SC-200 Manage a security operations environment Practice Test 29 — 15 Questions

Question 1

You are reviewing a PowerShell script used for automated response on a Windows 10 device managed by Microsoft Defender for Endpoint. What is the intended outcome of this script?

Accepted Answer

It triggers a quick scan if any Trojan detection exists.. The script checks for Trojan detections using Get-MpThreat with a threat category filter for Trojans. If any Trojan is found, it triggers Start-MpScan -ScanType QuickScan to perform a quick scan. This matches option C exactly.

Answer

It removes all Trojan threats from the device.

Answer

It updates the antimalware signatures and then performs a scan.

Answer

It configures Windows Defender to exclude Trojan files.

Question 2

You are a security operations analyst at a company that uses Microsoft Sentinel. You need to ensure that all incidents generated from Microsoft Defender for Cloud Apps are automatically assigned to the same SOC team. The team uses Microsoft Teams to collaborate. Which configuration should you implement?

Accepted Answer

Create an automation rule that sets the owner to the team entity.. Automation rules in Microsoft Sentinel can directly set the incident owner to a specific user or group (such as a SOC team) without requiring a playbook. This ensures all incidents from Microsoft Defender for Cloud Apps are automatically assigned to the designated team, streamlining ownership and collaboration via Microsoft Teams.

Answer

Create a playbook that assigns the incident to the team and configure an automation rule to run it.

Answer

Configure the Microsoft Defender for Cloud Apps connector to assign incidents to the team.

Answer

Use a logic app to automatically post incidents to a Teams channel and have the team claim them.

Question 3

Your organization uses Microsoft Defender XDR. You need to ensure that when a user reports a phishing email using the built-in Outlook add-in, the incident is automatically created in Microsoft Sentinel with high severity and a custom tag 'Phishing-Reported'. What is the most efficient way to achieve this?

Accepted Answer

Configure the 'User-reported phishing' policy in Microsoft Defender XDR to create an incident in Microsoft Sentinel with high severity and the tag.. The 'User-reported phishing' policy in Microsoft Defender XDR can be configured to automatically create an incident in Microsoft Sentinel with a specified severity and custom tags. This policy directly processes user-reported phishing emails from the built-in Outlook add-in and integrates natively with Sentinel via the Microsoft Defender XDR connector, making it the most efficient method without requiring additional automation or custom code.

Answer

Set up an automation rule in Microsoft Sentinel to tag incidents from 'Microsoft Defender' connector with the tag when severity is high.

Answer

Create a Power Automate flow that reads from the unified audit log and creates a Sentinel incident via API.

Answer

Use a playbook triggered by a Microsoft Sentinel analytics rule that monitors for 'PhishDeliver' events.

Question 4

Your team uses Microsoft Sentinel to monitor multiple Azure subscriptions. You need to grant a junior analyst the ability to view incidents and run playbooks, but not modify analytics rules or data connectors. Which built-in role should you assign?

Accepted Answer

Microsoft Sentinel Responder. Microsoft Sentinel Responder is the correct built-in role because it grants the junior analyst the ability to view incidents and run playbooks, while explicitly preventing modifications to analytics rules or data connectors. This role provides the exact permissions needed for incident response tasks without allowing changes to the security configuration.

Answer

Microsoft Sentinel Contributor

Answer

Automation Contributor

Answer

Microsoft Sentinel Reader

Question 5

You are configuring Microsoft Sentinel to ingest logs from a third-party firewall via Syslog. After configuring the data connector, you notice that no logs are appearing. You verify that the firewall is sending logs to the Syslog collector. What is the most likely cause?

Accepted Answer

The syslog daemon on the collector is not configured to forward logs to the Log Analytics workspace.. The most common reason logs fail to appear in Microsoft Sentinel after configuring a Syslog data connector is that the Syslog daemon (e.g., rsyslog or syslog-ng) on the collector VM is not configured to forward logs to the Log Analytics workspace. Even if the firewall sends logs to the collector, the Azure Monitor Agent (AMA) or legacy Log Analytics agent relies on the local Syslog daemon to listen on UDP port 514 (or TCP 6514) and forward those events to the agent, which then sends them to the workspace. Without proper daemon configuration (e.g., adding rules in /etc/rsyslog.d/ to forward facility/severity levels), the agent never receives the logs.

