should you do?

Accepted Answer

Initiate device isolation from Microsoft Defender XDR.. Initiating device isolation from Microsoft Defender XDR immediately disconnects the device from the network while preserving forensic data on the device. This contains the RAT's command-and-control communication without disrupting the user's ability to work offline, and it allows the security team to investigate the compromised device without risk of lateral movement or data exfiltration.

Answer

Restore the device from a recent backup.

Answer

Run a full antivirus scan on the device.

Answer

Reset the user's password and force a sign-out.

Question 4

You are a security operations architect for a company that uses Microsoft Sentinel in a hybrid environment with multiple workspaces. The company has a central SOC team that needs to view incidents from all workspaces in a single pane of glass. Each workspace belongs to a different business unit and has its own retention and access policies. You need to design a solution that provides centralized incident management without duplicating data or requiring users to switch workspaces. You also need to ensure that the SOC team can perform actions on incidents across workspaces. What should you do?

Accepted Answer

Use Microsoft Sentinel incident multi-view to connect all workspaces.. Microsoft Sentinel incident multi-view allows SOC teams to view and manage incidents across multiple workspaces from a single interface without duplicating data. This feature provides a centralized pane of glass while respecting each workspace's independent retention and access policies, and it enables cross-workspace incident actions without requiring users to switch contexts.

Answer

Create a playbook that copies incidents from all workspaces to a central workspace.

Answer

Use the Microsoft Sentinel data connector to connect all workspaces to a central workspace.

Answer

Create a new Log Analytics workspace that ingests data from all workspaces via diagnostic settings.

Question 5

You are a security analyst for a company that uses Microsoft Defender for Office 365. You receive an incident indicating that a user reported a phishing email. You need to investigate the email and determine if it was delivered to other users. You also need to ensure that similar emails are blocked in the future. What should you do?

Accepted Answer

Use Threat Explorer to search for similar emails and delete them.. Threat Explorer in Microsoft Defender for Office 365 allows you to search for and take bulk action on emails matching specific criteria, such as sender, subject, or URL. By using Threat Explorer, you can identify all instances of the reported phishing email across your tenant and delete them from user mailboxes, which directly addresses the need to determine if the email was delivered to other users and to remediate it. This tool is designed for hunting and remediation, making it the correct choice for this investigation.

Answer

Submit the email to Microsoft for analysis and quarantine it.

Answer

Create a Safe Links policy to block URLs in the email.

Answer

Run a simulated phishing attack to test user awareness.

Question 6

You are a security operations analyst for a company that uses Microsoft Sentinel. You need to create a workbook that displays the top 10 most common alert types over the last 7 days. The workbook will be used by the SOC manager to identify trends. You have already created a new workbook and added a query step. Which KQL query should you use in the query step?

Accepted Answer

AlertInfo | where TimeGenerated > ago(7d) | summarize Count = count() by AlertName | top 10 by Count desc | render barchart. It uses the `summarize` operator to count alerts by `AlertName`, then `top 10 by Count desc` to return the ten most frequent alert types, and `render barchart` to visualize the data in the workbook. This directly meets the requirement to display the top 10 most common alert types over the last 7 days.

Answer

AlertInfo | where TimeGenerated > ago(7d) | project AlertName

Answer

AlertInfo | where TimeGenerated > ago(7d) | project AlertName, count()

Answer

AlertInfo | where TimeGenerated > ago(7d) | summarize count() by bin(TimeGenerated, 1d) | render timechart

Question 7

You are a security operations engineer for a company that uses Microsoft Defender XDR. You need to create a custom detection rule that alerts when a user performs more than 10 failed logon attempts within 5 minutes from different IP addresses. The rule should use the IdentityLogonEvents table. You have written the KQL query and now need to configure the rule settings in Microsoft 365 Defender. Which configuration should you use for the rule frequency and lookback period to minimize false positives while ensuring timely detection?

Accepted Answer

Run every 5 minutes with a 5-minute lookback.. To detect more than 10 failed logons within 5 minutes, the rule should run every 5 minutes with a 5-minute lookback so it evaluates the most recent 5-minute window each time. This minimizes false positives by focusing on the exact time window and ensures timely detection.

Answer

Run every 5 minutes with a 1-hour lookback.

Answer

Run every 1 hour with no lookback.

Answer

Run every 24 hours with a 24-hour lookback.

Question 8

Your organization uses Microsoft Sentinel with UEBA enabled. You need to investigate a potential insider threat where a user is accessing sensitive data outside of business hours. Which three built-in UEBA entities should you review?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the Microsoft Defender for Cloud data connector in Sentinel to stream alerts.. The Microsoft Defender for Cloud data connector in Microsoft Sentinel provides a native, direct integration that streams security alerts from Defender for Cloud into Sentinel with near-real-time latency. This connector uses the underlying Azure Resource Graph and alert APIs to push alerts automatically, eliminating the need for custom polling or additional orchestration, which ensures the least possible ingestion delay.

Answer

Configure a custom API connector in Sentinel to pull alerts from Defender for Cloud REST API every 5 minutes.

Answer

Enable continuous export in Defender for Cloud to send alerts to a Log Analytics workspace and then create a scheduled query in Sentinel.

Answer

Create a Logic App that triggers on Defender for Cloud alerts and sends them to Sentinel via the Azure Monitor HTTP Data Collector API.

