SC-200 Manage a security operations environment Practice Test 30 — 15 Questions

Question 1

Refer to the exhibit. You are deploying an Azure Resource Manager (ARM) template to create a saved search in Microsoft Sentinel. However, the template does not create an analytics rule. What is missing to turn this saved search into a scheduled analytics rule?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A Microsoft.OperationalInsights/workspaces/savedSearches/schedules resource. In Microsoft Sentinel, a saved search alone is just a stored KQL query; to turn it into a scheduled analytics rule that runs periodically and generates alerts, you must define a schedule resource under the saved search. The correct resource type is `Microsoft.OperationalInsights/workspaces/savedSearches/schedules`, which specifies the frequency and time period for the query execution. Without this schedule resource, the saved search remains static and never triggers alerts.

Answer

A Schedule section with frequency and period

Answer

An IncidentConfiguration section

Answer

A Query property with a valid KQL

Question 2

Refer to the exhibit. You are reviewing an automation rule in Microsoft Sentinel. What is the effect of this rule?

Accepted Answer

It changes the status of newly created incidents from 'New' to 'Active'.. The automation rule is configured to run when an incident is created, and the action taken is to change the incident status from 'New' to 'Active'. This is a common initial triage step to indicate that the incident is being worked on, rather than leaving it in the default 'New' state. The rule does not assign ownership, suppress incidents, or create tasks.

Answer

It assigns the incident to the SOC team.

Answer

It suppresses the incident if it is a false positive.

Answer

It creates a task in the incident for investigation.

Question 3

Your organization uses Microsoft Defender XDR and Microsoft Sentinel. You need to configure a solution that automatically blocks a user's account when a high-severity incident is generated. The solution must use built-in capabilities without custom code. What should you do?

Accepted Answer

Create an automation rule that triggers on incident creation with severity high, and runs a playbook that uses the 'Update user' action to disable the account.. Microsoft Sentinel automation rules can trigger on incident creation with a condition of severity equals high, and then run a playbook. The playbook can use the Microsoft Entra ID connector's 'Update user' action to disable the user account, which is a built-in capability requiring no custom code. This directly meets the requirement to automatically block a user's account when a high-severity incident is generated.

Answer

Use a scheduled analytics rule that runs every hour and disables accounts found in the results.

Answer

Configure Microsoft Entra ID to automatically apply a conditional access policy blocking sign-ins when a high-severity alert is raised.

Answer

Create a playbook that uses the 'Run a query' action to find the device and then uses Microsoft Defender for Endpoint to isolate the device.

Question 4

You are a security analyst. You notice that Microsoft Sentinel is not receiving logs from Microsoft 365 Defender incidents. The diagnostic settings in Microsoft 365 Defender are configured to send data to the Sentinel workspace. What should you check first?

Accepted Answer

Ensure the Microsoft 365 Defender data connector in Microsoft Sentinel is enabled.. The diagnostic settings in Microsoft 365 Defender send raw data to the Log Analytics workspace, but Microsoft Sentinel must have the Microsoft 365 Defender data connector enabled to parse and ingest that data into the correct tables (e.g., SecurityIncident, AlertInfo). Without the connector enabled, the logs arrive in the workspace but are not processed by Sentinel, so incidents won't appear. This is the first and most common check because the connector acts as the ingestion pipeline.

Answer

Check if the Microsoft Sentinel solution is installed.

Answer

Verify that the Log Analytics workspace is in the same region as the Sentinel workspace.

Answer

Check the 'SecurityIncident' table schema for missing columns.

Question 5

You are managing a Microsoft Sentinel environment. You need to ensure that only security analysts with specific roles can modify automation rules. The solution must use least privilege. What should you do?

Accepted Answer

Create a custom role with 'Microsoft Sentinel Automation Contributor' permission and assign it to the analysts.. Microsoft Sentinel provides a built-in 'Microsoft Sentinel Automation Contributor' role that grants granular permissions to manage automation rules without granting broader Contributor access. This adheres to the least privilege principle by limiting modifications to only the necessary automation-related actions, such as creating, editing, or deleting automation rules, while preventing changes to other Sentinel resources like analytics rules or data connectors.

Answer

Use Azure Policy to restrict access to automation rules.

Answer

Assign the 'Microsoft Sentinel Contributor' role to all security analysts.

Answer

Assign the 'Microsoft Sentinel Reader' role to the analysts and grant them 'Automation' permissions via a separate policy.

