SC-200 Manage a security operations environment Practice Test 26 — 15 Questions

Question 1

Your organization wants to use Microsoft Sentinel's built-in threat intelligence feeds to enrich alerts. Which data connector should you enable?

Accepted Answer

Threat Intelligence - TAXII connector.. The Threat Intelligence - TAXII connector is the correct choice because it ingests threat intelligence feeds from STIX/TAXII servers, which are the standard protocol (Trusted Automated eXchange of Intelligence Indicator) used by built-in threat intelligence feeds. This connector allows Microsoft Sentinel to pull indicators of compromise (IOCs) from external threat intelligence sources, enriching alerts with context like malicious IPs, domains, or hashes.

Answer

Office 365 connector.

Answer

Microsoft 365 Defender connector.

Answer

Microsoft Defender for Cloud connector.

Question 2

The exhibit shows a KQL query used in a Microsoft Sentinel analytics rule. The rule is intended to detect brute-force attacks by identifying IP addresses that have more than 10 failed sign-ins (result code 50057) followed by a successful sign-in (result code 0) within an hour. However, the rule is not triggering alerts even though you are confident such patterns exist. What is the most likely issue?

Accepted Answer

The query does not ensure the successful sign-in occurred after the failed attempts.. The query likely uses a join that pairs failed sign-ins with successful sign-ins based on the same IP address but does not enforce that the successful sign-in occurred after the failed attempts. This means it could pair a successful sign-in that happened before the failed ones, which would not constitute a brute-force attack. The rule is designed to detect a pattern of many failures followed by a success within an hour; without a temporal condition ensuring the success comes after the failures, the rule may not trigger correctly. Option C correctly identifies this issue. Option A (threshold too high) is incorrect because the threshold of 10 is set and presumably appropriate. Option B (time window too short) is incorrect because the time window is one hour, which is reasonable. Option D (not considering same IP across different users) is less likely because the join likely uses IP address, which is already considering the same IP across users.

Answer

The threshold is too high.

Answer

The time window is too short to capture the pattern.

Answer

The query does not consider the same IP address across different users.

Question 3

You are configuring a Microsoft Sentinel workbook to display incident metrics. You want to show the average time to triage incidents over the last 30 days. Which data source should you use?

Accepted Answer

SecurityIncident table.. The SecurityIncident table in Microsoft Sentinel contains all incident-related data, including timestamps for creation, triage, and resolution. To calculate the average time to triage (e.g., the time between incident creation and the first triage action), you query this table using KQL to compute the mean duration. The other tables (CommonSecurityLog, SecurityAlert, SigninLogs) do not store incident lifecycle metadata.

Answer

CommonSecurityLog table.

Answer

SecurityAlert table.

Answer

SigninLogs table.

Question 4

Your organization uses Microsoft Sentinel to manage security incidents. The security team wants to automatically assign incidents to the appropriate analyst based on the incident’s severity and category. Which feature should you configure?

Accepted Answer

Automation rules. Automation rules in Microsoft Sentinel allow you to automatically assign incidents to specific analysts or teams based on conditions such as severity and category. This is the correct feature because it provides a rule-based engine that triggers on incident creation or update, enabling automatic assignment without manual intervention.

Answer

Analytics rules

Answer

Playbooks

Answer

Watchlists

Question 5

Your organization has Microsoft Defender for Cloud Apps and Microsoft Sentinel integrated. The security team wants to receive alerts when a user's activity from an anonymous IP address exceeds a certain risk score. What should you configure in Defender for Cloud Apps?

Accepted Answer

Activity policy. Activity policies in Microsoft Defender for Cloud Apps allow you to monitor and respond to specific user activities based on conditions such as IP address categories (e.g., anonymous proxy) and risk scores. This policy type can trigger alerts when a user's activity from an anonymous IP address exceeds a defined risk score threshold, meeting the security team's requirement.

Answer

Anomaly detection policy

Answer

File policy

Answer

App discovery policy

Question 6

Your organization uses Microsoft Defender XDR for threat detection and response. The security team wants to automatically isolate a compromised device when a specific malware alert is triggered, but only if the device is not a critical server. What is the most efficient way to achieve this?

Accepted Answer

Configure an automation rule in Microsoft Defender XDR. Automation rules in Microsoft Defender XDR allow you to define conditions (e.g., malware alert triggered) and actions (e.g., isolate device) with scoping filters (e.g., exclude devices tagged as 'critical server'). This provides a no-code, built-in mechanism that runs automatically without manual intervention or external scripting, making it the most efficient approach for conditional automated response.

Answer

Use advanced hunting to find devices and then manually isolate

Answer

Use PowerShell scripts in a playbook

Answer

Create a custom detection rule

Question 7

Your organization uses Microsoft Sentinel and wants to ensure that all incident-related data is retained for at least 90 days for compliance purposes. Which configuration should you check?

Accepted Answer

Log Analytics workspace retention settings. Log Analytics workspace retention settings directly control how long raw data ingested into Microsoft Sentinel is stored. For compliance requiring 90-day retention of incident-related data, you must configure the workspace retention period to at least 90 days (or use archive policies for longer retention). Incident data in Sentinel is derived from this underlying workspace data, so retention settings at the workspace level ensure the data persists for the required duration.