Question 9

Your team uses Microsoft Defender XDR to manage incidents. You need to ensure that all incidents with a severity of 'High' are automatically assigned to a specific SOC analyst group. What should you configure?

Accepted Answer

Create an automation rule in Microsoft Defender XDR to automatically assign incidents.. Microsoft Defender XDR's automation rules allow you to define conditions (e.g., severity equals 'High') and actions (e.g., assign to a specific SOC analyst group) that are executed automatically when incidents are created or updated. This is the native, built-in mechanism for incident assignment without requiring external scripts, playbooks, or email-based workflows.

Answer

Set up an advanced hunting query to detect high severity incidents and send email.

Answer

Configure a playbook in Microsoft Sentinel triggered by incidents.

Answer

Use the 'New-MTPIncidentAssignment' cmdlet in a scheduled task.

Question 10

Your organization uses Microsoft Sentinel with UEBA enabled. You need to investigate a potential insider threat where a user is accessing sensitive data outside of business hours. Which three built-in UEBA entities should you review?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Check the Windows Event Log collection configuration in the Log Analytics workspace data collection rules.. Since the Log Analytics agent is installed and some events are collected, connectivity and agent health are already proven. The most likely cause of selective event gaps is the data collection configuration — specifically the Windows Event Logs settings in the workspace's data collection rules (or legacy agent configuration) that define which event logs and severity levels are forwarded.

Answer

Confirm that the workspace key is correctly deployed on the servers.

Answer

Verify that the Log Analytics agent is running and has network connectivity to Azure.

Answer

Ensure that the servers are listed in the Azure Arc management pane.

Question 11

Your organization uses Microsoft Defender for Office 365. You need to create a custom alert that triggers when users receive external emails with attachments from untrusted domains. What should you configure?

Accepted Answer

Create an alert policy in Microsoft 365 Defender.. A custom alert policy in Microsoft 365 Defender can be configured to detect when users receive external emails with attachments from untrusted domains. This leverages the built-in threat detection capabilities of Defender for Office 365, allowing you to define conditions such as sender domain reputation and attachment presence, and trigger an alert when the criteria are met.

Answer

Create a mail flow rule in Exchange admin center.

Answer

Set up a conditional access policy in Microsoft Entra ID.

Answer

Configure a data sensitivity label in Microsoft Purview.

Question 12

Refer to the exhibit. You are configuring an automation rule in Microsoft Sentinel. The rule is enabled but never runs. The playbook exists and is in the same resource group. What is the most likely cause?

Accepted Answer

The trigger type is incorrect; it should be 'Microsoft.SecurityInsights/Alert'.. The exhibit shows the trigger type set to 'Microsoft.SecurityInsights/Incident', but the playbook is designed to run on alerts, not incidents. Automation rules in Microsoft Sentinel require the trigger type to match the data type the playbook expects; for alert-triggered playbooks, the trigger must be 'Microsoft.SecurityInsights/Alert'. Since the rule is enabled and the playbook exists in the same resource group, the mismatch in trigger type is the most likely reason the rule never runs.

Answer

The condition uses 'Contains' operator, but 'AlertProvider' requires 'Equals'.

Answer

The automation rule is in a 'Disabled' state.

Answer

The playbookId is missing the subscription ID.

Question 13

Your organization uses Microsoft Defender for Cloud Apps. You need to receive alerts when a user accesses a cloud app from a location that is not whitelisted. What should you configure?

Accepted Answer

Create an activity policy in Microsoft Defender for Cloud Apps.. An activity policy in Microsoft Defender for Cloud Apps monitors user activities and can trigger alerts based on specific conditions, such as access from non-whitelisted locations. This policy type evaluates activities against defined criteria (e.g., IP address ranges) and generates alerts without blocking access, which matches the requirement to receive alerts.

Answer

Create a conditional access policy in Microsoft Entra ID.

Answer

Set up a session policy in Microsoft Defender for Cloud Apps.

Answer

Configure an access policy in Microsoft Defender for Cloud Apps.

Question 14

Your SOC team uses Microsoft Sentinel incident management. You need to ensure that when an incident is created, it automatically runs a playbook to gather additional context from threat intelligence sources. What should you create?

Accepted Answer

Automation rule with a trigger on incident creation.. Microsoft Sentinel automation rules can be configured with a trigger on incident creation to automatically run a playbook. This allows the SOC team to gather additional context from threat intelligence sources without manual intervention, directly addressing the requirement to execute a playbook when an incident is created.

Answer

Workbook that queries threat intelligence.

Answer

Watchlist that maps to the incident.

Answer

Analytics rule that generates an alert.

Question 15

Your organization uses Microsoft Defender for Identity. You need to receive alerts when suspicious LDAP queries are detected. What should you configure?

Accepted Answer

Configure alert rules in Microsoft Defender for Identity.. Microsoft Defender for Identity (MDI) detects suspicious LDAP queries, such as LDAP reconnaissance or directory traversal attacks, by analyzing domain controller traffic. To receive alerts for these detections, you must configure alert rules directly within the MDI portal, which allows you to set thresholds and notification preferences for specific LDAP-related activities. Option B is correct because MDI's built-in alert rules are the mechanism for generating and delivering these security alerts.

Answer

Set up an anomaly detection policy in Microsoft Defender for Cloud Apps.

Answer

Assign the Security Administrator role in Microsoft Entra ID.

Answer

Create a custom sensitivity label in Microsoft Purview.