SC-200 Manage a security operations environment Practice Test 25 — 15 Questions

Question 1

Which TWO actions are valid for automation rules in Microsoft Sentinel? (Choose two.)

Accepted Answer

Change the severity of an incident.. Automation rules in Microsoft Sentinel allow you to automate incident management tasks without requiring a playbook. Changing the severity of an incident is a supported action, enabling you to adjust the priority based on custom criteria such as incident properties or enrichment data.

Answer

Delete an incident.

Answer

Add tags to an incident.

Answer

Modify an existing analytics rule.

Question 2

Which THREE components are part of Microsoft Sentinel's SOAR capabilities? (Choose three.)

Accepted Answer

Incident management. Incident management is a core SOAR component in Microsoft Sentinel because it provides the structured workflow for security analysts to triage, investigate, and respond to security incidents. It integrates with automation rules and playbooks to orchestrate response actions, enabling consistent and efficient handling of threats.

Answer

Workbooks

Answer

Watchlists

Question 3

Which TWO roles can be used to manage Microsoft Sentinel? (Choose two.)

Accepted Answer

Microsoft Sentinel Responder. Microsoft Sentinel Contributor (Option E) is a built-in Azure RBAC role that grants full permissions to create and manage Sentinel resources, including data connectors, analytics rules, and workbooks. Microsoft Sentinel Responder (Option B) is a dedicated role that allows users to manage incidents, perform investigations, and respond to threats without having full write access to the Sentinel workspace. Both roles are specifically designed for managing Microsoft Sentinel operations.

Answer

Compliance Administrator

Answer

Security Reader

Answer

Global Administrator

Question 4

Your organization uses Microsoft Sentinel. You need to provide a SOC analyst with the ability to create and modify incident comments but not delete incidents. Which role should you assign?

Accepted Answer

Microsoft Sentinel Responder. The Microsoft Sentinel Responder role is designed for SOC analysts who need to manage incidents, including adding and modifying comments, but not delete incidents. Microsoft Sentinel Contributor can delete incidents, so it is too permissive. Microsoft Sentinel Reader is read-only and cannot create or modify comments. Global Administrator has full access to all resources, including the ability to delete incidents, which is excessive for this requirement.

Answer

Global Administrator

Answer

Microsoft Sentinel Contributor

Answer

Microsoft Sentinel Reader

Question 5

Your organization uses Microsoft Defender XDR. You need to ensure that when a user reports a phishing email in Outlook, it automatically triggers an investigation in Microsoft Defender XDR. What should you configure?

Accepted Answer

Enable user-reported message settings in Microsoft Defender for Office 365 and configure automated investigation.. Enabling user-reported message settings in Microsoft Defender for Office 365 allows users to report phishing emails directly from Outlook. When combined with automated investigation and response (AIR) policies, this triggers an automatic investigation in Microsoft Defender XDR, leveraging the unified incident and alerting pipeline to analyze the reported message and associated threats.

Answer

Create a playbook in Microsoft Sentinel triggered by a custom connector.

Answer

Configure a data loss prevention policy in Microsoft Purview.

Answer

Set up a session policy in Microsoft Defender for Cloud Apps.

Question 6

You are managing Microsoft Defender XDR. The security team reports that some automated investigations are closing prematurely without sufficient evidence. You need to ensure that investigations only close when a minimum confidence level is reached. What should you modify?

Accepted Answer

Adjust the automation level in the Microsoft 365 Defender security settings.. The automation level in Microsoft 365 Defender security settings controls how automated investigations behave, including the confidence level required for actions to be taken or for investigations to close. By adjusting the automation level (e.g., from 'Full – remediate threats automatically' to a higher threshold like 'Semi – require approval for any remediation'), you can ensure that investigations do not close prematurely without sufficient evidence. This setting directly addresses the requirement to enforce a minimum confidence level before closure.

Answer

Change the action center settings to require manual approval.

Answer

Modify the tenant-level advanced features in Microsoft Defender XDR.

Answer

Create a custom detection rule to override default behavior.

Question 7

Your organization uses Microsoft Sentinel. You need to ensure that an incident is automatically assigned to a specific analyst when it is created. What should you create?

Accepted Answer

An automation rule with an 'Assign incident' action.. An automation rule in Microsoft Sentinel can be configured to run when an incident is created and includes an 'Assign incident' action that automatically assigns the incident to a specific analyst or group. This is the native, no-code method for incident assignment without requiring external logic or playbooks.

Answer

An analytics rule with an output to a specific user.

Answer

A playbook triggered by incident creation.

Answer

A watchlist that maps incident types to owners.

Question 8

You have a Microsoft Sentinel automation rule that triggers a playbook. The playbook definition is shown in the exhibit. The playbook runs but no email is sent. What is the most likely cause?

Accepted Answer

The playbook uses a recurrence trigger instead of a Microsoft Sentinel trigger.. The playbook uses a recurrence trigger, which means it runs on a schedule (e.g., every hour) rather than being invoked by a Microsoft Sentinel incident or alert. A Microsoft Sentinel automation rule can only trigger a playbook that has a Microsoft Sentinel trigger (e.g., 'When a response to a Microsoft Sentinel incident is triggered'). Without the correct trigger, the playbook will execute on its schedule but will not receive the incident context or be invoked by the automation rule, so no email is sent.

Answer

The JSON syntax is invalid.

Answer

The email operation 'SendEmailV2' is deprecated.

