SC-200 Manage a security operations environment Practice Test 29 — 15 Questions

Question 1

Which THREE of the following are capabilities of Microsoft Copilot for Security?

Accepted Answer

Summarize incidents from Microsoft Defender XDR.. Microsoft Copilot for Security can summarize incidents from Microsoft Defender XDR, providing a concise overview of alerts, affected assets, and attack chains. This capability leverages natural language processing to parse incident data and generate human-readable summaries, aiding analysts in rapid triage.

Answer

Manage Azure Policy assignments.

Answer

Automatically configure conditional access policies.

Question 2

Which TWO of the following are required to enable Microsoft Sentinel UEBA (User and Entity Behavior Analytics)?

Accepted Answer

Enable UEBA in the Microsoft Sentinel workspace settings.. UEBA must be explicitly enabled in the Microsoft Sentinel workspace settings under the 'Entity behavior analytics' blade. This activation allows Sentinel to start profiling user and entity behaviors using built-in machine learning models. Without this toggle, UEBA remains disabled regardless of other configurations.

Answer

Integrate Microsoft Defender for Cloud Apps.

Answer

Purchase a separate UEBA license.

Answer

Configure Azure Key Vault to store UEBA data.

Question 3

Refer to the exhibit. You have an automation rule in Microsoft Sentinel configured as shown. An analyst reports that low-severity incidents are not being closed automatically. The rule is enabled and has the highest order. What is the most likely reason?

Accepted Answer

The automation rule does not have the required permissions to modify incidents.. The automation rule requires an automation account with Microsoft Sentinel contributor permissions to run playbooks or modify incidents. Without these permissions, the rule cannot close incidents regardless of its order or enabled status. The rule being enabled and having the highest order does not override the missing permissions.

Answer

The rule is triggered by alerts, not incidents.

Answer

The rule is set to close incidents with classification 'TruePositive' but low-severity incidents are not true positives.

Answer

The rule is disabled due to a conflict with another rule.

Question 4

Refer to the exhibit. You have a Microsoft Sentinel playbook created as shown. When you test the playbook manually, it sends an email successfully. However, when an incident triggers the playbook via an automation rule, the email is not sent. What is the most likely cause?

Accepted Answer

The playbook uses an HTTP trigger instead of a Microsoft Sentinel trigger.. The exhibit shows a playbook that begins with an HTTP trigger, not a Microsoft Sentinel trigger. When an incident triggers the playbook via an automation rule, Sentinel expects the playbook to start with a Microsoft Sentinel trigger (e.g., 'When a response to a Microsoft Sentinel incident is triggered'). An HTTP trigger requires an external HTTP request to start the playbook, which the automation rule does not provide, so the playbook never executes the email action.

Answer

The playbook does not have permission to read incidents.

Answer

The email action is not configured correctly.

Answer

The Office 365 connection is not authorized.

Question 5

Your organization uses Microsoft Defender for Cloud Apps. You need to ensure that alerts from Defender for Cloud Apps are forwarded to Microsoft Sentinel. Which connector should you use in Sentinel?

Accepted Answer

Microsoft Defender for Cloud Apps connector. The Microsoft Defender for Cloud Apps connector in Microsoft Sentinel is specifically designed to ingest alerts and logs from Defender for Cloud Apps, including anomaly detection, policy violations, and threat intelligence alerts. This connector uses the Microsoft Graph API to pull data directly from the Defender for Cloud Apps service, ensuring that all relevant security alerts are forwarded to Sentinel for centralized monitoring and incident response.

Answer

Windows Security Events via AMA connector

Answer

Microsoft 365 Defender connector

Answer

Azure Activity connector

Question 6

Your organization has Microsoft Defender for Office 365. You need to review a user's reported phishing email in Microsoft Defender XDR. Which section of the Microsoft Defender portal should you check?

Accepted Answer

Submissions. The Submissions page in the Microsoft Defender portal is the dedicated section for reviewing user-reported phishing emails. It allows security operators to view, analyze, and take action on messages that users have reported as suspicious or malicious, directly integrating with Microsoft Defender for Office 365's threat intelligence pipeline.

Answer

Threat Explorer

Answer

Alerts

Answer

Action center

Question 7

You are a SOC analyst using Microsoft Sentinel. You receive an incident with high severity. You need to quickly gather additional context about the affected user account, including recent sign-in logs and role assignments. Which feature should you use?

Accepted Answer

Entity pages. Entity pages in Microsoft Sentinel provide a centralized, pre-built view of a specific entity (such as a user account), aggregating related alerts, incidents, and data from connected sources like Microsoft Entra ID sign-in logs and role assignments. This allows a SOC analyst to quickly gather contextual information without manually querying multiple data sources, making it the ideal feature for high-severity incidents requiring rapid investigation.

Answer

Sentinel Workbooks

Answer

Analytics rules

Answer

Hunting queries

Question 8

Your organization uses Microsoft Defender for Identity (MDI) and Microsoft Sentinel. You notice that MDI alerts are not appearing in Sentinel. You have already installed the MDI data connector and configured the workspace. What is the most likely cause?

