SC-200 Manage a security operations environment Practice Test 27 — 15 Questions

Question 1

You are reviewing the KQL query shown in the exhibit. What is the purpose of this query?

Accepted Answer

Identify high-severity alert names that occurred more than 10 times in the last 24 hours. The query uses `summarize` with `count()` on `AlertName`, then filters with `where count_ > 10`. This groups high-severity alerts by name and returns only those names that appear more than 10 times in the last 24 hours. The `project` statement outputs only the `AlertName` and its count, confirming the purpose is to identify frequently occurring high-severity alert names.

Answer

Count the number of high-severity alerts per hour

Answer

Return the timestamp of each high-severity alert

Answer

List all high-severity incidents in the last 24 hours

Question 2

You are reviewing the ARM template snippet shown in the exhibit. What is the purpose of this template?

Accepted Answer

Create a saved search in a Log Analytics workspace. The ARM template snippet defines a saved search resource of type 'Microsoft.OperationalInsights/workspaces/savedSearches'. This resource type is specifically used to create a saved query within a Log Analytics workspace, which can then be used for log queries, alert rules, or workbooks. Option C correctly identifies this purpose.

Answer

Create a workbook in Azure Monitor

Answer

Create an analytics rule in Microsoft Sentinel

Answer

Create a data connector in Microsoft Sentinel

Question 3

Your security team needs to assign a custom role in Microsoft Sentinel that allows read and write access to incidents but not to analytics rules. Which built-in role should you use as a base for the custom role?

Accepted Answer

Microsoft Sentinel Responder. The Microsoft Sentinel Responder role is the correct base because it grants read and write access to incidents while explicitly excluding write permissions to analytics rules. This aligns with the requirement for incident management without allowing modifications to detection logic.

Answer

Microsoft Sentinel Reader

Answer

Microsoft Sentinel Contributor

Answer

Global Administrator

Question 4

Your organization uses Microsoft Defender for Cloud to monitor hybrid workloads. You need to ensure that security alerts from on-premises servers are sent to Microsoft Sentinel. What should you configure?

Accepted Answer

Connect the on-premises servers to Azure Arc and deploy the Log Analytics agent.. Azure Arc enables on-premises servers to be managed as Azure resources, allowing the Log Analytics agent to be deployed and configured to forward security alerts to a Log Analytics workspace integrated with Microsoft Sentinel. This is the standard method for ingesting security events from hybrid workloads into Sentinel without requiring third-party connectors or complex network configurations.

Answer

Install a third-party SIEM connector on the servers and forward logs to Sentinel.

Answer

Deploy Azure Policy on the servers to audit security settings.

Answer

Configure a site-to-site VPN to Azure and enable network logging.

Question 5

Your Microsoft Defender XDR environment is experiencing high false positive rates for a specific type of alert. You need to reduce the noise without completely disabling the alert. What is the most effective method?

Accepted Answer

Create a custom detection rule to tune the detection logic.. Creating a custom detection rule allows you to refine the detection logic by adding specific conditions, such as excluding known benign processes or IP addresses, thereby reducing false positives while retaining the alert's core detection capability. This approach directly tunes the detection mechanism rather than masking or disabling it, aligning with the goal of reducing noise without completely disabling the alert.

Answer

Create a suppression rule for the alert.

Answer

Use an automation rule to automatically close the false positive incidents.

Answer

Disable the built-in detection rule.

Question 6

Your organization has Microsoft Defender for Office 365 enabled. Users report that phishing emails are being delivered to their inboxes. You need to improve the filtering. What should you do first?

Accepted Answer

Review phishing emails in Threat Explorer and adjust anti-phishing policies.. Reviewing the Threat Explorer in Defender for Office 365 allows you to analyze detected phishing emails and understand why they were delivered, then adjust policies accordingly. Option A is wrong because increasing spam confidence level might block legitimate email. Option C is wrong because disabling third-party connectors doesn't help. Option D is wrong because enabling secure by default is already enabled.

Answer

Increase the spam confidence level threshold.

Answer

Disable third-party email connectors.

Answer

Enable the 'Secure by default' setting in Exchange Online.

Question 7

Your Microsoft Sentinel workspace is ingesting data from multiple sources. You notice that the cost is higher than expected. You need to reduce costs without losing critical security data. Which two actions should you take? (Choose two.)

Accepted Answer

Set a daily cap on tables that generate high volumes but low security value.. Setting daily caps on specific tables (option A) prevents high-volume, low-security-value data from incurring excessive costs, while moving verbose logs to Auxiliary logs (Basic Logs) tier (option B) reduces cost because this tier is cheaper than Analytics logs. Option C is wrong because increasing retention raises storage costs. Option D is wrong because changing to Pay-as-you-go Gen2 is not a built-in cost-reduction feature; it's a newer pricing model that may be more expensive. Option E is wrong because turning off data connectors stops all ingestion, which could eliminate critical security data.

Answer

Increase the retention period for all tables to 90 days.

Answer

Change the workspace pricing tier to 'Pay-as-you-go Gen2'.

Answer

Turn off data connectors for non-critical sources.

Question 8

Your organization uses Microsoft Defender for Cloud Apps. You need to create a policy that alerts when a user downloads more than 10 files from SharePoint in 5 minutes. What type of policy should you create?

