SC-200 Manage a security operations environment Practice Test 3 — 15 Questions

Question 1

Your SOC team uses Microsoft Sentinel with multiple workspaces across regions. You need to implement a solution that allows analysts to query all workspaces from a single location without moving data. Which feature should you configure?

Accepted Answer

Use cross-workspace queries with workspace() expressions in KQL.. Option A is correct because cross-workspace queries using the `workspace()` expression in KQL allow analysts to query multiple Log Analytics workspaces from a single query context without moving or centralizing the data. This is the native Microsoft Sentinel feature designed for multi-workspace environments, enabling seamless querying across regions while keeping data in its original workspace.

Answer

Export data to Azure Data Explorer and query there.

Answer

Create a single Log Analytics workspace and have all data sources send logs there.

Answer

Configure Azure Lighthouse to manage all workspaces.

Question 2

Your organization uses Microsoft Defender for Cloud with enhanced security features enabled. You need to ensure that all Azure subscriptions are covered by a single Defender for Cloud policy that enforces specific security standards. The policy must be automatically applied to new subscriptions. What should you do?

Accepted Answer

Create a custom policy initiative and assign it to the root management group.. Assigning a custom policy initiative to the root management group ensures that the policy is inherited by all subscriptions under that management group, including new subscriptions as they are added. This approach enforces consistent security standards across the entire Azure environment without requiring manual intervention for each subscription.

Answer

Enable the default Defender for Cloud policy from the Azure portal.

Answer

Manually assign the policy to each subscription using PowerShell.

Answer

Configure the security contact email for each subscription.

Question 3

You are configuring Microsoft Sentinel SOAR capabilities. You need to create an automated response that, when a critical incident is created, triggers a playbook that sends a message to a Teams channel. Which connector should you use in the playbook?

Accepted Answer

Microsoft Teams connector. The Microsoft Teams connector is the correct choice because it enables the playbook to post messages directly to a Teams channel via an HTTP trigger and the Teams webhook action. This connector is specifically designed for sending notifications and messages to Teams, which aligns with the requirement to alert a channel when a critical incident is created.

Answer

Microsoft Exchange connector

Answer

Azure DevOps connector

Answer

Microsoft Entra ID connector

Question 4

Your organization uses Microsoft Defender XDR. You need to configure automatic attack disruption for identity-related threats. The solution should automatically contain a compromised user by disabling their account. Which setting should you enable?

Accepted Answer

Enable automatic attack disruption in the Microsoft Defender XDR settings.. Option B is correct because Microsoft Defender XDR's automatic attack disruption feature is specifically designed to contain identity-related threats by automatically disabling compromised user accounts. This setting, found in the Microsoft Defender XDR settings under 'Automated investigation and response', triggers when high-confidence identity attacks (e.g., password spray, lateral movement) are detected, without requiring manual intervention or additional infrastructure.

Answer

Configure Conditional Access policies to block the user.

Answer

Use Microsoft Sentinel automation rules to disable the user.

Answer

Create a custom detection rule to alert on suspicious sign-ins.

Question 5

Your organization uses Microsoft Sentinel with UEBA enabled. You notice that the UEBA entity pages are not showing any insights for Azure resources. What is the most likely cause?

Accepted Answer

The resource context data is not being ingested from Azure Resource Manager.. UEBA entity pages for Azure resources rely on resource context data, which includes metadata about Azure resources such as virtual machines, storage accounts, and their activities. This data is ingested from Azure Resource Manager (ARM) via the Azure Activity data connector. If the resource context data is not being ingested, UEBA cannot correlate activities to specific Azure resources, resulting in no insights on entity pages. Option D correctly identifies this missing data source as the root cause.

Answer

UEBA is not enabled for the workspace.

Answer

The user accounts are not synchronized with Microsoft Entra ID.

Answer

The Azure Activity data connector is not configured.

Question 6

You need to grant a junior analyst the ability to view and investigate incidents in Microsoft Sentinel, but not make any changes. Which built-in role should you assign?

Accepted Answer

Microsoft Sentinel Reader. The Microsoft Sentinel Reader role provides read-only access to Sentinel resources, including incidents, workbooks, and analytics rules, without allowing any modifications. This aligns with the requirement to view and investigate incidents without making changes, as the role explicitly denies write, delete, or action permissions on Sentinel data.

Answer

Microsoft Sentinel Responder

Answer

Microsoft Sentinel Contributor

Answer

Microsoft Sentinel Automation Contributor

Question 7

Your SOC team uses Microsoft Sentinel analytics rules. You need to ensure that a scheduled rule runs every hour, but only during business hours (8 AM to 6 PM). What configuration should you use?

Accepted Answer

Create two rules: one that runs every hour during business hours and another that runs but suppresses alerts outside business hours.. Option C is correct because Microsoft Sentinel scheduled analytics rules do not natively support time-based scheduling restrictions like 'only during business hours'. The recommended workaround is to create two separate rules: one that runs every hour during business hours to generate alerts, and another that runs every hour outside business hours but is configured to suppress alerts (e.g., by setting a low severity or using a suppression query). This ensures detection logic runs continuously while avoiding alert fatigue outside the desired window.

Answer

Use a custom log with a logic app to only trigger the rule during business hours.

Answer

Configure the rule to run continuously with an alert threshold of 0.

Answer

Set the rule to run every hour and use a KQL query to filter events outside business hours.

Question 8

Your organization uses Microsoft Defender for Endpoint. You need to configure a device group that automatically assigns devices to the group based on their domain membership. Devices joined to 'contoso.com' should be in the 'Corporate' group, and all others in 'Non-Corporate'. What should you use?

