SC-200 Manage a security operations environment Practice Test 28 — 15 Questions

Question 1

Your organization uses Microsoft Sentinel. You need to automatically assign incidents to the appropriate SOC tier based on severity. What should you create?

Accepted Answer

An automation rule with an owner assignment action. Automation rules in Microsoft Sentinel allow you to automatically assign incidents to specific owners based on conditions like severity, using the 'Assign owner' action. This directly meets the requirement to route incidents to the appropriate SOC tier without manual intervention, leveraging Sentinel's native incident management capabilities.

Answer

A data connector to Microsoft Teams

Answer

A scheduled analytics rule

Answer

A playbook in Microsoft Power Automate

Question 2

Which TWO actions are part of managing a security operations environment in Microsoft Sentinel? (Select two.)

Accepted Answer

Creating automation rules to triage incidents. Automation rules in Microsoft Sentinel allow you to automatically triage incidents by applying actions such as assigning ownership, changing severity, or running playbooks. This is a core operational task within the security operations environment to streamline incident response and reduce manual effort.

Answer

Configuring physical access controls to the data center

Answer

Installing the Azure Monitor Agent on servers

Answer

Creating Microsoft Purview sensitivity labels

Question 3

Which THREE components are part of Microsoft Defender XDR? (Select three.)

Accepted Answer

Microsoft Defender for Endpoint. Microsoft Defender XDR is the unified extended detection and response suite that correlates signals across Microsoft's first-party security workloads, and its core components include Microsoft Defender for Endpoint (A), which provides endpoint detection and response (EDR) for devices; Microsoft Defender for Identity (C), which monitors on-premises Active Directory Domain Services signals via sensors to detect identity-based attacks; and Microsoft Defender for Office 365 (E), which protects email, collaboration, and Office apps against phishing, malware, and business email compromise. These three services natively share incidents, alerts, and advanced hunting data in the Microsoft 365 Defender portal, which is why they are part of Defender XDR. Microsoft Entra ID (B) is the identity and access management service (formerly Azure AD) and is not itself a Defender XDR workload, though it feeds identity signals into the suite. Microsoft Defender for Cloud (D) is a cloud security posture management and workload protection offering for Azure, multicloud, and hybrid resources, and it belongs to the Microsoft Defender for Cloud family rather than being one of the Defender XDR components.

Answer

Microsoft Entra ID

Answer

Microsoft Defender for Cloud

Question 4

Which TWO features in Microsoft Sentinel can help reduce alert fatigue by grouping related alerts into incidents? (Select two.)

Accepted Answer

Incident merging. Incident merging (Option A) is correct because it automatically combines multiple alerts that share common entities (such as IP addresses, hostnames, or user accounts) into a single incident. This reduces alert fatigue by preventing security analysts from having to triage dozens of separate alerts that are all part of the same attack chain, allowing them to focus on a single, consolidated incident.

Answer

Entity behavior analytics

Answer

Automation rules that run playbooks

Answer

Threat intelligence indicators

Question 5

Refer to the exhibit. You are reviewing an automation rule in Microsoft Sentinel. What will happen when a new incident is created?

Accepted Answer

The playbook 'BlockIPPlaybook' will be executed. The automation rule is configured to trigger a playbook when an incident is created. The rule's action specifies 'Run playbook' with 'BlockIPPlaybook' selected, and the trigger condition is set to 'When incident is created'. This means that upon incident creation, Sentinel will execute the playbook as an automated response.

Answer

The incident severity will be changed

Answer

A new analytics rule will be created

Answer

The incident will be automatically closed

Question 6

Refer to the exhibit. You run this KQL query in Microsoft Sentinel. What is the purpose of the query?

Accepted Answer

To count alerts by severity over the last week. The KQL query uses the `SecurityAlert` table and summarizes alerts by `AlertSeverity` using the `count()` aggregation function. The `where TimeGenerated > ago(7d)` filter restricts results to the last 7 days, and the `project` clause outputs only the severity and count columns. This directly produces a count of alerts grouped by severity over the last week, matching option B.

Answer

To list all incidents in the last 7 days

Answer

To find the most recent high-severity alert

Answer

To identify hunting results

Question 7

Your organization uses Microsoft Sentinel. You need to automatically assign incidents to the appropriate SOC tier based on severity. What should you create?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The automation rule that triggers the playbook is set to run only when the incident is created by a specific provider (e.g., Microsoft Defender XDR), but the incident is created by Microsoft Sentinel.. The automation rule that triggers the playbook is configured with a condition that restricts it to incidents created by a specific provider, such as Microsoft Defender XDR. However, the ransomware incident is being created by Microsoft Sentinel (e.g., via an analytics rule), not by Microsoft Defender XDR. This provider mismatch prevents the automation rule from firing, so the playbook never runs, even though the playbook itself is enabled and connected to the analytics rule.

Answer

The Microsoft Sentinel workspace is in a different region than Microsoft Defender XDR.

Answer

The incident is not being created by the analytics rule.

Answer

The playbook is not associated with the correct analytics rule in the automation rule.

Question 8

You are designing a Microsoft Sentinel deployment for a multinational organization that must comply with GDPR and local data residency requirements. They have offices in the US, EU, and Asia. They want to use a single Microsoft Sentinel workspace for global visibility but need to ensure that data from EU sources remains within the EU. What is the best approach to meet these requirements?