Question 6

Your organization uses Microsoft Defender XDR and Microsoft Sentinel. You need to ensure that when a user reports a phishing email in Microsoft 365 Defender, the incident in Microsoft Sentinel is automatically updated with the user's comments. Which THREE components are required?

Accepted Answer

The Microsoft 365 Defender data connector in Microsoft Sentinel.. The Microsoft 365 Defender data connector in Microsoft Sentinel is required because it ingests alerts and incidents from Microsoft 365 Defender into Sentinel. Without this connector, the phishing email report from Microsoft 365 Defender would not create an incident in Sentinel, making it impossible to automatically update that incident with user comments.

Answer

A logic app in Azure that is triggered by the Microsoft 365 Defender alert.

Answer

The Microsoft Entra ID data connector in Microsoft Sentinel.

Question 7

You are configuring Microsoft Sentinel to use Microsoft Copilot for Security. Which TWO prerequisites must be met?

Accepted Answer

Ensure that the Microsoft Defender XDR tenant is integrated with Copilot for Security.. Microsoft Copilot for Security must be integrated with the Microsoft Defender XDR tenant to access and correlate security data across the Microsoft security ecosystem. This integration enables Copilot to leverage signals from Defender XDR, Microsoft Sentinel, and other sources for incident response and investigation. Without this tenant-level integration, Copilot cannot authenticate or retrieve the necessary security context from Defender XDR.

Answer

Enable Copilot for Security in the Microsoft Sentinel workspace settings.

Answer

Deploy Copilot for Security in the same Azure region as the Sentinel workspace.

Answer

Purchase a Microsoft Sentinel premium license.

Question 8

You are a SOC analyst investigating a high-severity incident. The incident involves a user who received a phishing email and clicked a link. Microsoft Defender for Office 365 detected the email as phishing and blocked the URL at time of click, but a follow-up investigation reveals that the user's mailbox has suspicious forwarding rules. You need to ensure that similar incidents are automatically remediated in the future. What should you configure in Microsoft Sentinel?

Accepted Answer

Create an automation rule that triggers a playbook to remove the forwarding rule when an incident with the 'Phishing' tactic is created.. Microsoft Sentinel automation rules can trigger a playbook (an Azure Logic Apps workflow) when an incident is created with a specific tactic, such as 'Phishing'. This allows automatic remediation of suspicious forwarding rules without manual intervention, ensuring similar incidents are handled consistently.

Answer

Configure entity behavior analytics to automatically block the user.

Answer

Create an analytics rule that detects suspicious forwarding rules and automatically removes them.

Answer

Add the user to a watchlist that triggers an automated investigation.

Question 9

You are a security analyst for a company that uses Azure Firewall. You are reviewing a custom rule deployed via Azure Firewall Manager. The exhibit shows the rule configuration. The rule is intended to block inbound traffic from known Tor exit nodes. However, a recent incident involved an attacker using a Tor exit node with IP 138.197.5.5 to access an internal web server on port 8080. The log shows the traffic was ALLOWED. What is the most likely reason the rule did not block the traffic?

Accepted Answer

The destination port 8080 is not listed in the rule.. The rule is configured to block traffic on destination port 80, but the attacker used port 8080. Azure Firewall rules are explicit; if the destination port in the traffic does not match any port specified in the rule, the rule is not applied, and the traffic is evaluated by subsequent rules or default allow logic. Since the rule only lists port 80, traffic to port 8080 is not matched, and thus the rule does not block it.

Answer

The source address range does not include 138.197.5.5.

Answer

The rule type is 'Prevention' but should be 'Detection'.

Answer

The rule priority is too low and is overridden by a higher priority rule.

Question 10

Your organization is planning to deploy Microsoft Sentinel. You need to ensure that security events from on-premises servers are sent to Sentinel. Which connector should you use?

Accepted Answer

Install the Azure Monitor Agent (AMA) on the servers and configure a Data Collection Rule (DCR) to send events to Sentinel.. The Azure Monitor Agent (AMA) is the current recommended agent for collecting security events from on-premises servers and forwarding them to Microsoft Sentinel. By installing AMA and configuring a Data Collection Rule (DCR), you can specify which security events (e.g., Windows Security Event logs) to collect and send directly to the Sentinel workspace, ensuring efficient and modern data ingestion.

Answer

Install the Log Analytics agent (MMA) on the servers and connect to Sentinel workspace.