Accepted Answer

Create a device group with a rule using the device tag 'Contoso' and assign tags via GPO.. Option B is correct because Microsoft Defender for Endpoint device groups can use device tags to automatically assign devices based on domain membership. By creating a device group with a rule that matches the device tag 'Contoso' and assigning that tag to domain-joined machines via Group Policy Object (GPO), you ensure that devices joined to 'contoso.com' are placed in the 'Corporate' group, while all others fall into the default 'Non-Corporate' group.

Answer

Use a custom detection rule to move devices based on risk level.

Answer

Create two device groups and manually move devices.

Answer

Create a device group with a rule using the domain field 'contoso.com'.

Question 9

You need to ensure that Microsoft Sentinel can access threat intelligence feeds from external sources like AlienVault OTX. Which data connector should you use?

Accepted Answer

Threat Intelligence - TAXII data connector. The Threat Intelligence - TAXII data connector is the correct choice because it enables Microsoft Sentinel to ingest threat intelligence feeds from external sources that support the TAXII (Trusted Automated eXchange of Indicator Information) protocol, such as AlienVault OTX. This connector uses the STIX (Structured Threat Information Expression) standard to pull indicators of compromise (IOCs) like IP addresses, domains, and hashes directly into Sentinel for correlation and alerting.

Answer

Microsoft 365 Defender data connector

Answer

Microsoft Entra ID data connector

Answer

Amazon Web Services data connector

Question 10

Which TWO of the following are valid ways to automate incident response in Microsoft Sentinel?

Accepted Answer

Create a playbook using Azure Logic Apps.. Option A is correct because Azure Logic Apps is the native workflow engine for Microsoft Sentinel playbooks, allowing security analysts to automate incident response actions such as blocking IPs, resetting passwords, or enriching alerts. Playbooks are triggered by automation rules or directly from incidents, and they leverage hundreds of connectors to integrate with external systems. This is the primary and recommended method for building automated response workflows in Sentinel.

Answer

Use Azure Functions to run a script.

Answer

Use PowerShell to modify incidents via API.

Answer

Use Microsoft Power Automate to create a flow.

Question 11

Which TWO of the following are required to enable user and entity behavior analytics (UEBA) in Microsoft Sentinel?

Accepted Answer

Windows Security Events via AMA must be ingested.. Option C is correct because Windows Security Events ingested via the Azure Monitor Agent (AMA) provide the necessary user and entity activity data (e.g., logon events, process creation) that UEBA analyzes to establish behavioral baselines and detect anomalies. Without this data source, UEBA lacks the raw security events required for user and entity profiling.

Answer

Microsoft Entra ID diagnostic logs must be streamed.

Answer

Azure subscription diagnostic logs must be enabled.

Answer

Microsoft Defender XDR connector must be configured.

Question 12

Which THREE of the following are valid methods to reduce the cost of Microsoft Sentinel data ingestion?

Accepted Answer

Configure Basic logs for high-volume, low-value data sources.. A is correct because Basic logs offer a lower ingestion cost (approximately 25% of the cost of Analytics logs) for high-volume, low-value data sources such as verbose firewall logs or debug events. By routing these logs to the Basic log table tier, you reduce the per-GB ingestion charge while still retaining the data for security investigations when needed.

Answer

Enable Sentinel on premium storage accounts.

Answer

Increase the data retention period to 90 days.

Question 13

Your security operations team receives an alert from Microsoft Sentinel about a suspicious sign-in from an unfamiliar IP address. You need to investigate the alert by correlating it with user activity and device information. Which data sources should you query first?

Accepted Answer

Microsoft Entra ID sign-in logs and Microsoft Defender for Endpoint device events. Option C is correct because investigating a suspicious sign-in requires correlating the sign-in event with user activity and device context. Microsoft Entra ID sign-in logs provide the authentication details (IP address, timestamp, user), while Microsoft Defender for Endpoint device events supply device-level telemetry (processes, network connections, logged-on users). This combination directly enables the correlation needed to validate whether the sign-in was legitimate or malicious.

Answer

Microsoft Purview audit logs and Microsoft Intune device compliance

Answer

Microsoft 365 Defender alerts and Microsoft Sentinel incidents

Answer

Azure Activity Logs and Azure Firewall logs

Question 14

You are configuring Microsoft Sentinel to detect potential ransomware activity. The security team wants to be alerted when a single host contacts multiple suspicious domains within a short time. Which analytic rule type should you create?

Accepted Answer

NRT (Near-Real-Time) rule. A NRT (Near-Real-Time) rule is the correct choice because it continuously processes events with a minimum latency of about 1 minute, making it ideal for detecting patterns like a single host contacting multiple suspicious domains within a short time window. Unlike scheduled rules that run on a fixed interval (e.g., every 5 minutes), NRT rules evaluate data as it arrives, enabling rapid detection of multi-event sequences such as DNS queries to known malicious domains.

Answer

Scheduled query rule

Answer

Anomaly rule

Answer

Microsoft security rule

Question 15

Your organization uses Microsoft Defender XDR and Microsoft Sentinel. You need to create a custom detection rule that triggers when a user is added to a privileged role in Microsoft Entra ID and within 5 minutes performs a mass download from SharePoint. Which approach should you use?

Accepted Answer

Create a scheduled query rule in Microsoft Sentinel. Option D is correct because the detection requires correlating events across Microsoft Entra ID (privileged role assignment) and SharePoint (mass download) within a 5-minute window. Microsoft Sentinel's scheduled query rules can ingest data from multiple sources (e.g., AuditLogs for Entra ID and SharePoint via Office 365 connector) and use KQL to join these events with a time constraint, making it the only native solution for cross-domain, time-bound custom detections.

Answer

Create an advanced hunting query in Microsoft Defender XDR

Answer

Use a custom detection rule in Microsoft 365 Defender

Answer

Use a Microsoft Purview insider risk policy