SC-200 Manage a security operations environment Practice Test 30 — 15 Questions

Question 1

You are configuring Microsoft Defender for Cloud Apps. You need to create a policy that alerts when a user downloads more than 100 files in 10 minutes from SharePoint. Which policy type should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Activity policy. An Activity policy in Microsoft Defender for Cloud Apps monitors specific user activities (e.g., file downloads) and can trigger alerts based on thresholds like 'more than 100 downloads in 10 minutes'. This policy type is designed for granular, behavior-based detection of suspicious actions, making it the correct choice for this scenario.

Answer

Anomaly detection policy

Answer

File policy

Answer

Cloud discovery policy

Question 2

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You want to use a Microsoft Copilot for Security to summarize an incident in Microsoft Defender XDR. What is the minimum role required?

Accepted Answer

Security Reader. The minimum role required to use Microsoft Copilot for Security to summarize an incident in Microsoft Defender XDR is Security Reader. This role grants read-only access to security data, including incidents and alerts, which is sufficient for Copilot to retrieve and summarize incident details without requiring write permissions. Higher-privileged roles like Security Administrator or Global Administrator are unnecessary for this read-only operation.

Answer

Security Administrator

Answer

Reader

Answer

Global Administrator

Question 3

You have a Microsoft Sentinel workspace that ingests logs from multiple sources. The log analytics workspace is in the East US region. You have a requirement to keep logs for 90 days for active investigation, then archive them to an Azure storage account for compliance for 5 years. What should you configure?

Accepted Answer

Set the retention period to 90 days and configure a data export rule to send logs older than 90 days to Azure Blob Storage. In Microsoft Sentinel, you can set the workspace retention to 90 days for active investigation. To archive logs for 5 years, configure a data export rule that continuously exports all ingested logs to Azure Blob Storage. The data export rule sends data as it arrives, not after retention expiry, so the exported copy is available in storage from day one, while the workspace copy is automatically deleted after 90 days. This meets the requirement without incurring high costs of extended workspace retention.

Answer

Set the retention period to 5 years and use purging for data older than 90 days

Answer

Set the retention period to 90 days and enable 'Archive' in the workspace retention settings

Answer

Configure diagnostic settings to send logs to storage with a retention of 90 days

Question 4

Your security team uses Microsoft Defender for Cloud to assess the security posture of Azure resources. You need to ensure that all virtual machines have endpoint protection enabled. Which policy initiative should you assign?

Accepted Answer

Deploy Microsoft Defender for Endpoint. The 'Deploy Microsoft Defender for Endpoint' policy initiative is specifically designed to ensure that all Azure VMs have endpoint protection enabled. This initiative deploys the Microsoft Defender for Endpoint agent to VMs that are missing it, directly addressing the requirement for endpoint protection. Other options focus on encryption, exploit guard configuration, or general security benchmarks, not the deployment of endpoint protection.

Answer

Enable encryption on Azure VMs

Answer

Deploy Windows Defender Exploit Guard

Answer

Azure Security Benchmark

Question 5

You are a security analyst. An incident in Microsoft Sentinel is assigned to you. The incident contains multiple alerts. You want to group related alerts into a single incident to reduce noise. What feature should you use?

Accepted Answer

Incident grouping settings in the analytics rule. Not C. Incident grouping settings in the analytics rule allow you to group multiple alerts into a single incident based on criteria like entities or time window. Option A (Automation rules) is for automating incident management actions, not for grouping alerts. Option B (Threat intelligence indicators) is used to enrich alerts with threat intelligence, not to group them. Option C (Incident details tab) is for viewing details of an existing incident, not for configuring grouping.

Answer

Automation rules

Answer

Threat intelligence indicators

Answer

Incident details tab

Question 6

Which TWO actions require the Global Administrator role in Microsoft 365?

