SC-200 Manage a security operations environment Practice Test 26 — 15 Questions

Question 1

You are managing Microsoft Defender for Cloud Apps. Which TWO actions can be performed using the Microsoft Defender XDR integration?

Accepted Answer

Investigate user activities across cloud apps.. Microsoft Defender XDR integration with Defender for Cloud Apps enables cross-domain investigation of user activities across cloud apps, leveraging signals from Microsoft 365 Defender to correlate events like sign-ins, file downloads, and admin actions. This allows security analysts to trace a user's behavior across SaaS applications (e.g., SharePoint, OneDrive, Teams) without switching consoles, using the unified incidents and alerts in the Microsoft 365 Defender portal.

Answer

Quarantine malicious emails.

Answer

Manage device compliance policies in Microsoft Intune.

Answer

Onboard devices to Microsoft Defender for Endpoint.

Question 2

Your organization uses Microsoft Sentinel. You need to ensure that an alert is created when a user accesses a sensitive SharePoint site from an unusual location. What should you create?

Accepted Answer

An analytics rule. An analytics rule in Microsoft Sentinel defines the conditions under which alerts are generated. To detect a user accessing a sensitive SharePoint site from an unusual location, you would create an analytics rule that queries the Office 365 activity logs (e.g., SharePoint operations) and uses the 'Unusual Geo-Location' anomaly detection or a custom KQL query comparing the user's location against a baseline of their typical access patterns. This rule will then generate an alert when the condition is met.

Answer

A watchlist

Answer

A playbook

Answer

An automation rule

Question 3

Your organization uses Microsoft Defender XDR and Microsoft Sentinel. The security operations center (SOC) team frequently receives false positive alerts for a specific user login pattern from a legacy application. You need to reduce alert fatigue without disabling the underlying detection rule. What should you configure?

Accepted Answer

Configure an automated investigation and remediation rule in Microsoft Defender XDR to suppress alerts matching the legacy application pattern.. Configuring an automated investigation and remediation rule in Microsoft Defender XDR allows you to suppress alerts that match a specific pattern (e.g., legacy application login behavior) without disabling the underlying detection rule. This directly reduces alert fatigue by automatically closing or ignoring false positive alerts while keeping the rule active for genuine threats.

Answer

Use Microsoft Sentinel bookmarks to mark the alerts as false positives.

Answer

Create a watchlist in Microsoft Sentinel containing the legacy application's user accounts and use it in the rule.

Answer

Modify the analytics rule in Microsoft Sentinel to exclude the legacy application IP range.

Question 4

Your company is deploying Microsoft Sentinel in a multi-tenant environment using Azure Lighthouse. You need to ensure that SOC analysts can triage incidents across all tenants from a single workspace. What is the minimum configuration required?

Accepted Answer

Onboard each tenant as a delegated resource under Azure Lighthouse, then route all logs to a single Sentinel workspace in the managing tenant.. Azure Lighthouse enables multi-tenant management by delegating subscriptions or resource groups from each tenant as delegated resources to the managing tenant. Once delegated, you can configure a single Microsoft Sentinel workspace in the managing tenant to ingest logs from all delegated tenants via diagnostic settings, allowing SOC analysts to triage incidents centrally without needing separate workspaces or cross-workspace queries.

Answer

Create a second Sentinel workspace in the managing tenant and configure cross-workspace queries.

Answer

Configure Azure AD B2B collaboration to grant external users access to each tenant's Sentinel workspace.

Answer

Use Azure Policy to enforce a standard analytics rule across all tenants.

Question 5

Your SOC uses Microsoft Sentinel and Microsoft Defender XDR. An incident is generated from a Microsoft Defender for Identity alert about a suspicious Kerberos ticket request. The incident is assigned the 'Medium' severity. You want to automatically increase the severity to 'High' if the user is in a privileged role, based on data from Microsoft Entra ID. What is the most efficient way to achieve this?

Accepted Answer

Create an automation rule in Microsoft Sentinel triggered on incident creation, which runs a playbook that checks Microsoft Entra ID roles and updates the severity accordingly.. Automation rules in Microsoft Sentinel can trigger a playbook on incident creation, and that playbook can use the Microsoft Graph API to query Microsoft Entra ID for the user's role assignments. If the user holds a privileged role (e.g., Global Administrator), the playbook can programmatically update the incident's severity to 'High'. This approach is event-driven, efficient, and does not require modifying existing analytics rules or creating additional scheduled queries.