Answer

The firewall is sending logs in a format incompatible with the Azure Monitor Agent.

Answer

The ingestion cost is too high and Sentinel throttled the connection.

Answer

The data connector is disabled in the Log Analytics workspace.

Question 6

Your organization uses Microsoft Defender for Cloud to assess security posture. You need to ensure that any new Azure subscription automatically has Microsoft Defender for Cloud enabled with the 'Defender for Cloud (CSPM)' plan active. What should you do?

Accepted Answer

Assign a built-in Azure Policy initiative that deploys Microsoft Defender for Cloud configuration to subscriptions.. Azure Policy can enforce compliance at scale by assigning the built-in initiative 'Deploy Microsoft Defender for Cloud configuration' to a management group or subscription. This initiative includes policies that automatically enable Microsoft Defender for Cloud and activate the 'Defender for Cloud (CSPM)' plan on new subscriptions, ensuring consistent security posture without manual intervention.

Answer

Create an automation account that runs a PowerShell script daily to check and enable Defender for Cloud.

Answer

Configure Azure Arc to enforce the plan on new subscriptions.

Answer

Use Microsoft Sentinel's 'Subscription Migration' playbook.

Question 7

Your SOC team uses Microsoft Sentinel to manage incidents. You want to categorize incidents based on the MITRE ATT&CK technique. You notice that some incidents are not being tagged with the correct technique. What should you check first?

Accepted Answer

The analytics rule that generated the incident has the correct MITRE ATT&CK technique selected.. The MITRE ATT&CK technique tag on an incident is determined by the analytics rule that generated the incident. If the rule does not have the correct technique selected, the incident will not be tagged correctly. Therefore, the first thing to check is the analytics rule configuration (option D). Option A is incorrect because playbooks are used for automation and can modify tags after creation, but they are not the root cause if the technique was never set. Option B is incorrect because incident creation rules (automation rules) control incident creation and assignment, not the technique mapping. Option C is incorrect because data connectors ingest raw data and fields, but the technique mapping is done at the analytics rule level, not by the connector.

Answer

The playbook assigned to the incident is overriding the technique tag.

Answer

The incident creation rule in the automation section is misconfigured.

Answer

The data connector for the source service is not ingesting the required fields.

Question 8

Your organization uses Microsoft Purview Data Loss Prevention (DLP) policies. You need to investigate an incident where sensitive data was shared externally. You want to view the details in Microsoft Sentinel. What should you ensure is configured?

Accepted Answer

The Microsoft 365 data connector in Microsoft Sentinel is enabled and configured to collect DLP alerts.. Microsoft Sentinel's Microsoft 365 data connector ingests unified audit logs from Microsoft Purview, including DLP alerts. When this connector is enabled and configured to collect DLP alerts, Sentinel can receive and surface the incident details, allowing investigation of externally shared sensitive data. Without this connector, DLP events remain in the Purview compliance portal and are not forwarded to Sentinel.

Answer

The SharePoint site is configured for external sharing.

Answer

The DLP policy must be set to 'Audit only' mode.

Answer

The unified audit log is enabled and the DLP events are being generated.

Question 9

You are configuring a Microsoft Sentinel analytics rule to detect brute-force attacks on your Azure Virtual Machines. The rule uses the 'SecurityEvent' table. You notice that the rule is not generating incidents even though you see failed logon events in the logs. What should you check?

Accepted Answer

The analytics rule is enabled and the query is correctly filtering for event ID 4625.. The most immediate reason a rule fails to generate incidents despite seeing failed logon events is that the rule itself is either disabled or its query does not correctly filter for event ID 4625, which is the specific Windows security event ID for failed logon attempts. Even if logs are present, the analytics rule must be enabled and its KQL query must accurately target the right event ID to trigger an incident. Without this, the rule will not process the events into alerts.

Answer

An automation rule is suppressing incidents with the same name.

Answer

The workspace retention period is set to less than 90 days.

Answer

The Log Analytics agent is not installed on the VMs.

Question 10

Which TWO of the following are valid methods to ingest custom logs into Microsoft Sentinel? (Choose two.)

