SC-200 Manage a security operations environment Practice Test 28 — 15 Questions

Question 1

Refer to the exhibit. You are configuring a Microsoft Sentinel Windows Security Events via AMA connector using an ARM template. After deployment, you notice that no Windows events are being ingested. The AMA agent is installed on the Windows servers. What is the most likely issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The data collection rule is not associated with the virtual machines.. The most likely issue is that the data collection rule (DCR) is not associated with the virtual machines. Even when the Azure Monitor Agent (AMA) is installed, it will not send any Windows security events to Microsoft Sentinel unless a DCR is linked to the VM. The DCR defines which events to collect and where to send them; without this association, the agent has no instructions and remains idle.

Answer

The WindowsEvent and SecurityEvent data types are disabled.

Answer

The Azure Monitor Agent is not installed on the servers.

Answer

The workspace ID is missing from the template.

Question 2

Your organization uses Microsoft Sentinel and has enabled UEBA. You notice that many low-severity incidents are being created from high-volume informational alerts. You want to reduce noise without disabling data connectors. What should you do?

Accepted Answer

Modify the analytics rule query to exclude the high-volume informational events using KQL.. Modifying the analytics rule query to exclude high-volume informational events using KQL directly addresses the root cause: the rule is generating low-severity incidents from noisy informational data. This approach preserves the data connectors and UEBA functionality while filtering out the specific events that cause alert fatigue. Unlike automation rules that close incidents after creation, query modification prevents the incidents from being generated in the first place.

Answer

Create an automation rule that closes low-severity incidents immediately.

Answer

Increase the incident creation threshold in the analytics rule.

Answer

Disable the Microsoft 365 Defender connector for those data sources.

Question 3

You are a security operations analyst. You need to ensure that when a suspicious sign-in is detected by Microsoft Entra ID Protection, an incident is automatically created in Microsoft Sentinel and assigned to the Tier 1 SOC team. What should you configure in Microsoft Sentinel?

Accepted Answer

Create an automation rule that triggers when an incident is created and sets the owner to the Tier 1 SOC group.. Automation rules in Microsoft Sentinel can be configured to run when an incident is created, and one of the available actions is to set the incident owner to a specific group (e.g., Tier 1 SOC). This directly fulfills the requirement to automatically assign the incident to the Tier 1 SOC team upon creation from a Microsoft Entra ID Protection detection.

Answer

Create a playbook that is triggered by the Microsoft Entra ID Protection data connector.

Answer

Enable UEBA and configure role-based access control (RBAC).

Answer

Configure an analytics rule with a corresponding automation rule to assign the incident.

Question 4

Your organization has deployed Microsoft Defender XDR and Microsoft Sentinel in a hybrid environment. You need to ensure that incidents from Microsoft Defender for Endpoint are synchronized to Microsoft Sentinel with full alert details. You have already connected the Microsoft Defender XDR connector. What additional step must you take?

Accepted Answer

In the Microsoft Defender XDR connector, enable 'Microsoft 365 Defender incident creation'.. After connecting the Microsoft Defender XDR connector, you need to enable 'Microsoft 365 Defender incident creation' within the connector settings to ensure that incidents from Microsoft Defender for Endpoint are synchronized to Microsoft Sentinel with full alert details. Option B is incorrect because the Microsoft Defender for Endpoint API connector is not required; the XDR connector handles incident streaming. Option C is incorrect because bi-directional sync is not supported and not needed. Option D is incorrect because the connector does not automatically sync full alert details without enabling incident creation.

Answer

Enable the Microsoft Defender for Endpoint API connector in Microsoft Sentinel.

Answer

Configure a bi-directional sync between Microsoft Sentinel and Microsoft Defender XDR.

Answer

No additional steps are required; the connector automatically syncs all incident details.

Question 5

A security incident in Microsoft Sentinel has been classified as a true positive and remediated. According to your SOC playbook, the incident should be closed with a classification of 'True Positive' and a sub-classification of 'Confirmed activity'. What is the correct way to close the incident in Microsoft Sentinel?

