SC-200 Manage a security operations environment Practice Test 27 — 15 Questions

Question 1

You need to configure Microsoft Sentinel to comply with a regulatory requirement that all security incidents must be retained for 7 years. Which TWO actions should you take?

Accepted Answer

Set the workspace retention policy to 2555 days (7 years).. Options A and D are correct. Setting a retention policy on the workspace to 7 years ensures data retention. Configuring a data export rule allows long-term retention in a storage account for compliance. Option B is incorrect because Basic Logs have a maximum retention of 30 days. Option C is incorrect because table-level retention cannot exceed workspace retention. Option E is incorrect because log analytics workspace retention can be set to up to 730 days by default, but longer via archive.

Answer

Configure table-level retention policies for each table to 7 years.

Answer

Use Basic Logs for all tables to reduce costs.

Answer

Use Azure Policy to enforce a minimum retention period of 7 years on all workspaces.

Question 2

Your organization uses Microsoft Defender XDR and Microsoft Sentinel. You need to ensure that when a user reports a phishing email in Microsoft 365 Defender, the incident in Microsoft Sentinel is automatically updated with the user's comments. Which THREE components are required?

Accepted Answer

The Microsoft 365 Defender data connector in Microsoft Sentinel.. Options A, C, and D are correct. A playbook is needed to process the alert. The Microsoft 365 Defender connector enables the playbook to receive the alert. Automation rules trigger the playbook. Option B is incorrect because the connector for Microsoft Entra ID is not needed. Option E is incorrect because a logic app is a type of playbook, not an additional component.

Answer

A logic app in Azure that is triggered by the Microsoft 365 Defender alert.

Answer

The Microsoft Entra ID data connector in Microsoft Sentinel.

Question 3

You are configuring Microsoft Sentinel to use Microsoft Copilot for Security. Which TWO prerequisites must be met?

Accepted Answer

Ensure that the Microsoft Defender XDR tenant is integrated with Copilot for Security.. Options A and B are correct. Copilot for Security requires the Security Compute Units and the Microsoft Defender XDR integrated tenant. Option C is incorrect because Copilot for Security does not require a premium license. Option D is incorrect because Copilot for Security is a separate service, not a workspace feature. Option E is incorrect because Copilot for Security is available in multiple regions.

Answer

Enable Copilot for Security in the Microsoft Sentinel workspace settings.

Answer

Deploy Copilot for Security in the same Azure region as the Sentinel workspace.

Answer

Purchase a Microsoft Sentinel premium license.

Question 4

Refer to the exhibit. You run this PowerShell script. What is the effect on the SecurityEvent table in the SOC-Workspace Log Analytics workspace?

Accepted Answer

The table will retain data interactively for 365 days, and data will be archived for an additional 365 days, total 730 days.. Option A is correct because the script sets the interactive retention to 365 days and the total retention (including archive) to 730 days. Option B is incorrect because it does not set to 90 and 365. Option C is incorrect because basic logs are not configured. Option D is incorrect because it does not set both to 730.

Answer

The table will retain data interactively for 90 days and archived for 275 days.

Answer

The table will be converted to Basic Logs.

Answer

The table will retain data for 730 days interactively.

Question 5

Your organization uses Microsoft Sentinel with multiple workspaces across different regions. You need to centrally manage all security incidents from a single pane of glass. The solution must allow analysts to investigate incidents across workspaces without switching contexts. What should you configure?

Accepted Answer

Use Azure Lighthouse to manage multiple workspaces and enable cross-workspace incident view in Microsoft Sentinel.. Option C is correct because Microsoft Sentinel's incident management supports cross-workspace views via Azure Lighthouse or unified incident management. Option A is for queries, not incident management. Option B is for data collection. Option D is for event management, not Sentinel.

Answer

Deploy Microsoft Sentinel in a single region and use Azure Arc to connect other workspaces.

Answer

Create a union query across workspaces using the workspace() expression.

Answer

Configure a single workspace and use diagnostic settings to send all logs to it.

Question 6

A junior security analyst reports that they cannot create a new analytics rule in Microsoft Sentinel. They have the 'Microsoft Sentinel Contributor' role on the workspace. What could be the issue?

Accepted Answer

The workspace is in a locked resource group preventing modifications.. Option B is correct because custom roles can be restrictive. Option A is not a common requirement. Option C is incorrect because Contributor can create rules. Option D is incorrect because the role is assigned on the workspace.

Answer

They need the 'Owner' role to create analytics rules.

Answer

They do not have the 'Microsoft Sentinel Responder' role.

Answer

They are assigned the role at the subscription level but not at the workspace level.

