SC-200 Manage a security operations environment Practice Test 3 — 15 Questions

Question 1

Your organization uses Microsoft Sentinel with UEBA enabled. You notice that the UEBA entity pages are not showing any insights for Azure resources. What is the most likely cause?

Accepted Answer

The resource context data is not being ingested from Azure Resource Manager.. UEBA entity pages for Azure resources rely on resource context data, which includes metadata about Azure resources such as virtual machines, storage accounts, and their activities. This data is ingested from Azure Resource Manager (ARM) via the Azure Activity data connector. If the resource context data is not being ingested, UEBA cannot correlate activities to specific Azure resources, resulting in no insights on entity pages. Option D correctly identifies this missing data source as the root cause.

Answer

UEBA is not enabled for the workspace.

Answer

The user accounts are not synchronized with Microsoft Entra ID.

Answer

The Azure Activity data connector is not configured.

Question 2

You need to grant a junior analyst the ability to view and investigate incidents in Microsoft Sentinel, but not make any changes. Which built-in role should you assign?

Accepted Answer

Microsoft Sentinel Reader. The Microsoft Sentinel Reader role provides read-only access to Sentinel resources, including incidents, workbooks, and analytics rules, without allowing any modifications. This aligns with the requirement to view and investigate incidents without making changes, as the role explicitly denies write, delete, or action permissions on Sentinel data.

Answer

Microsoft Sentinel Responder

Answer

Microsoft Sentinel Contributor

Answer

Microsoft Sentinel Automation Contributor

Question 3

Your SOC team uses Microsoft Sentinel analytics rules. You need to ensure that a scheduled rule runs every hour, but only during business hours (8 AM to 6 PM). What configuration should you use?

Accepted Answer

Create two rules: one that runs every hour during business hours and another that runs but suppresses alerts outside business hours.. Microsoft Sentinel scheduled analytics rules do not natively support time-based scheduling restrictions like 'only during business hours'. The recommended workaround is to create two separate rules: one that runs every hour during business hours to generate alerts, and another that runs every hour outside business hours but is configured to suppress alerts (e.g., by setting a low severity or using a suppression query). This ensures detection logic runs continuously while avoiding alert fatigue outside the desired window.

Answer

Use a custom log with a logic app to only trigger the rule during business hours.

Answer

Configure the rule to run continuously with an alert threshold of 0.

Answer

Set the rule to run every hour and use a KQL query to filter events outside business hours.

Question 4

Your organization uses Microsoft Defender for Endpoint. You need to configure a device group that automatically assigns devices to the group based on their domain membership. Devices joined to 'contoso.com' should be in the 'Corporate' group, and all others in 'Non-Corporate'. What should you use?

Accepted Answer

Create a device group with a rule using the device tag 'Contoso' and assign tags via GPO.. Microsoft Defender for Endpoint device groups can use device tags to automatically assign devices based on domain membership. By creating a device group with a rule that matches the device tag 'Contoso' and assigning that tag to domain-joined machines via Group Policy Object (GPO), you ensure that devices joined to 'contoso.com' are placed in the 'Corporate' group, while all others fall into the default 'Non-Corporate' group.

Answer

Use a custom detection rule to move devices based on risk level.

Answer

Create two device groups and manually move devices.

Answer

Create a device group with a rule using the domain field 'contoso.com'.

Question 5

You need to ensure that Microsoft Sentinel can access threat intelligence feeds from external sources like AlienVault OTX. Which data connector should you use?

Accepted Answer

Threat Intelligence - TAXII data connector. The Threat Intelligence - TAXII data connector is the correct choice because it enables Microsoft Sentinel to ingest threat intelligence feeds from external sources that support the TAXII (Trusted Automated eXchange of Indicator Information) protocol, such as AlienVault OTX. This connector uses the STIX (Structured Threat Information Expression) standard to pull indicators of compromise (IOCs) like IP addresses, domains, and hashes directly into Sentinel for correlation and alerting.