Accepted Answer

In the Microsoft Sentinel incident, set Status to 'Closed', Classification to 'True Positive', and Sub-classification to 'Confirmed activity'.. Microsoft Sentinel requires incidents to be closed directly within its own interface to apply the proper classification and sub-classification. Setting the status to 'Closed' with the classification 'True Positive' and sub-classification 'Confirmed activity' ensures the incident is resolved according to the SOC playbook and that the analytics rules and reporting reflect accurate closure reasons.

Answer

Close the incident in Microsoft Defender XDR and let it sync to Microsoft Sentinel.

Answer

Change the incident status to 'Closed' without adding a classification.

Answer

Use the Microsoft Security Graph API to close the incident with the appropriate classification.

Question 6

Your SOC team uses Microsoft Sentinel and Microsoft Defender XDR. You have configured automated responses using playbooks. However, some playbooks fail to execute when triggered from Microsoft Defender XDR incidents. You need to ensure that the playbooks run successfully. What should you verify?

Accepted Answer

Ensure that the automation rule that triggers the playbook has the correct 'incident provider' set to 'Microsoft Defender XDR'.. Microsoft Defender XDR incidents that are synchronized to Microsoft Sentinel include an 'incident provider' property. Automation rules in Sentinel must have the 'incident provider' set to 'Microsoft Defender XDR' to trigger playbooks specifically for those incidents. If this property is not configured correctly, the automation rule will not match the incoming incidents, causing the playbook to fail to execute.

Answer

Confirm that the playbook is stored in the same resource group as Microsoft Sentinel.

Answer

Verify that the playbook is connected to Microsoft Teams for approval.

Answer

Check that the service principal has global administrator role in Microsoft Entra ID.

Question 7

Your organization has a Microsoft Sentinel workspace that ingests logs from multiple sources. You need to implement a process to review and approve changes to analytics rules before they are deployed to production. What should you use?

Accepted Answer

Configure Microsoft Sentinel repository integration with Azure DevOps and use branch policies for approval.. Microsoft Sentinel repository integration with Azure DevOps (or GitHub) enables source control for analytics rules, allowing changes to be managed through pull requests and branch policies. This enforces a review and approval workflow before rules are deployed to production, directly meeting the requirement for a structured change management process.

Answer

Create a playbook that emails the SOC manager when an analytics rule is modified.

Answer

Use a workbook to track changes to analytics rules.

Answer

Export analytics rules to a notebook for manual review.

Question 8

Your SOC team receives a high-priority incident related to a potential malware outbreak. You need to quickly identify all affected devices and users across the environment. What Microsoft Defender XDR feature should you use?

Accepted Answer

Incident graph. The incident graph visually maps the relationships between alerts, devices, users, and entities, enabling rapid identification of all affected devices and users during a high-priority incident. Option A is wrong because advanced hunting is query-based and slower for immediate triage. Option B is wrong because action center is for remediation actions, not for identifying affected assets. Option D is wrong because a Microsoft Sentinel workbook is for custom reporting and dashboards, not for real-time incident triage.

Answer

Advanced hunting

Answer

Action center

Answer

Microsoft Sentinel workbook

Question 9

You have a Microsoft Sentinel workspace that uses Customer-Managed Keys (CMK). A security audit requires that all data at rest be encrypted with the CMK. You recently onboarded a new data connector that sends logs to a Log Analytics workspace in a different region. You need to ensure the new workspace uses CMK. What should you do?

Accepted Answer

Associate the new Log Analytics workspace with an Azure Key Vault containing the CMK before ingesting data.. Customer-Managed Keys (CMK) for Log Analytics workspaces must be configured at workspace creation time or before any data is ingested. The CMK is associated with the workspace via an Azure Key Vault, and once data is written, the encryption key cannot be changed. Therefore, to ensure the new workspace in a different region uses CMK, you must associate it with the Key Vault containing the CMK before any logs are ingested.

Answer

Update the data connector settings to enable CMK at the source.

Answer

Use Azure Policy to enforce CMK on the new workspace.

Answer

Configure CMK on the new workspace's tables individually.