Accepted Answer

Configure tenant-wide settings in Microsoft 365. Configuring tenant-wide settings in Microsoft 365 requires the Global Administrator role because these settings affect the entire organization, including security, compliance, and user management. Only the Global Administrator has the broadest permissions to modify such high-level configurations, as defined by Microsoft's role-based access control (RBAC) model.

Answer

Create a data loss prevention (DLP) policy in Microsoft Purview

Answer

Create a custom role in Microsoft Defender XDR

Answer

View the Microsoft 365 Defender incident queue

Question 7

Which THREE actions can you perform using Microsoft Sentinel automation rules?

Accepted Answer

Run a playbook. Automation rules in Microsoft Sentinel can trigger a playbook as an automated response to an incident or alert. Playbooks are based on Azure Logic Apps and allow you to run complex workflows, such as gathering additional data, sending notifications, or taking remediation actions, directly from the automation rule.

Answer

Create a new analytics rule

Answer

Add threat intelligence indicators to Sentinel

Question 8

Which TWO Microsoft 365 security solutions include capabilities for managing security incidents?

Accepted Answer

Microsoft Defender XDR. Correct options are B and E. Microsoft Defender XDR (B) provides a unified incident management queue across endpoints, email, and identities. Microsoft Sentinel (E) is a cloud-native SIEM that ingests alerts and manages security incidents. Option A (Microsoft Intune) is an endpoint management solution, not incident management. Option C (Microsoft Entra ID Protection) focuses on identity-based risk detection but does not manage incidents like a SIEM or XDR. Option D (Microsoft Purview) is for data governance and compliance, not incident handling.

Answer

Microsoft Intune

Answer

Microsoft Entra ID Protection

Answer

Microsoft Purview

Question 9

Refer to the exhibit. You are reviewing an analytics rule in Microsoft Sentinel. The rule is enabled but has not generated any alerts in the past 24 hours. What is the most likely cause?

Accepted Answer

The query uses 'Location == Unknown' but the actual sign-in location is not 'Unknown'. The rule has generated no alerts because the query condition 'Location == Unknown' does not match any actual sign-in locations. Suppression only suppresses alerts after an initial alert has been generated; it does not prevent the first alert. With zero alerts, the most likely cause is that the query returns no results, not suppression.

Answer

The triggerThreshold is set to 0, which means no alerts will be generated

Answer

Suppression is enabled with a duration of 6 hours, which may be suppressing new alerts after the first one

Answer

The queryFrequency is 1 hour and the queryPeriod is 7 days, which is a mismatch

Question 10

Refer to the exhibit. You are deploying a Microsoft Sentinel workspace using an ARM template. After deployment, you notice the workspace is in a disabled state for ingesting data. Which parameter is most likely causing this?

Accepted Answer

The dailyQuotaInGB parameter sets a daily cap that may have been exceeded. The dailyQuotaInGB parameter sets a daily ingestion cap for the Log Analytics workspace. If this cap is reached, data ingestion is disabled until the next day, causing the workspace to appear in a disabled state for ingesting data. This is the most likely cause because the question explicitly states the workspace is disabled for data ingestion, which aligns with the behavior of the daily cap being exceeded.

Answer

The location parameter is set to 'eastus' but Sentinel is not available in that region

Answer

The retentionInDays parameter is set to 90, which is less than the default 30 days

Answer

The workspaceName parameter is set to 'SentinelWorkspace' but the name must be globally unique

Question 11

Refer to the exhibit. You have an analytics rule in Microsoft Sentinel that uses this KQL query. The rule is configured to run every hour and alert when the result count is greater than 0. Which type of attack is this rule most likely detecting?

Accepted Answer

Brute force attack on user accounts. The KQL query counts failed sign-in events (ResultType != 0) aggregated by User, IPAddress, and a 5-minute bin, then filters for users with more than 10 failures. This pattern of multiple rapid failed logins from the same IP against a single user is the classic signature of a brute force attack, where an attacker tries many passwords to guess credentials. The rule triggers when the count exceeds 10 within any 5-minute window, making it highly specific to brute force detection.