Answer

Enable automatic attack disruption in Microsoft Defender XDR to handle the incident.

Answer

Modify the analytics rule that generates the incident to check user roles during query execution.

Answer

Create a scheduled analytics rule that queries Microsoft Entra ID audit logs and updates incident severity via a watchlist.

Question 6

Your organization uses Microsoft Defender for Cloud Apps and Microsoft Sentinel. You notice that a large number of log entries from Defender for Cloud Apps are being dropped at ingestion due to 'malformed data' errors. The data connector shows a healthy status. What is the most likely cause?

Accepted Answer

The data volume exceeds the workspace's ingestion capacity, causing data truncation.. When the data volume exceeds the Log Analytics workspace's ingestion capacity, Defender for Cloud Apps log entries can be truncated mid-record, causing them to be malformed and dropped. The connector status remains healthy because the connector itself is still connected and receiving data, but the workspace's ingestion rate limit (typically 500 MB/min per workspace or 2 GB/min per workspace depending on pricing tier) causes truncation, not a connectivity or authentication failure.

Answer

The log type is not supported by Sentinel.

Answer

The Log Analytics workspace key has expired.

Answer

The Defender for Cloud Apps connector is blocked by a firewall.

Question 7

Your SOC uses Microsoft Sentinel and Microsoft Defender XDR. An incident is created from a Defender for Endpoint alert about a malware detection on a device. The incident has low priority, but you want to automatically isolate the device from the network if the alert is confirmed as a true positive by the SOC. What is the recommended approach?

Accepted Answer

Create an automation rule in Microsoft Sentinel that triggers a playbook with an approval step before executing device isolation.. It aligns with the recommended SOC workflow: an automation rule in Microsoft Sentinel triggers a playbook that includes an approval step, ensuring that device isolation only occurs after the SOC confirms the alert as a true positive. This approach maintains human oversight for low-priority incidents while leveraging automation for the response action.

Answer

Create a separate analytics rule that triggers on the same alert and uses a playbook to isolate the device.

Answer

Use automatic attack disruption in Microsoft Defender XDR to isolate the device automatically.

Answer

Configure an automated response in Defender for Endpoint to isolate the device immediately when an alert is generated.

Question 8

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You need to ensure that all incidents from Microsoft Defender XDR are synchronized to Microsoft Sentinel with the same status (e.g., 'Active', 'Resolved'). What should you configure?

Accepted Answer

Connect Microsoft Defender XDR to Microsoft Sentinel using the official data connector.. The official Microsoft Defender XDR data connector in Microsoft Sentinel automatically synchronizes incidents, including their status (e.g., 'Active', 'Resolved'), bidirectionally. This ensures that any status change in either system is reflected in the other without manual intervention or custom scripting. Option B is correct because it leverages the built-in integration that handles the synchronization natively.

Answer

Create a custom playbook to poll Defender XDR API and update Sentinel incidents.

Answer

Manually update status in both systems.

Answer

Disable the Microsoft Defender XDR connector and use separate connectors for each workload.

Question 9

Your SOC uses Microsoft Sentinel with multiple workspaces for different business units. You want to create a single dashboard that shows key performance indicators (KPIs) across all workspaces. Which approach minimizes complexity and query latency?

Accepted Answer

Use cross-workspace queries in a single dashboard that references all workspaces.. Cross-workspace queries in Microsoft Sentinel allow you to query multiple workspaces in a single KQL query using the `workspace()` expression, enabling a unified dashboard without data duplication or additional infrastructure. This minimizes complexity by avoiding data movement and reduces query latency by leveraging the existing indexing and caching within each workspace.

Answer

Export data to Azure Data Explorer and build the dashboard there.

Answer

Ingest all logs into a single workspace and create the dashboard there.

Answer

Use Power BI to query each workspace separately and combine data.

Question 10

Your organization uses Microsoft Defender for Office 365 and Microsoft Sentinel. You discover that phishing emails are bypassing Defender for Office 365 and being reported by users. You need to ensure that user-reported emails are automatically analyzed and incidents are created in Sentinel for high-confidence phishing. What should you configure?