Answer

Watchlist settings

Answer

Analytics rule settings

Answer

Incident settings in Sentinel

Question 8

Your organization is using Microsoft Defender for Identity (MDI) and Microsoft Sentinel. The security team wants to correlate alerts from MDI with other data sources in Sentinel. What is the recommended approach?

Accepted Answer

Enable the Microsoft Defender for Identity data connector in Sentinel. The Microsoft Defender for Identity data connector in Microsoft Sentinel is the recommended approach because it provides native, out-of-the-box integration that automatically ingests MDI alerts and events into Sentinel without requiring additional infrastructure or manual configuration. This connector leverages the Microsoft Graph Security API to pull alerts, enabling seamless correlation with other data sources for unified threat detection and investigation.

Answer

Export MDI logs manually to Sentinel

Answer

Configure MDI to send syslog to Sentinel

Answer

Create a playbook to pull MDI alerts

Question 9

Your organization has Microsoft Sentinel deployed across multiple workspaces for different business units. The security team wants to view a unified incident queue across all workspaces. What should you implement?

Accepted Answer

Create cross-workspace queries and use the incident view with workspace references. Microsoft Sentinel supports cross-workspace incident viewing through the use of workspace references in queries and the unified incident view. By configuring cross-workspace queries and enabling the incident view with workspace references, the security team can aggregate and display incidents from multiple Sentinel workspaces in a single queue, providing a unified view without moving data.

Answer

Use Microsoft Defender XDR portal to view all incidents

Answer

Use Azure Lighthouse to manage multiple workspaces

Answer

Configure a single workspace to receive all incidents

Question 10

Your organization uses Microsoft Sentinel to manage security incidents. The security team wants to automatically close low-severity incidents after 24 hours if no activity has occurred. Which feature should you use?

Accepted Answer

Playbooks. Automation rules in Microsoft Sentinel are event-driven and trigger only on incident creation or update events. They cannot check for 'no activity for 24 hours' because they do not run on a timer or wait. To automatically close low-severity incidents after 24 hours of inactivity, you need a playbook built on Azure Logic Apps that runs on a recurring schedule, queries for incidents matching the criteria, and closes them. Therefore, the correct answer is A: Playbooks.

Answer

Automation rules

Answer

Watchlists

Answer

Analytics rules

Question 11

Your organization is using Microsoft Defender for Cloud Apps to protect cloud applications. The security team wants to be alerted when a user shares a sensitive file with an external user. What should you configure?

Accepted Answer

File policy. File policies in Microsoft Defender for Cloud Apps are specifically designed to monitor and respond to events involving files stored in connected cloud apps, such as when a sensitive file is shared with an external user. You can configure a file policy with a filter for 'External' sharing and apply a content inspection rule to detect sensitive information types, triggering an alert when the condition is met.

Answer

Activity policy

Answer

App discovery policy

Answer

Anomaly detection policy

Question 12

Which TWO of the following are valid data connectors in Microsoft Sentinel? (Select two.)

Accepted Answer

Office 365. Office 365 is a valid Microsoft Sentinel data connector because it ingests audit logs from Exchange Online, SharePoint Online, Teams, and other Office 365 services via the Office 365 Management Activity API. This connector enables security monitoring of user and admin activities across the Microsoft 365 tenant, making it a core data source for insider threat detection and compliance scenarios.

Answer

Windows Defender Firewall

Answer

Microsoft Forms

Answer

Azure DevOps

Question 13

Which TWO of the following are valid actions that can be performed by an automation rule in Microsoft Sentinel? (Select two.)

Accepted Answer

Assign incident to an analyst. Automation rules in Microsoft Sentinel can assign incidents to specific analysts or groups as part of incident response workflows. This action helps ensure accountability and proper triage by routing incidents to the appropriate personnel based on criteria like severity or type.

Answer

Delete a watchlist

Answer

Create a task

Answer

Modify an analytics rule

Question 14

Which THREE of the following are valid components of Microsoft Defender XDR? (Select three.)

Accepted Answer

Microsoft Defender for Endpoint. Microsoft Defender XDR is a unified security operations platform that integrates signals from multiple Microsoft security products. Microsoft Defender for Endpoint provides endpoint detection and response (EDR) capabilities, including behavioral-based detection and automated investigation. It is a core component of the XDR solution, enabling cross-domain correlation of alerts from endpoints.

Answer

Microsoft Purview

Answer

Microsoft Sentinel

Question 15

You are reviewing the automation rule configuration shown in the exhibit. What is the purpose of this rule?

Accepted Answer

Run a playbook to isolate a device when an incident with 'Malware' in the alert title is created. The automation rule is configured to trigger when an incident is created with 'Malware' in the alert title. The action specified is to run a playbook, which in Microsoft Sentinel can perform complex remediation steps such as isolating a device. Option C correctly identifies this combination of trigger condition and action.

Answer

Automatically resolve incidents related to malware

Answer

Automatically close incidents with 'Malware' in the title

Answer

Create a playbook for malware alerts