SC-200 Manage a security operations environment Practice Test 25 — 15 Questions

Question 1

Your organization uses Microsoft Sentinel with a workspace in the East US region. You need to ingest security logs from Azure resources in the West Europe region. The solution must minimize data transfer costs. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure diagnostic settings on the West Europe resources to send logs to a Log Analytics workspace in West Europe, and then use a cross-workspace query from the East US workspace.. It minimizes data transfer costs by keeping logs within the same Azure region (West Europe) for ingestion into a local Log Analytics workspace, and then using cross-workspace queries from the East US workspace to access the data. This avoids egress charges that would apply if logs were sent directly across regions, as Azure data transfer between regions incurs costs. Diagnostic settings can only send logs to a workspace in the same region as the resource, so sending directly to East US is not possible without additional egress costs.

Answer

Configure diagnostic settings to send logs directly to the East US workspace.

Answer

Use Azure Monitor Agent to collect logs and send them to the East US workspace.

Answer

Export logs to a storage account in West Europe and then import them to the East US workspace using Azure Data Factory.

Question 2

Your organization uses Microsoft Defender XDR and Microsoft Sentinel. You need to ensure that when a user reports a phishing email in Microsoft 365 Defender, the incident in Microsoft Sentinel is automatically updated with the user's comments. Which THREE components are required?

Accepted Answer

The Microsoft 365 Defender data connector in Microsoft Sentinel.. The Microsoft 365 Defender data connector in Microsoft Sentinel is required because it ingests alerts and incidents from Microsoft 365 Defender into Sentinel. Without this connector, the phishing email report from Microsoft 365 Defender would not create an incident in Sentinel, making it impossible to automatically update that incident with user comments.

Answer

A logic app in Azure that is triggered by the Microsoft 365 Defender alert.

Answer

The Microsoft Entra ID data connector in Microsoft Sentinel.

Question 3

You are configuring Microsoft Sentinel to use Microsoft Copilot for Security. Which TWO prerequisites must be met?

Accepted Answer

Ensure that the Microsoft Defender XDR tenant is integrated with Copilot for Security.. Microsoft Copilot for Security must be integrated with the Microsoft Defender XDR tenant to access and correlate security data across the Microsoft security ecosystem. This integration enables Copilot to leverage signals from Defender XDR, Microsoft Sentinel, and other sources for incident response and investigation. Without this tenant-level integration, Copilot cannot authenticate or retrieve the necessary security context from Defender XDR.

Answer

Enable Copilot for Security in the Microsoft Sentinel workspace settings.

Answer

Deploy Copilot for Security in the same Azure region as the Sentinel workspace.

Answer

Purchase a Microsoft Sentinel premium license.

Question 4

Refer to the exhibit. You run this PowerShell script. What is the effect on the SecurityEvent table in the SOC-Workspace Log Analytics workspace?

Accepted Answer

The table will retain data for 730 days interactively.. The script sets both `RetentionInDays` and `TotalRetentionInDays` to 730 using the `Update-AzOperationalInsightsTable` cmdlet. In Log Analytics, when these two values are equal, all data is kept in interactive retention for the entire duration. Therefore, the SecurityEvent table retains data interactively for 730 days with no archive period. Option D is correct.

Answer

The table will retain data interactively for 365 days, and data will be archived for an additional 365 days, total 730 days.

Answer

The table will retain data interactively for 90 days and archived for 275 days.

Answer

The table will be converted to Basic Logs.

Question 5

A junior security analyst reports that they cannot create a new analytics rule in Microsoft Sentinel. They have the 'Microsoft Sentinel Contributor' role on the workspace. What could be the issue?

Accepted Answer

The workspace is in a locked resource group preventing modifications.. A resource group lock (e.g., ReadOnly or Delete) prevents any modifications to resources within the group, including the Sentinel workspace. The Microsoft Sentinel Contributor role allows creating analytics rules, so option B is incorrect. Option C is incorrect because the Responder role is for incident response, not rule creation. Option D is incorrect because the Contributor role assigned at the subscription level would be inherited by the workspace, so it should still work unless a lock exists.

Answer

They need the 'Owner' role to create analytics rules.

Answer

They do not have the 'Microsoft Sentinel Responder' role.

Answer

They are assigned the role at the subscription level but not at the workspace level.