Accepted Answer

Use the Azure Monitor Agent to collect custom logs via data collection rules.. The Azure Monitor Agent (AMA) can collect custom logs from text files on Windows and Linux machines by defining a data collection rule (DCR) that specifies the file path and parsing logic. This is the modern, recommended method for custom log ingestion into Log Analytics workspaces, which underpin Microsoft Sentinel.

Answer

Use Windows Event Forwarding to send custom logs to Sentinel.

Answer

Use the Application Insights connector to ingest custom logs.

Answer

Configure the syslog daemon to forward custom application logs.

Question 11

Which THREE of the following are capabilities of Microsoft Defender XDR's automated investigation and response (AIR) that can be enabled or configured by a security operations analyst? (Choose three.)

Accepted Answer

Automatically block an email message or attachment.. Microsoft Defender XDR's automated investigation and response (AIR) allows security operations analysts to configure automatic actions such as blocking an email message or attachment. This is a core capability of AIR, which uses playbooks to automatically remediate threats by applying actions like soft-delete or quarantine to malicious emails or attachments based on investigation results.

Answer

Automatically modify Data Loss Prevention policies.

Answer

Automatically create new analytics rules based on incident patterns.

Question 12

Which TWO of the following are required to enable Microsoft Sentinel to receive alerts from Microsoft Defender for Cloud? (Choose two.)

Accepted Answer

Install the 'Microsoft Defender for Cloud' data connector in Microsoft Sentinel.. The 'Microsoft Defender for Cloud' data connector in Microsoft Sentinel is the specific integration point that ingests security alerts from Defender for Cloud into Sentinel. Without installing and configuring this connector, Sentinel cannot receive the alerts, even if Defender for Cloud is enabled on the subscription.

Answer

Deploy the Log Analytics agent on all VMs.

Answer

Connect a non-Azure machine using Azure Arc.

Answer

Assign an Azure Policy to enable Defender for Cloud.

Question 13

A security analyst receives a high-severity incident in Microsoft Sentinel for a user who is suspected of lateral movement. The analyst wants to automatically run a playbook that isolates the user's machine and disables their account when such an incident is created. What is the most efficient way to achieve this?

Accepted Answer

Create an automation rule that triggers the playbook when the incident is created. Automation rules in Microsoft Sentinel are designed to trigger playbooks automatically when an incident is created, based on conditions like severity or rule name. This provides the most efficient, event-driven response without polling or manual intervention, directly addressing the requirement to isolate the machine and disable the account upon incident creation.

Answer

Configure a Logic Apps trigger to poll for new incidents every minute

Answer

Train analysts to manually run the playbook when they see the incident

Answer

Create an analytics rule that runs a playbook as part of its alert generation

Question 14

Your company is deploying Microsoft Defender for Endpoint. You need to ensure that all devices report their security baseline compliance to Microsoft Intune. Which configuration should you use?

Accepted Answer

Assign a Security Baseline policy in Microsoft Intune to the device groups. Security Baseline policies in Microsoft Intune define a set of pre-configured security settings recommended by Microsoft to harden devices. When assigned to device groups, these policies automatically evaluate and report compliance status for each device, ensuring all devices meet the required security baseline. This directly fulfills the requirement to report security baseline compliance to Intune.

Answer

Configure a device configuration profile in Microsoft Intune

Answer

Deploy Windows Update for Business reports

Answer

Enable Microsoft Defender for Cloud Apps session controls

Question 15

You manage a Microsoft Sentinel workspace with multiple analytics rules. You notice that an analytics rule has not generated any alerts in the past month despite relevant data being ingested. The rule uses a custom KQL query that joins two tables. What is the most likely cause?

Accepted Answer

The join condition in the KQL query is incorrect, resulting in no matching records. The most likely cause is an incorrect join condition in the KQL query. When a custom analytics rule uses a JOIN operation between two tables, if the join keys or conditions do not match any records in the ingested data, the query returns zero results, and no alerts are generated. Since the question states that relevant data is being ingested, the issue is not with data availability but with the query logic itself.

Answer

The rule is using an unsupported KQL function

Answer

The data connector for the tables is disabled

Answer

The rule is running on a schedule of 5 minutes but the data arrives every hour