Accepted Answer

Enable the 'User reported messages' feature in Defender for Office 365 and ensure the Microsoft Defender XDR connector is enabled in Sentinel.. Enabling the 'User reported messages' feature in Defender for Office 365 allows user-reported phishing emails to be automatically submitted to Microsoft for analysis. When the Microsoft Defender XDR connector is enabled in Sentinel, high-confidence phishing verdicts from this analysis are ingested as incidents, creating a seamless automated pipeline without custom infrastructure.

Answer

Set up a custom connector using Microsoft Graph API to ingest user-reported messages into Sentinel.

Answer

Use the Microsoft 365 Defender portal to create a submission rule for user-reported messages.

Answer

Configure a mail flow rule to forward user-reported messages to a dedicated mailbox monitored by Sentinel.

Question 11

Which TWO actions are valid ways to reduce the number of false positive incidents in Microsoft Sentinel without disabling analytics rules?

Accepted Answer

Modify the rule's query to include additional filters.. Modifying the rule's query to include additional filters directly reduces false positives by narrowing the conditions that trigger an alert. This approach refines the detection logic without disabling the rule, ensuring only events that more precisely match the intended threat pattern generate incidents.

Answer

Configure the rule to group all alerts into a single incident per entity.

Answer

Increase the rule run frequency.

Answer

Change the incident severity to Informational.

Question 12

Which THREE are valid components of a Microsoft Sentinel automation rule?

Accepted Answer

Actions (e.g., Run playbook, Change severity). Automation rules in Microsoft Sentinel allow you to define actions such as running a playbook or changing the severity of an incident. These actions are executed automatically when the rule's trigger and conditions are met, enabling streamlined incident response without manual intervention.

Answer

Watchlist

Answer

KQL query

Question 13

Which TWO are supported data sources for Microsoft Sentinel?

Accepted Answer

Microsoft Entra ID audit logs. Microsoft Entra ID audit logs (Option C) are a native data source for Microsoft Sentinel because Sentinel is built on Azure Monitor Logs and directly ingests Entra ID (formerly Azure AD) diagnostic settings via the Azure portal or API. This integration requires no additional connectors or agents, as Entra ID audit logs are automatically forwarded to a Log Analytics workspace when configured under 'Diagnostic settings' in the Entra ID blade.

Answer

Google Cloud VPC Flow Logs

Answer

Windows Server 2008 event logs

Answer

On-premises syslog-ng

Question 14

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You need to ensure that incidents created in Microsoft Defender XDR are automatically synchronized to Microsoft Sentinel with the least administrative effort. What should you configure?

Accepted Answer

Enable the Microsoft Defender XDR data connector in Microsoft Sentinel.. The Microsoft Defender XDR data connector in Microsoft Sentinel provides a built-in, one-click integration that automatically synchronizes incidents from Microsoft Defender XDR to Microsoft Sentinel with no custom development required. This connector uses the Microsoft Graph Security API to ingest incidents, alerts, and evidence, ensuring seamless bidirectional synchronization with the least administrative effort.

Answer

Create a Logic App that uses the Microsoft Defender XDR API to fetch incidents and push them to Microsoft Sentinel.

Answer

Use the Microsoft Sentinel API to pull incidents from Microsoft Defender XDR.

Answer

Enable raw data ingestion from Microsoft Defender for Endpoint to Microsoft Sentinel.

Question 15

You are reviewing an analytics rule configuration in Microsoft Sentinel using ARM template JSON. The rule is enabled and incident creation is set to true. However, when alerts are generated, they are not being grouped into a single incident. What is the most likely reason?

Accepted Answer

The groupingConfiguration is disabled.. The groupingConfiguration in Microsoft Sentinel analytics rules controls whether alerts are grouped into a single incident. When this configuration is disabled, each alert generates its own separate incident, even if the rule is enabled and incident creation is set to true. Therefore, the most likely reason alerts are not being grouped is that the groupingConfiguration is disabled.

Answer

The lookbackDuration is set to 5 hours which is too short.

Answer

The matchingMethod is set to 'AllEntities' which is not supported.

Answer

The rule is not enabled properly.