Question 6

You are a SOC analyst investigating a high-severity incident. The incident involves a user who received a phishing email and clicked a link. Microsoft Defender for Office 365 detected the email as phishing and blocked the URL at time of click, but a follow-up investigation reveals that the user's mailbox has suspicious forwarding rules. You need to ensure that similar incidents are automatically remediated in the future. What should you configure in Microsoft Sentinel?

Accepted Answer

Create an automation rule that triggers a playbook to remove the forwarding rule when an incident with the 'Phishing' tactic is created.. Microsoft Sentinel automation rules can trigger a playbook (an Azure Logic Apps workflow) when an incident is created with a specific tactic, such as 'Phishing'. This allows automatic remediation of suspicious forwarding rules without manual intervention, ensuring similar incidents are handled consistently.

Answer

Configure entity behavior analytics to automatically block the user.

Answer

Create an analytics rule that detects suspicious forwarding rules and automatically removes them.

Answer

Add the user to a watchlist that triggers an automated investigation.

Question 7

Your organization uses Microsoft Sentinel with a workspace in the East US region. You need to ingest security logs from Azure resources in the West Europe region. The solution must minimize data transfer costs. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Adjust the analytics rule settings to only create incidents for alerts with a severity of Medium or higher.. To reduce noise from low-severity incidents in Microsoft Sentinel, you should adjust analytics rule settings to create incidents only for alerts with severity Medium or higher (option B). This filters out low-severity alerts from becoming incidents, directly reducing the queue. Additionally, you can configure automation rules to automatically close incidents with specific low-severity alert types (option E), which handles false positives efficiently without manual intervention. Option A (increasing data retention) does not affect the incident queue, as it only affects log storage. Option C (playbooks for manual review) would increase workload, not reduce noise. Option D (creating more analytics rules) would likely create more alerts and incidents, worsening the noise problem.

Answer

Increase the data retention period for low-severity alerts.

Answer

Use playbooks to manually review each low-severity incident.

Answer

Create additional analytics rules to better differentiate between true and false positives.

Question 8

The exhibit shows a KQL query used in a Microsoft 365 Defender custom detection rule. The query is intended to detect encoded PowerShell commands executed in the last hour. However, the detection rule is not generating any alerts even though the SOC knows that encoded PowerShell commands are being executed. Which modification would most likely fix the detection rule?

Accepted Answer

Add a condition to also look for `-EncodedCommand` in the command line.. The query uses `contains '-e'` which is too broad and matches many non-encoded commands. Adding a condition to explicitly check for `-EncodedCommand` in the command line narrows the detection to actual encoded PowerShell commands, which is the most likely fix for false negatives. Options A, C, and D either address performance issues or irrelevant filtering that would not specifically fix the detection of encoded commands.

Answer

Change `contains` to `has` for better performance and accuracy.

Answer

Modify the query to use `project-away` instead of `project`.

Answer

Replace `FileName == "powershell.exe"` with `InitiatingProcessFileName == "powershell.exe"`.

Question 9

Your organization is planning to deploy Microsoft Sentinel. You need to ensure that security events from on-premises servers are sent to Sentinel. Which connector should you use?

Accepted Answer

Install the Azure Monitor Agent (AMA) on the servers and configure a Data Collection Rule (DCR) to send events to Sentinel.. The Azure Monitor Agent (AMA) is the current recommended agent for collecting security events from on-premises servers and forwarding them to Microsoft Sentinel. By installing AMA and configuring a Data Collection Rule (DCR), you can specify which security events (e.g., Windows Security Event logs) to collect and send directly to the Sentinel workspace, ensuring efficient and modern data ingestion.

Answer

Install the Log Analytics agent (MMA) on the servers and connect to Sentinel workspace.

Answer

Use the Microsoft Defender for Cloud (MDC) connector to stream security events.

Answer

Enable Azure Arc on the servers and use the Arc agent to forward events.

Question 10

You are a SOC analyst using Microsoft Defender XDR. You notice that a user's account has been compromised and is being used to send phishing emails. You need to prevent the user from sending any more emails while preserving the ability to receive emails for investigation. What should you do?

Accepted Answer

Restrict the user from sending email using Microsoft Defender for Office 365 mailbox restrictions.. Microsoft Defender for Office 365 mailbox restrictions allow you to block a user from sending email while still permitting them to receive messages. This is done via the 'Restrict user from sending email' policy in the Microsoft 365 Defender portal, which applies a transport rule that rejects outbound mail from the user but leaves inbound delivery intact, enabling forensic analysis of incoming phishing responses.