Question 7

You are a SOC analyst investigating a high-severity incident. The incident involves a user who received a phishing email and clicked a link. Microsoft Defender for Office 365 detected the email as phishing and blocked the URL at time of click, but a follow-up investigation reveals that the user's mailbox has suspicious forwarding rules. You need to ensure that similar incidents are automatically remediated in the future. What should you configure in Microsoft Sentinel?

Accepted Answer

Create an automation rule that triggers a playbook to remove the forwarding rule when an incident with the 'Phishing' tactic is created.. Automation rules in Microsoft Sentinel allow you to automatically trigger playbooks (e.g., to remove forwarding rules) when incidents are created. Option A is correct because automation rules can invoke a playbook that removes the forwarding rule. Option B is wrong because analytics rules create alerts, not automated actions on incidents. Option C is wrong because watchlists are for reference data, not automation. Option D is wrong because entity behavior analytics is for detecting anomalies, not automated remediation.

Answer

Configure entity behavior analytics to automatically block the user.

Answer

Create an analytics rule that detects suspicious forwarding rules and automatically removes them.

Answer

Add the user to a watchlist that triggers an automated investigation.

Question 8

You are a security analyst for a company that uses Azure Firewall. You are reviewing a custom rule deployed via Azure Firewall Manager. The exhibit shows the rule configuration. The rule is intended to block inbound traffic from known Tor exit nodes. However, a recent incident involved an attacker using a Tor exit node with IP 138.197.5.5 to access an internal web server on port 8080. The log shows the traffic was ALLOWED. What is the most likely reason the rule did not block the traffic?

Accepted Answer

The destination port 8080 is not listed in the rule.. The rule only blocks ports 80 and 443 (destinationPorts). The attacker used port 8080, which is not covered by the rule. Option C is correct. Option A is wrong because the source IP is within the rule's range. Option B is wrong because the rule is of type Prevention, not Detection. Option D is wrong because the priority is not necessarily too low; the rule would still be evaluated if the port matched.

Answer

The source address range does not include 138.197.5.5.

Answer

The rule type is 'Prevention' but should be 'Detection'.

Answer

The rule priority is too low and is overridden by a higher priority rule.

Question 9

Your organization uses Microsoft Sentinel as the primary SIEM. The SOC team reports that many low-severity incidents are overwhelming the queue. You need to reduce noise while ensuring that high-severity incidents are not missed. Which two actions should you take? (Choose two.)

Accepted Answer

Adjust the analytics rule settings to only create incidents for alerts with a severity of Medium or higher.. Option A helps automatically close low-severity incidents that are false positives. Option D sets a severity threshold for alerts to be created as incidents. Option B is incorrect because creating more analytics rules would increase noise. Option C is incorrect because increasing retention does not reduce noise. Option E is incorrect because playbooks do not suppress incidents.

Answer

Increase the data retention period for low-severity alerts.

Answer

Use playbooks to manually review each low-severity incident.

Answer

Create additional analytics rules to better differentiate between true and false positives.

Question 10

The exhibit shows a KQL query used in a Microsoft 365 Defender custom detection rule. The query is intended to detect encoded PowerShell commands executed in the last hour. However, the detection rule is not generating any alerts even though the SOC knows that encoded PowerShell commands are being executed. Which modification would most likely fix the detection rule?

Accepted Answer

Add a condition to also look for `-EncodedCommand` in the command line.. The query uses `contains` which is case-insensitive, but the problem is that the rule might be running on a different time range or the query may not be scheduled to run frequently enough. However, the most likely issue is that the query uses `Project` instead of `project` (case sensitivity in KQL is not an issue), but actually KQL is case-insensitive for keywords. A common mistake is that the query uses `project` correctly. Actually, the issue might be that the detection rule is not including the right data source or the query is not scheduled. But given the options, the most plausible fix is to change `contains` to `has` because `contains` will match substrings like "-encodedcommand" but also "-enc" inside other words, but the real issue might be that the query is not using `has_any` for performance. However, among the options, the correct one is to add a condition to filter on `InitiatingProcessFileName` to ensure only powershell.exe is considered? No, the query already filters on FileName. Let's re-analyze: The query uses `DeviceProcessEvents` which is from Microsoft 365 Defender. The detection rule might not be triggering because the query uses `ago(1h)` which is relative to the time the query runs, but if the rule runs every hour, it might miss events that happen just after the query runs. However, the rule should include all events from the last hour. The more likely issue is that the query uses `contains "-enc"` which will match any string containing "-enc", but the encoded command flag in PowerShell is "-EncodedCommand". However, the query also checks for "-e" which would match many commands. But the real problem might be that the query is not filtering out legitimate uses. Option A is correct because the query should also look for the `-EncodedCommand` parameter explicitly. Option B is wrong because using `has` instead of `contains` would be more accurate but not the main issue. Option C is wrong because the query already filters on FileName. Option D is wrong because the query already uses Project.