Answer

The connection name 'office365' is incorrect.

Question 9

Your organization uses Microsoft Sentinel and Microsoft Defender for Cloud. You need to ensure that security alerts from Defender for Cloud are automatically ingested into Sentinel. What should you configure?

Accepted Answer

Add the 'Microsoft Defender for Cloud' data connector in Microsoft Sentinel.. The 'Microsoft Defender for Cloud' data connector in Microsoft Sentinel is specifically designed to ingest security alerts from Defender for Cloud into Sentinel. When you enable this connector, it automatically synchronizes alerts from all connected Defender for Cloud subscriptions, allowing you to investigate and respond to those alerts within Sentinel's unified security operations environment.

Answer

Enable diagnostic settings on the Defender for Cloud subscription.

Answer

Configure the 'Azure Activity' data connector.

Answer

Create an automation rule in Sentinel to fetch alerts from Defender for Cloud.

Question 10

Your organization uses Microsoft Defender for Endpoint. You need to ensure that when a malware alert is generated, an automated investigation is triggered. What should you configure?

Accepted Answer

Enable automated investigation and remediation in the Microsoft 365 Defender portal.. Enabling automated investigation and remediation in the Microsoft 365 Defender portal is the specific configuration that triggers an automated investigation when a malware alert is generated by Microsoft Defender for Endpoint. This feature allows the security operations team to define the automation level (e.g., full, semi, or no automation) for alerts, ensuring that when a malware alert fires, the system automatically initiates an investigation to contain and remediate the threat without manual intervention.

Answer

Configure the Action center settings.

Answer

Create custom indicators of compromise (IOCs).

Answer

Use threat analytics to trigger investigations.

Question 11

Your organization uses Microsoft Sentinel with Azure Policy. You need to ensure that new Log Analytics workspaces are automatically connected to Sentinel and configured with a standard set of data connectors. What should you use?

Accepted Answer

Create Azure Policy definitions that deploy Sentinel and data connectors.. Azure Policy can be used to automatically deploy and configure Microsoft Sentinel and its data connectors on new Log Analytics workspaces. By creating policy definitions with 'DeployIfNotExists' or 'Modify' effects, you ensure that any new workspace is automatically onboarded to Sentinel and has the required data connectors installed, meeting the requirement for automated, consistent configuration at scale.

Answer

Deploy an ARM template to each new workspace manually.

Answer

Use Sentinel automation rules to configure new workspaces.

Answer

Develop a Logic App that runs on a schedule to check for new workspaces.

Question 12

You have a Microsoft Sentinel automation rule as shown in the exhibit. The rule triggers a playbook that blocks a user in Microsoft Entra ID. The rule is enabled but never fires. What is the most likely reason?

Accepted Answer

The playbook does not have a Microsoft Sentinel trigger.. The automation rule is configured to trigger a playbook, but for a playbook to be invoked by a Microsoft Sentinel automation rule, it must have a Microsoft Sentinel trigger (e.g., 'When a response to a Microsoft Sentinel incident is triggered'). Without this trigger, the playbook cannot receive the incident context from Sentinel, so the rule will never fire even if all other conditions are met.

Answer

The automation rule is disabled.

Answer

No incidents with High severity are created.

Answer

The JSON syntax is invalid.

Question 13

Your organization uses Microsoft Defender for Office 365. You need to ensure that suspicious email messages are automatically moved to quarantine and an incident is raised in Microsoft Sentinel. What should you configure?

Accepted Answer

Configure the Microsoft Defender for Office 365 data connector in Sentinel.. The Microsoft Defender for Office 365 data connector in Microsoft Sentinel ingests email-related alerts and events (e.g., phishing, malware, spam) from Defender for Office 365. When you configure automated investigation and response (AIR) policies in Defender for Office 365 to move suspicious emails to quarantine, and enable the connector in Sentinel, those quarantine actions trigger corresponding incidents in Sentinel. This integration ensures that email threats are both remediated (quarantined) and tracked as security incidents for further analysis.

Answer

Configure the Microsoft Defender for Cloud data connector in Sentinel.

Answer

Use the Microsoft Defender for Identity data connector.

Answer

Enable the Microsoft Defender for Endpoint data connector.

Question 14

Your organization uses Microsoft Sentinel. You need to ensure that incident response times are monitored and reported. Which TWO capabilities should you use?

Accepted Answer

Automation rules. Automation rules (C) are correct because they allow you to define conditions and actions that automatically trigger when an incident is created or updated, enabling consistent assignment, severity changes, and tagging. Workbooks (E) are correct because they provide customizable visualizations and reports that can track key metrics like incident response times, mean time to acknowledge (MTTA), and mean time to remediate (MTTR) using KQL queries against Sentinel's security data.

Answer

Playbooks

Answer

UEBA

Answer

Watchlists

Question 15

Your organization uses Microsoft Defender XDR. You need to delegate incident management tasks to a team of analysts without granting full global admin permissions. Which THREE roles in Microsoft 365 Defender should you assign?

Accepted Answer

Security Administrator. Security Administrator is correct because this role in Microsoft 365 Defender provides full access to incident management features, including the ability to investigate, respond to, and resolve incidents, while not granting full global admin permissions. It allows analysts to manage alerts, perform advanced hunting, and configure security settings within the Defender portal, making it suitable for delegated incident management tasks.

Answer

Security Analyst

Answer

Compliance Administrator