Question 10

Your organization uses Microsoft Sentinel and has deployed multiple analytics rules. You need to evaluate the effectiveness of these rules by identifying which rules generate the most incidents and have the highest false positive rate. What should you use?

Accepted Answer

Incidents view in Microsoft Sentinel filtered by analytics rule. The Incidents view in Microsoft Sentinel allows you to filter incidents by analytics rule, enabling you to see the count of incidents generated per rule and assess their effectiveness. By reviewing the incident details, you can identify which rules produce the most incidents and, by analyzing the closed or resolved incidents, determine the false positive rate. This directly addresses the requirement to evaluate rule effectiveness based on incident volume and false positives.

Answer

Hunting view in Microsoft Sentinel

Answer

MITRE ATT&CK view in Microsoft Sentinel

Answer

Entity behavior analytics view in Microsoft Sentinel

Question 11

Which TWO actions should you take to ensure that Microsoft Sentinel can detect and respond to threats across your multicloud environment, including AWS and GCP?

Accepted Answer

Create analytics rules in Microsoft Sentinel to detect threats from the ingested multicloud logs.. Analytics rules in Microsoft Sentinel define the conditions under which alerts are generated from ingested data. Without these rules, the raw logs from AWS S3 and GCP Pub/Sub would be stored but not evaluated for threats, rendering detection ineffective. Creating custom or built-in analytics rules is essential to transform ingested multicloud logs into actionable security incidents.

Answer

Use Azure Policy to deploy the connectors automatically.

Answer

Enable the Microsoft Defender XDR connector for AWS and GCP.

Answer

Create a separate Microsoft Sentinel workspace for each cloud provider.

Question 12

Which THREE are valid incident classification options in Microsoft Sentinel?

Accepted Answer

Benign Positive. (Benign Positive) is correct because Microsoft Sentinel uses incident classification to categorize the outcome of an investigation. A Benign Positive indicates that an alert is triggered by legitimate activity that is expected or acceptable, such as a security tool scanning the network or a user performing an authorized administrative task. This classification helps analysts distinguish between true threats and harmless events without marking them as false positives.

Answer

Informational

Answer

Malicious

Question 13

Which TWO steps are necessary to configure Microsoft Sentinel to automatically disable a compromised user account in Microsoft Entra ID when a high-severity incident is created?

Accepted Answer

Create a playbook that uses the Microsoft Entra ID 'Disable user' action.. A playbook is an automated workflow that can contain the 'Disable user' action from Microsoft Entra ID, which directly disables a compromised user account. This action leverages the Microsoft Graph API to update the user's accountEnabled property to false, effectively blocking sign-ins. Without this playbook, there is no mechanism to execute the disablement action when an incident is created.

Answer

Enable the Microsoft Defender XDR connector.

Answer

Enable the Microsoft Entra ID Protection data connector.

Answer

Create an analytics rule that detects compromised user accounts.

Question 14

You are reviewing an automation rule ARM template for Microsoft Sentinel. What is the result of deploying this automation rule?

Accepted Answer

When a High severity incident is created, the rule changes its severity to Medium and assigns it to SOC-Tier2.. The ARM template defines an automation rule that triggers when an incident is created with a severity of High. The rule's actions change the severity to Medium and assign the incident to the SOC-Tier2 owner. This matches option C exactly.

Answer

The rule assigns the incident to SOC-Tier2 only if the severity is Medium.

Answer

The rule triggers when an incident is updated and resets the severity to High.

Answer

The rule triggers when a High severity incident is created but does not change the severity.

Question 15

You run the above KQL query in Microsoft Sentinel. The query returns no results. What is the most likely reason?

Accepted Answer

The query does not specify a time range, so it may be querying data older than the default 24-hour lookback.. By default, KQL queries in Microsoft Sentinel without an explicit time range filter only look back 24 hours. If the relevant SecurityAlert records were generated more than 24 hours ago, the query will return no results. This is a common oversight when investigating historical incidents.

Answer

The column 'AlertSeverity' does not exist in the SecurityAlert table.

Answer

The 'summarize' operator is misspelled.

Answer

The 'has' operator is case-sensitive and the alert names are capitalized differently.