Answer

Change `contains` to `has` for better performance and accuracy.

Answer

Modify the query to use `project-away` instead of `project`.

Answer

Replace `FileName == "powershell.exe"` with `InitiatingProcessFileName == "powershell.exe"`.

Question 11

Your organization is planning to deploy Microsoft Sentinel. You need to ensure that security events from on-premises servers are sent to Sentinel. Which connector should you use?

Accepted Answer

Install the Azure Monitor Agent (AMA) on the servers and configure a Data Collection Rule (DCR) to send events to Sentinel.. The Azure Monitor Agent (AMA) is the recommended agent for collecting logs from Windows and Linux servers to Azure Monitor and Sentinel. Option A is correct. Option B is wrong because the Log Analytics agent is legacy and being deprecated. Option C is wrong because Microsoft Defender for Cloud is for cloud security posture, not log collection. Option D is wrong because Azure Arc is for managing servers outside Azure, but the actual log collection still uses AMA.

Answer

Install the Log Analytics agent (MMA) on the servers and connect to Sentinel workspace.

Answer

Use the Microsoft Defender for Cloud (MDC) connector to stream security events.

Answer

Enable Azure Arc on the servers and use the Arc agent to forward events.

Question 12

You are a SOC analyst using Microsoft Defender XDR. You notice that a user's account has been compromised and is being used to send phishing emails. You need to prevent the user from sending any more emails while preserving the ability to receive emails for investigation. What should you do?

Accepted Answer

Restrict the user from sending email using Microsoft Defender for Office 365 mailbox restrictions.. In Microsoft Defender XDR, you can restrict a user from sending email by applying a mailbox restriction. Option B is correct. Option A is wrong because disabling the user in Entra ID prevents all access. Option C is wrong because deleting the mailbox removes all data. Option D is wrong because removing licenses removes access to all Microsoft 365 services.

Answer

Remove the user's Microsoft 365 license.

Answer

Disable the user account in Microsoft Entra ID.

Answer

Delete the user's mailbox in Exchange Online.

Question 13

Your organization uses Microsoft Sentinel with a workspace in the East US region. You have a playbook that escalates incidents to ServiceNow. Due to compliance requirements, all data must remain in the West Europe region. You need to ensure that the playbook execution and any data it processes stays within West Europe. What should you do?

Accepted Answer

Create the playbook as a Logic App in the West Europe region and ensure it uses a managed identity for authentication.. Playbooks run in the same region as the Logic Apps resource, which can be created in West Europe. By creating the playbook in West Europe, it will process data there. Option D is correct. Option A is wrong because moving the Sentinel workspace is not possible without redeployment. Option B is wrong because the API connector does not control data location. Option C is wrong because using a different workspace would require changing all data collection.

Answer

Use a different Sentinel workspace in West Europe for the incidents.

Answer

Move the Sentinel workspace to West Europe.

Answer

Configure the ServiceNow connector to use a West Europe endpoint.

Question 14

You are configuring Microsoft Sentinel to ingest logs from Azure Active Directory (now Microsoft Entra ID). Which of the following connectors should you use to collect sign-in logs and audit logs?

Accepted Answer

Microsoft Entra ID connector.. The Microsoft Entra ID connector provides sign-in logs and audit logs directly to Sentinel. Option A is correct. Option B is wrong because Office 365 connector is for Exchange, SharePoint, etc. Option C is wrong because Azure Activity connector is for Azure resource logs. Option D is wrong because Microsoft Defender for Cloud is for security alerts.

Answer

Microsoft Defender for Cloud connector.

Answer

Office 365 connector.

Answer

Azure Activity connector.

Question 15

You are a SOC analyst investigating an incident where a user's credentials were used to access a sensitive SharePoint site from an unusual location. Microsoft Defender for Cloud Apps detected the activity as a suspicious sign-in. You need to create a detection rule that alerts whenever a user accesses SharePoint from a location not in the allowed list. What type of rule should you create in Microsoft Defender for Cloud Apps?

Accepted Answer

Activity policy.. Activity policies in Defender for Cloud Apps allow you to detect specific user activities that match criteria. Option B is correct. Option A is wrong because anomaly detection policies use machine learning to detect unusual patterns, not specific location-based checks. Option C is wrong because app discovery policies are for discovering shadow IT. Option D is wrong because session policies are for real-time session control, not detection.

Answer

App discovery policy.

Answer

Session policy.

Answer

Anomaly detection policy.