Answer

Microsoft 365 Defender data connector

Answer

Microsoft Entra ID data connector

Answer

Amazon Web Services data connector

Question 6

Which TWO of the following are valid ways to automate incident response in Microsoft Sentinel?

Accepted Answer

Create a playbook using Azure Logic Apps.. Azure Logic Apps is the native workflow engine for Microsoft Sentinel playbooks, allowing security analysts to automate incident response actions such as blocking IPs, resetting passwords, or enriching alerts. Playbooks are triggered by automation rules or directly from incidents, and they leverage hundreds of connectors to integrate with external systems. This is the primary and recommended method for building automated response workflows in Sentinel.

Answer

Use Azure Functions to run a script.

Answer

Use PowerShell to modify incidents via API.

Answer

Use Microsoft Power Automate to create a flow.

Question 7

Which TWO of the following are required to enable user and entity behavior analytics (UEBA) in Microsoft Sentinel?

Accepted Answer

Windows Security Events via AMA must be ingested.. Windows Security Events ingested via the Azure Monitor Agent (AMA) provide the necessary user and entity activity data (e.g., logon events, process creation) that UEBA analyzes to establish behavioral baselines and detect anomalies. Without this data source, UEBA lacks the raw security events required for user and entity profiling.

Answer

Microsoft Entra ID diagnostic logs must be streamed.

Answer

Azure subscription diagnostic logs must be enabled.

Answer

Microsoft Defender XDR connector must be configured.

Question 8

Which TWO of the following are valid methods to reduce the cost of Microsoft Sentinel data ingestion?

Accepted Answer

Configure Basic logs for high-volume, low-value data sources.. A is correct because Basic logs offer a lower ingestion cost (approximately 25% of the cost of Analytics logs) for high-volume, low-value data sources such as verbose firewall logs or debug events. By routing these logs to the Basic log table tier, you reduce the per-GB ingestion charge while still retaining the data for security investigations when needed. C is correct because setting a daily ingestion cap on the Log Analytics workspace prevents ingestion beyond a specified limit, thereby controlling costs. B is incorrect because using analytics rules with efficient KQL queries only reduces false positives in alerts, but does not reduce the volume of data ingested; ingestion cost is based on data volume, not alert volume. D is incorrect because enabling Sentinel on premium storage accounts does not reduce ingestion costs; it may increase costs. E is incorrect because increasing the data retention period increases storage costs, not ingestion costs.

Answer

Use analytics rules with efficient KQL queries to reduce false positives.

Answer

Enable Sentinel on premium storage accounts.

Answer

Increase the data retention period to 90 days.

Question 9

Your security operations team receives an alert from Microsoft Sentinel about a suspicious sign-in from an unfamiliar IP address. You need to investigate the alert by correlating it with user activity and device information. Which data sources should you query first?

Accepted Answer

Microsoft Entra ID sign-in logs and Microsoft Defender for Endpoint device events. Investigating a suspicious sign-in requires correlating the sign-in event with user activity and device context. Microsoft Entra ID sign-in logs provide the authentication details (IP address, timestamp, user), while Microsoft Defender for Endpoint device events supply device-level telemetry (processes, network connections, logged-on users). This combination directly enables the correlation needed to validate whether the sign-in was legitimate or malicious.

Answer

Microsoft Purview audit logs and Microsoft Intune device compliance

Answer

Microsoft 365 Defender alerts and Microsoft Sentinel incidents

Answer

Azure Activity Logs and Azure Firewall logs

Question 10

You are configuring Microsoft Sentinel to detect potential ransomware activity. The security team wants to be alerted when a single host contacts multiple suspicious domains within a short time. Which analytic rule type should you create?

Accepted Answer

NRT (Near-Real-Time) rule. A NRT (Near-Real-Time) rule is the correct choice because it continuously processes events with a minimum latency of about 1 minute, making it ideal for detecting patterns like a single host contacting multiple suspicious domains within a short time window. Unlike scheduled rules that run on a fixed interval (e.g., every 5 minutes), NRT rules evaluate data as it arrives, enabling rapid detection of multi-event sequences such as DNS queries to known malicious domains.