Answer

Privileged account misuse

Answer

Data exfiltration via sign-in

Answer

Account takeover from a new location

Question 12

Your organization uses Microsoft Sentinel in a hybrid environment with on-premises servers and Azure VMs. You need to ensure that all Windows servers forward their security events to Sentinel. The security team wants to use Windows Security Events via AMA connector. Windows servers are not domain-joined and are managed by a third-party RMM tool. What is the most efficient way to deploy the AMA agent?

Accepted Answer

Onboard the servers to Azure Arc and deploy the AMA agent via policy or script.. Azure Arc provides a control plane for non-Azure and on-premises servers, enabling them to be managed like Azure resources. Once onboarded to Azure Arc, you can deploy the Azure Monitor Agent (AMA) via Azure Policy or custom scripts, which is the most efficient method for non-domain-joined servers managed by a third-party RMM tool, as it avoids manual intervention and leverages Azure's centralized management.

Answer

Use Group Policy Objects (GPO) to push the agent installation.

Answer

Use Microsoft Intune to deploy the AMA agent to all servers.

Answer

Manually install the agent on each server using the setup wizard.

Question 13

You are a SOC analyst using Microsoft Sentinel. You have a scheduled analytics rule that generates incidents from KQL queries. Recently, incidents are being created but automatically closed within minutes without any actions taken. You suspect a configuration issue. What should you check first?

Accepted Answer

Review the incident automation rules that might have a 'Close incident' action triggered by a condition.. Incident automation rules in Microsoft Sentinel can be configured to automatically close incidents when specific conditions are met, such as a related alert being resolved or a playbook completing. Since the incidents are being closed within minutes without manual intervention, an automation rule with a 'Close incident' action is the most likely cause, as it directly triggers closure based on conditions. Checking this first aligns with the SOC analyst's need to identify automated actions that could prematurely close incidents.

Answer

Verify the 'Alert grouping' settings in the analytics rule; they might be grouping alerts incorrectly.

Answer

Check if the analytics rule has a 'Suppression' setting enabled that causes the incident to close.

Answer

Examine the entity mapping configuration; it might be causing the incident to close automatically.

Question 14

You are configuring Microsoft Defender for Cloud Apps. You need to create a policy that alerts when a user downloads more than 100 files in 10 minutes from SharePoint. Which policy type should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a session policy to block or limit activities based on risk.. Session policies in Microsoft Defender for Cloud Apps allow you to monitor and control user activities in real time based on risk level. By configuring a session policy with the 'block' or 'limit' action triggered by risk factors (e.g., anomalous location, impossible travel), you can automatically suspend risky user activities without disrupting legitimate usage.

Answer

Set up IP address range policies.

Answer

Configure app discovery policies.

Answer

Define file policies to protect sensitive data.

Question 15

Your organization uses Microsoft Sentinel with a Log Analytics workspace in the East US region. You have deployed the Microsoft Defender for Cloud connector. You notice that security alerts from Defender for Cloud are not appearing as incidents in Sentinel. You have confirmed that the connector is enabled and data is flowing. What is the most likely cause?

Accepted Answer

You need to create an analytics rule with a rule template that uses the SecurityAlert table.. The Microsoft Defender for Cloud connector ingests security alerts into the Log Analytics workspace's SecurityAlert table, but incidents in Microsoft Sentinel are generated only by analytics rules. Without a configured analytics rule that queries the SecurityAlert table (such as the built-in 'Create incidents based on Microsoft Defender for Cloud alerts' template), no incidents will be created even if data is flowing. Option C correctly identifies this missing step.

Answer

The Sentinel workspace does not have required permissions to create incidents.

Answer

There is a delay in incident creation; wait for 24 hours.

Answer

The Microsoft Defender for Cloud connector is not properly configured.