Answer

Use the Microsoft Defender for Cloud (MDC) connector to stream security events.

Answer

Enable Azure Arc on the servers and use the Arc agent to forward events.

Question 11

You are a SOC analyst using Microsoft Defender XDR. You notice that a user's account has been compromised and is being used to send phishing emails. You need to prevent the user from sending any more emails while preserving the ability to receive emails for investigation. What should you do?

Accepted Answer

Restrict the user from sending email using Microsoft Defender for Office 365 mailbox restrictions.. Microsoft Defender for Office 365 mailbox restrictions allow you to block a user from sending email while still permitting them to receive messages. This is done via the 'Restrict user from sending email' policy in the Microsoft 365 Defender portal, which applies a transport rule that rejects outbound mail from the user but leaves inbound delivery intact, enabling forensic analysis of incoming phishing responses.

Answer

Remove the user's Microsoft 365 license.

Answer

Disable the user account in Microsoft Entra ID.

Answer

Delete the user's mailbox in Exchange Online.

Question 12

You are configuring Microsoft Sentinel to ingest logs from Azure Active Directory (now Microsoft Entra ID). Which of the following connectors should you use to collect sign-in logs and audit logs?

Accepted Answer

Microsoft Entra ID connector.. The Microsoft Entra ID connector (formerly Azure AD connector) is the correct choice because it is specifically designed to ingest sign-in logs, audit logs, and provisioning logs from Microsoft Entra ID into Microsoft Sentinel. This connector uses the Microsoft Graph API to pull these logs, enabling security monitoring of user authentication and administrative activities.

Answer

Microsoft Defender for Cloud connector.

Answer

Office 365 connector.

Answer

Azure Activity connector.

Question 13

You are a SOC analyst investigating an incident where a user's credentials were used to access a sensitive SharePoint site from an unusual location. Microsoft Defender for Cloud Apps detected the activity as a suspicious sign-in. You need to create a detection rule that alerts whenever a user accesses SharePoint from a location not in the allowed list. What type of rule should you create in Microsoft Defender for Cloud Apps?

Accepted Answer

Activity policy.. An Activity policy in Microsoft Defender for Cloud Apps allows you to create custom rules that trigger alerts based on specific user activities, such as accessing SharePoint from a location not in the allowed list. This policy type evaluates each activity against defined conditions (e.g., IP address ranges, geolocation) and can generate alerts or take automated actions. It is the correct choice because it directly matches the requirement to detect a specific access pattern (location-based anomaly) rather than broad behavioral patterns.

Answer

App discovery policy.

Answer

Session policy.

Answer

Anomaly detection policy.

Question 14

The exhibit shows a Conditional Access policy configuration in Microsoft Entra ID. The policy is intended to require MFA and compliant device for all users accessing all applications from trusted locations. However, users are reporting that they are being prompted for MFA even when accessing from the office (which is a trusted location). What is the most likely issue?

Accepted Answer

The location condition should include 'All untrusted locations' and exclude 'All trusted locations'.. The policy is configured to require MFA and compliant device for 'All users' accessing 'All applications' from 'Trusted locations'. However, users are being prompted for MFA from the office, which is a trusted location. The most likely issue is that the location condition is inverted: the policy should target 'All untrusted locations' (i.e., require MFA when not in a trusted location) and exclude 'All trusted locations' to avoid prompting from trusted IPs. Option D correctly identifies this misconfiguration.

Answer

The policy should target specific applications instead of 'All applications'.

Answer

The grant controls should be 'Require MFA' only, not 'Require compliant device'.

Answer

The policy should exclude the 'All Users' group and instead assign specific users.

Question 15

Your organization uses Microsoft Sentinel with User and Entity Behavior Analytics (UEBA) enabled. You notice that the UEBA is not generating any anomalies for a particular user who has been inactive for 30 days. You have verified that the user's data is being ingested into the workspace. What is the most likely reason?

Accepted Answer

UEBA requires a minimum of 14 days of activity to establish a baseline.. UEBA in Microsoft Sentinel requires a minimum of 14 days of historical data to build a behavioral baseline for each user. If a user has been inactive for 30 days, the baseline may have expired or never been established, so no anomalies are generated. The data ingestion is confirmed, but without recent activity, UEBA cannot compare current behavior against a meaningful profile.

Answer

The user's license does not include UEBA.

Answer

UEBA only works with Active Directory data, not Microsoft Entra ID.

Answer

UEBA is not enabled for the workspace.