Answer

Remove the user's Microsoft 365 license.

Answer

Disable the user account in Microsoft Entra ID.

Answer

Delete the user's mailbox in Exchange Online.

Question 11

Your organization uses Microsoft Sentinel with a workspace in the East US region. You need to ingest security logs from Azure resources in the West Europe region. The solution must minimize data transfer costs. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create the playbook as a Logic App in the West Europe region and ensure it uses a managed identity for authentication.. Playbooks run in the same region as the Logic Apps resource, which can be created in West Europe. By creating the playbook in West Europe, it will process data there. Option D is correct. Option A is wrong because moving the Sentinel workspace is not possible without redeployment. Option B is wrong because the API connector does not control data location. Option C is wrong because using a different workspace would require changing all data collection.

Answer

Use a different Sentinel workspace in West Europe for the incidents.

Answer

Move the Sentinel workspace to West Europe.

Answer

Configure the ServiceNow connector to use a West Europe endpoint.

Question 12

You are a SOC analyst investigating an incident where a user's credentials were used to access a sensitive SharePoint site from an unusual location. Microsoft Defender for Cloud Apps detected the activity as a suspicious sign-in. You need to create a detection rule that alerts whenever a user accesses SharePoint from a location not in the allowed list. What type of rule should you create in Microsoft Defender for Cloud Apps?

Accepted Answer

Activity policy.. An Activity policy in Microsoft Defender for Cloud Apps allows you to create custom rules that trigger alerts based on specific user activities, such as accessing SharePoint from a location not in the allowed list. This policy type evaluates each activity against defined conditions (e.g., IP address ranges, geolocation) and can generate alerts or take automated actions. It is the correct choice because it directly matches the requirement to detect a specific access pattern (location-based anomaly) rather than broad behavioral patterns.

Answer

App discovery policy.

Answer

Session policy.

Answer

Anomaly detection policy.

Question 13

The exhibit shows a Conditional Access policy configuration in Microsoft Entra ID. The policy is intended to require MFA and compliant device for all users accessing all applications from trusted locations. However, users are reporting that they are being prompted for MFA even when accessing from the office (which is a trusted location). What is the most likely issue?

Accepted Answer

The location condition should include 'All untrusted locations' and exclude 'All trusted locations'.. The policy is configured to require MFA and compliant device for 'All users' accessing 'All applications' from 'Trusted locations'. However, users are being prompted for MFA from the office, which is a trusted location. The most likely issue is that the location condition is inverted: the policy should target 'All untrusted locations' (i.e., require MFA when not in a trusted location) and exclude 'All trusted locations' to avoid prompting from trusted IPs. Option D correctly identifies this misconfiguration.

Answer

The policy should target specific applications instead of 'All applications'.

Answer

The grant controls should be 'Require MFA' only, not 'Require compliant device'.

Answer

The policy should exclude the 'All Users' group and instead assign specific users.

Question 14

Your organization uses Microsoft Sentinel with a workspace in the East US region. You need to ingest security logs from Azure resources in the West Europe region. The solution must minimize data transfer costs. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

UEBA requires a minimum of 14 days of activity to establish a baseline.. UEBA in Microsoft Sentinel requires a minimum of 14 days of historical data to build a behavioral baseline for each user. If a user has been inactive for 30 days, the baseline may have expired or never been established, so no anomalies are generated. The data ingestion is confirmed, but without recent activity, UEBA cannot compare current behavior against a meaningful profile.

Answer

The user's license does not include UEBA.

Answer

UEBA only works with Active Directory data, not Microsoft Entra ID.

Answer

UEBA is not enabled for the workspace.

Question 15

You are a SOC analyst using Microsoft Defender for Endpoint. You need to investigate a device that is suspected of being compromised. You want to collect a memory dump for offline analysis. Which action should you take from the Microsoft Defender XDR portal?

Accepted Answer

Initiate a live response session and use the 'Collect memory dump' command.. The 'Collect memory dump' command is a built-in capability within a live response session in Microsoft Defender for Endpoint. This command allows you to capture a full memory dump of the device for offline forensic analysis, which is essential for investigating a suspected compromise. It is specifically designed for this purpose and does not require additional scripting or external tools.

Answer

Isolate the device from the network to prevent further damage.

Answer

Run a PowerShell script through live response to copy the memory dump.

Answer

Run a full antivirus scan on the device.