Answer

Scheduled query rule

Answer

Anomaly rule

Answer

Microsoft security rule

Question 11

Your organization uses Microsoft Defender XDR and Microsoft Sentinel. You need to create a custom detection rule that triggers when a user is added to a privileged role in Microsoft Entra ID and within 5 minutes performs a mass download from SharePoint. Which approach should you use?

Accepted Answer

Create a scheduled query rule in Microsoft Sentinel. The detection requires correlating events across Microsoft Entra ID (privileged role assignment) and SharePoint (mass download) within a 5-minute window. Microsoft Sentinel's scheduled query rules can ingest data from multiple sources (e.g., AuditLogs for Entra ID and SharePoint via Office 365 connector) and use KQL to join these events with a time constraint, making it the only native solution for cross-domain, time-bound custom detections.

Answer

Create an advanced hunting query in Microsoft Defender XDR

Answer

Use a custom detection rule in Microsoft 365 Defender

Answer

Use a Microsoft Purview insider risk policy

Question 12

Your security team uses Microsoft Sentinel automation rules to respond to incidents. You need to ensure that critical incidents are automatically assigned to a senior analyst in the Americas time zone and that a Teams message is sent to a specific channel. Which configuration should you use?

Accepted Answer

Create a playbook that assigns the incident and sends a Teams message, then attach it to a automation rule. Automation rules in Microsoft Sentinel can trigger a playbook when an incident is created or updated. By creating a playbook that assigns the incident to a specific senior analyst (using Microsoft Entra ID or a watchlist for mapping) and sends a Teams message via the Teams connector, then attaching that playbook to an automation rule with conditions for critical severity, you meet both requirements. This approach leverages native Sentinel automation without custom connectors or manual email triggers.

Answer

Use a watchlist to map critical incidents to senior analysts and trigger an email

Answer

Configure the analytics rule to set the incident owner and add a playbook action

Answer

Create a custom connector in Power Automate to monitor Sentinel incidents

Question 13

You are a security operations analyst. You need to review all incidents from the past 24 hours that have a high severity and involve multiple users. In Microsoft Sentinel, which blade should you use?

Accepted Answer

Incidents. The Incidents blade in Microsoft Sentinel is the correct place to review all security incidents, including filtering by severity and the number of users involved. It provides a centralized view where you can apply filters for 'High' severity and 'Multiple users' to meet the requirement of reviewing incidents from the past 24 hours. The Hunting, Workbooks, and Analytics blades serve different purposes and do not offer the same incident review and filtering capabilities.

Answer

Hunting

Answer

Workbooks

Answer

Analytics

Question 14

Your organization uses Microsoft Sentinel with UEBA enabled. You notice that the UEBA entity pages are not showing any insights for Azure resources. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable incident across workspaces in Microsoft Sentinel. Microsoft Sentinel's 'Incident across workspaces' feature (enabled via the 'SecurityIncident' table union) provides a single incident view across multiple workspaces with minimal latency by leveraging built-in cross-workspace incident synchronization. This avoids the overhead of manual queries or external orchestration, ensuring near-real-time incident correlation for a central SOC.

Answer

Use cross-workspace queries in a workbook

Answer

Merge all workspaces into one Log Analytics workspace

Answer

Set up Azure Lighthouse and connect workspaces

Question 15

As a SOC analyst, you need to quickly identify if a specific user account has been involved in any incidents in the past week. Which feature in Microsoft Sentinel allows you to search for user-related incidents?

Accepted Answer

Entity behavior blade. The Entity behavior blade in Microsoft Sentinel provides a user-centric view that aggregates all incidents, alerts, and activities associated with a specific user account. By selecting a user entity and navigating to the 'Incidents' tab within the blade, you can quickly filter incidents involving that user over a defined time range, such as the past week. This feature is designed specifically for investigating user-related security events without needing to write custom queries.

Answer

Incidents blade with time range filter

Answer

Hunting blade with user query

Answer

Workbooks with KQL query