Accepted Answer

Deploy separate Microsoft Sentinel workspaces in the US, EU, and Asia, and use cross-workspace queries and Azure Lighthouse to manage them centrally.. Deploying separate Microsoft Sentinel workspaces in each required region (US, EU, Asia) ensures that data from EU sources remains within the EU, satisfying GDPR and local data residency requirements. Cross-workspace queries and Azure Lighthouse allow centralized management and global visibility across these workspaces without moving data between regions.

Answer

Deploy a single Microsoft Sentinel workspace in the US and use Azure Policy to restrict data ingestion from EU sources.

Answer

Deploy a single workspace in the EU and enable UEBA to analyze all data.

Answer

Use Azure Lighthouse to project a single workspace into multiple regions, which automatically separates data storage.

Question 9

A security operations center (SOC) uses Microsoft Sentinel. They want to automatically block a user's account when a high-severity incident is created. Which automation action should you use in a playbook?

Accepted Answer

Run a playbook that calls the Microsoft Graph API to disable the user account.. Disabling the user account via Microsoft Graph API is the most direct and effective way to prevent further access when a high-severity incident is created. This action immediately blocks the user from authenticating across all services, which aligns with the requirement to automatically block the account. Other options either do not block the account (e.g., revoking sessions or resetting password) or are indirect and less reliable (e.g., updating Conditional Access policies).

Answer

Run a playbook that revokes the user's current sessions using Microsoft Graph API.

Answer

Run a playbook that resets the user's password.

Answer

Run a playbook that updates a conditional access policy in Microsoft Entra ID.

Question 10

Your Microsoft Sentinel workspace is ingesting logs from multiple sources. You notice that the data ingestion cost is higher than expected. You want to reduce costs without losing security value. Which action should you take?

Accepted Answer

Configure basic logs ingestion for verbose data sources such as firewall logs.. Basic logs are designed for high-volume, verbose data sources (e.g., firewall logs, syslog) that have lower security value. They are stored at a reduced cost and support only summary queries, not full KQL analytics. By routing verbose logs to basic logs, you reduce ingestion costs while retaining the ability to perform threat hunting and incident response on high-value analytics logs.

Answer

Reduce the retention period for all data to 30 days.

Answer

Switch the pricing tier from Capacity Reservations to Pay-as-you-go.

Answer

Disable analytics rules that generate high volume of alerts.

Question 11

Your organization uses Microsoft Defender XDR incident queue. You want to automatically assign incidents related to a specific campaign to a dedicated SOC group. What should you create?

Accepted Answer

A custom detection rule in Microsoft Defender XDR that includes an incident assignment action.. Microsoft Defender XDR allows you to create custom detection rules that can include automated incident assignment actions. This enables you to automatically assign incidents related to a specific campaign to a dedicated SOC group directly within the Defender XDR incident queue, without relying on external tools or manual processes.

Answer

A standard rule in Microsoft Defender for Endpoint.

Answer

An automation rule in Microsoft Sentinel.

Answer

A custom role in Microsoft Defender XDR.

Question 12

You are configuring Microsoft Sentinel to send email notifications to the SOC manager when a high-severity incident is created. What should you use?

Accepted Answer

Create a playbook that sends an email and assign it to an automation rule.. Automation rules in Microsoft Sentinel can trigger a playbook (an Azure Logic Apps workflow) when an incident is created. The playbook can include an action to send an email notification, enabling automated response to high-severity incidents without manual intervention.

Answer

Configure an analytics rule to send an email when an incident is created.

Answer

Use a workbook to track incidents and configure an alert for email.

Answer

Add the SOC manager's email to a watchlist and configure a scheduled query.

Question 13

Your SOC team uses Microsoft Defender XDR. You want to ensure that all incidents are automatically classified and determined by the built-in AI before any manual review. What should you configure?

Accepted Answer

Enable the incident summarization and classification feature in Microsoft Defender XDR.. Microsoft Defender XDR includes a built-in AI-driven incident summarization and classification feature that automatically assigns a classification (e.g., true positive, false positive) and determination (e.g., malicious, clean) to each incident before manual review. This feature leverages machine learning models trained on Microsoft's global threat intelligence to reduce alert fatigue and streamline SOC workflows.

Answer

Create a custom detection rule in Microsoft Defender XDR.

Answer

Enable automation rules in Microsoft Sentinel to classify incidents.

Answer

Configure a workbook in Microsoft Sentinel to analyze incidents.

Question 14

You are managing a Microsoft Sentinel environment. An analyst reports that a scheduled analytics rule is not generating alerts. The rule has been enabled for a week. What is the most likely cause?

Accepted Answer

The rule's query does not match any events in the workspace.. The most likely cause is that the rule's query does not match any events in the workspace. Since the rule has been enabled for a week, if the query logic is correct and data exists, alerts should have been generated. The absence of alerts strongly indicates that the query returns zero results, which is a common issue when the KQL query references tables, columns, or conditions that do not exist in the ingested data.

Answer

The rule is disabled due to a cost threshold.

Answer

The rule has a short lookback period that misses data.

Answer

The rule is configured as a real-time rule instead of scheduled.

Question 15

Which TWO of the following are valid methods to reduce Microsoft Sentinel data ingestion costs?

Accepted Answer

Configure basic logs for high-volume verbose data sources.. Microsoft Sentinel allows you to configure basic logs for high-volume, verbose data sources (e.g., DNS or firewall logs) to reduce costs. Basic logs are stored at a lower ingestion price and support only simple queries, making them ideal for debugging or compliance data that doesn't require advanced analytics.

Answer

Disable all analytics rules.

Answer

Switch all data sources to basic logs.

Answer

Increase the retention period for all tables.