Accepted Answer

Activity policy. An Activity policy in Microsoft Defender for Cloud Apps is designed to monitor and respond to specific user activities, such as file downloads from SharePoint, based on predefined thresholds. By configuring the policy with a threshold of more than 10 downloads within 5 minutes, it triggers an alert when the activity exceeds this limit, enabling detection of potential data exfiltration or anomalous user behavior.

Answer

App permissions policy

Answer

Session policy

Answer

Anomaly detection policy

Question 9

Your SOC team uses Microsoft Sentinel's UEBA to detect insider threats. You want to ensure that UEBA can correlate activities across multiple data sources. Which data source must be enabled for UEBA to function properly?

Accepted Answer

Microsoft Entra ID audit logs. Microsoft Sentinel's UEBA relies on Microsoft Entra ID (formerly Azure AD) audit logs as the primary identity source to establish a baseline of user behavior and correlate activities across different data sources. Without these logs, UEBA cannot map activities to specific user identities, which is essential for detecting anomalous behavior patterns indicative of insider threats.

Answer

Azure Activity logs

Answer

Office 365 audit logs

Answer

Windows Security Events

Question 10

Your organization is implementing Microsoft Sentinel. You need to ensure that security events from AWS CloudTrail are collected. What should you configure?

Accepted Answer

AWS S3 connector in Sentinel.. The AWS S3 connector in Microsoft Sentinel is the correct solution because AWS CloudTrail logs are stored in an S3 bucket. Sentinel's native AWS S3 connector ingests these logs by polling the S3 bucket for new CloudTrail events, parsing them into the Sentinel workspace for security monitoring. This is the designated method for collecting CloudTrail data into Sentinel, as documented by Microsoft.

Answer

Azure Policy to audit AWS resources.

Answer

Microsoft Defender for Cloud to monitor AWS.

Answer

A REST API connector to call CloudTrail API.

Question 11

Which THREE actions are recommended practices for managing Microsoft Sentinel costs?

Accepted Answer

Set daily caps on high-volume tables.. Setting daily caps on high-volume tables is a recommended practice because it prevents unexpected cost overruns by limiting the amount of data ingested into expensive tables like SecurityEvent or CommonSecurityLog. Microsoft Sentinel bills per GB ingested, so capping tables that generate large volumes of noise (e.g., verbose Windows event logs) directly controls costs without necessarily impacting security visibility, as critical alerts can still be generated from other sources.

Answer

Ingest all logs to ensure complete visibility.

Answer

Increase retention period to 1 year for all tables.

Question 12

Which TWO permissions are required to create and manage automation rules in Microsoft Sentinel?

Accepted Answer

Microsoft Sentinel Automation Contributor. To create and manage automation rules in Microsoft Sentinel, you need a role that includes the 'Microsoft Sentinel Automation Contributor' permission. Both the Microsoft Sentinel Contributor role (Option E) and the Microsoft Sentinel Automation Contributor role (Option B) grant this permission individually. Therefore, either role is sufficient, and both are correct answers to the question.

Answer

Microsoft Sentinel Reader

Answer

Microsoft Sentinel Responder

Answer

Log Analytics Contributor

Question 13

Which TWO data connectors are available in Microsoft Sentinel to ingest data from Microsoft 365 services?

Accepted Answer

Microsoft Entra ID. Microsoft Entra ID (formerly Azure Active Directory) is a correct data connector because it ingests sign-in logs, audit logs, and provisioning events from Microsoft's identity service into Microsoft Sentinel. This connector uses the Microsoft Graph API to pull identity-related telemetry, which is essential for monitoring authentication anomalies and privilege escalation.

Answer

Azure Active Directory

Answer

Microsoft Defender for Cloud

Answer

Amazon Web Services

Question 14

Refer to the exhibit. You create an automation rule in Microsoft Sentinel using the ARM template snippet shown. However, the rule does not trigger when a high-severity incident is created. What is the most likely cause?

Accepted Answer

The automation rule does not specify the incident provider condition.. The ARM template snippet does not include the 'incidentProvider' condition, which is required for automation rules to trigger on incidents created by Microsoft Sentinel (e.g., from analytics rules). Without specifying the provider (e.g., 'Microsoft Sentinel'), the rule will not evaluate or trigger when a high-severity incident is created, as the condition defaults to no provider filter, effectively disabling the rule for Sentinel incidents.

Answer

The playbook resource ID is invalid.

Answer

The 'triggersWhen' property should be 'Updated' instead of 'Created'.

Answer

The order property is set to 1, conflicting with another rule.

Question 15

Refer to the exhibit. A SOC analyst runs the KQL query in Microsoft Sentinel to identify the top 10 alert names by count. They notice the results include alerts with low severity that are not relevant. What should they add to the query to focus on high-severity alerts only?

Accepted Answer

Add 'where Severity == "High"' before the summarize clause.. In KQL, the `where` clause must be placed before the `summarize` clause to filter raw events before aggregation. Placing `where Severity == "High"` before `summarize` ensures that only high-severity alerts are counted, preventing low-severity alerts from appearing in the top 10 results. This is a fundamental KQL query execution order: filtering first reduces the dataset for aggregation, improving both accuracy and performance.

Answer

Add 'order by Severity' to the query.

Answer

Add 'where Severity == "High"' after the summarize clause.

Answer

Change the time range to last 24 hours.