Accepted Answer

The data connector is not enabled, even though it is installed. The most likely cause is that the MDI data connector, although installed, is not enabled. In Microsoft Sentinel, installing a data connector only makes it available; you must explicitly enable it to start ingesting data. Without enabling the connector, alerts from Microsoft Defender for Identity will not flow into Sentinel, even if the workspace is correctly configured.

Answer

The workspace is in a different region than MDI

Answer

The Microsoft 365 Defender connector is not installed

Answer

Microsoft Defender for Identity is not licensed

Question 9

You are designing a Microsoft Sentinel deployment. You need to minimize ingestion costs while ensuring that all security-relevant events are collected. Which strategy should you use?

Accepted Answer

Use Basic Logs for verbose data sources like Windows firewall logs, and Analytic Logs for high-value security logs. Microsoft Sentinel offers two log plan tiers: Analytic Logs (full KQL, alerts, workbooks) and Basic Logs (cheaper ingestion, limited query, 30-day retention). Placing high-volume, low-value sources like Windows firewall logs in Basic Logs and reserving Analytic Logs for high-value security events minimizes cost while still collecting all relevant data. This is the documented cost-optimization pattern.

Answer

Use Analytic Logs for all data sources to ensure full query capabilities

Answer

Set short retention periods for all logs and export to storage

Answer

Collect only logs from Microsoft 365 Defender and ignore other sources

Question 10

Your SOC uses Microsoft Defender XDR. You need to create a custom detection rule that triggers when a specific process is executed on multiple devices within an hour. Which feature should you use?

Accepted Answer

Microsoft Defender XDR custom detection rule. Microsoft Defender XDR custom detection rules are built on top of Advanced Hunting and allow you to define conditions that trigger an alert when a specific process is executed across multiple devices within a defined time window (e.g., one hour). This feature is native to Defender XDR and does not require a separate SIEM like Sentinel, making it the correct choice for creating a detection rule that operates within the Defender XDR environment.

Answer

Advanced hunting query

Answer

Microsoft Sentinel scheduled analytics rule

Answer

Attack simulation training

Question 11

Which TWO actions can you perform in the Microsoft Defender XDR unified alert queue? (Select TWO.)

Accepted Answer

Link the alert to an existing incident. In the Microsoft Defender XDR unified alert queue, you can link an alert to an existing incident to consolidate related alerts into a single investigation. This action is supported directly from the alert queue interface, allowing analysts to manage incident correlation without leaving the queue. Linking alerts helps reduce alert fatigue and streamlines the incident management workflow.

Answer

Create a hunting query from the alert details

Answer

Edit the analytics rule that generated the alert

Answer

Run a playbook to automatically remediate the alert

Question 12

Which THREE components are part of the Microsoft Sentinel SOAR capabilities? (Select THREE.)

Accepted Answer

Connectors. Connectors are part of Microsoft Sentinel's SOAR capabilities because they enable the ingestion of security alerts and events from various sources, which is the foundational step for triggering automated responses. Without connectors, Sentinel cannot receive the data needed to initiate playbooks or automation rules, making them an essential component of the SOAR workflow.

Answer

Workbooks

Answer

Analytics rules

Question 13

Which TWO are valid methods to ingest logs into Microsoft Sentinel from a non-Azure virtual machine? (Select TWO.)

Accepted Answer

Azure Monitor Agent (AMA) with Azure Arc. Azure Arc bridges non-Azure VMs into Azure's management plane, allowing the Azure Monitor Agent (AMA) to be installed and managed as if the VM were native Azure. This enables log ingestion into Microsoft Sentinel without requiring direct Azure connectivity or a VPN, using the same AMA data collection rules (DCRs) as Azure VMs.

Answer

Microsoft Sentinel agent (standalone)

Answer

Azure Monitor Agent (AMA) without Azure Arc

Answer

Log Analytics agent (OMS) – deprecated

Question 14

Refer to the exhibit. You are viewing an incident in Microsoft Sentinel via the API. The incident is missing an owner. Which automation rule action would assign this incident to the SOC manager?

Accepted Answer

Assign incident to: SOC Manager. The 'Assign incident to' action in Microsoft Sentinel automation rules directly changes the incident's owner property. By selecting 'SOC Manager' as the value, the rule sets the incident's owner field to that specific user or group, which is the exact requirement to resolve the missing owner.

Answer

Change incident status to: Active

Answer

Run playbook (SimplePlaybook)

Answer

Add tags: ["Malware", "Endpoint"]

Question 15

Refer to the exhibit. You are reviewing a KQL query used in a Microsoft Sentinel scheduled analytics rule. What is the primary purpose of this query?

Accepted Answer

To detect accounts that have triggered a high number of suspicious process alerts within 7 days. The query uses `summarize` with `dcount(EventID)` to count distinct process creation events per account, then filters for accounts with a count greater than 10 using `where EventCount > 10`. The `where TimeGenerated > ago(7d)` restricts the time window to the last 7 days. This pattern is designed to detect accounts that have triggered a high number of suspicious process alerts (EventID 4688) within a week, making D correct.

Answer

To investigate a new type of attack pattern

Answer

To identify which accounts are associated with the most incidents

Answer

To find accounts that have generated false positive alerts