SC-200 Manage a security operations environment Practice Test 31 — 15 Questions

Question 1

Which TWO actions should you take to ensure that Microsoft Sentinel can detect and respond to threats across your multicloud environment, including AWS and GCP?

Accepted Answer

Create analytics rules in Microsoft Sentinel to detect threats from the ingested multicloud logs.. Option A is correct because Microsoft Sentinel supports connectors for AWS (CloudTrail) and GCP (via the GCP connector). Option C is correct because custom KQL analytics rules are needed to create incidents from those logs. Option B is wrong because a separate workspace is not required; you can use one workspace. Option D is wrong because the Microsoft Defender XDR connector is for Microsoft services, not third-party clouds. Option E is wrong because Azure Policy doesn't configure connectors.

Answer

Use Azure Policy to deploy the connectors automatically.

Answer

Enable the Microsoft Defender XDR connector for AWS and GCP.

Answer

Create a separate Microsoft Sentinel workspace for each cloud provider.

Question 2

Which THREE are valid incident classification options in Microsoft Sentinel?

Accepted Answer

Benign Positive. Option A is correct because 'True Positive' is a standard classification. Option C is correct because 'False Positive' is standard. Option D is correct because 'Benign Positive' is a classification for non-malicious but relevant activity. Option B is wrong because 'Malicious' is a sub-classification, not a main classification. Option E is wrong because 'Informational' is not a classification; it's a severity level.

Answer

Informational

Answer

Malicious

Question 3

Which TWO steps are necessary to configure Microsoft Sentinel to automatically disable a compromised user account in Microsoft Entra ID when a high-severity incident is created?

Accepted Answer

Create a playbook that uses the Microsoft Entra ID 'Disable user' action.. Option B is correct because a playbook with a Microsoft Entra ID action can disable the user. Option D is correct because an automation rule triggers the playbook when an incident is created. Option A is wrong because analytics rules create incidents but don't trigger remediation. Option C is wrong because the Microsoft Entra ID Protection connector is not required; the playbook can connect directly. Option E is wrong because the Microsoft Defender XDR connector is not needed for this scenario.

Answer

Enable the Microsoft Defender XDR connector.

Answer

Enable the Microsoft Entra ID Protection data connector.

Answer

Create an analytics rule that detects compromised user accounts.

Question 4

You are reviewing an automation rule ARM template for Microsoft Sentinel. What is the result of deploying this automation rule?

Accepted Answer

When a High severity incident is created, the rule changes its severity to Medium and assigns it to SOC-Tier2.. Option C is correct because the trigger condition is 'Severity Equals High', and the action sets severity to 'Medium' and assigns to SOC-Tier2. So a high-severity incident is created, then changed to medium and assigned. Option A is wrong because it triggers on creation, not on update. Option B is wrong because the action modifies severity. Option D is wrong because the action does assign an owner.

Answer

The rule assigns the incident to SOC-Tier2 only if the severity is Medium.

Answer

The rule triggers when an incident is updated and resets the severity to High.

Answer

The rule triggers when a High severity incident is created but does not change the severity.

Question 5

You run the above KQL query in Microsoft Sentinel. The query returns no results. What is the most likely reason?

Accepted Answer

The query does not specify a time range, so it may be querying data older than the default 24-hour lookback.. Option A is correct because the 'SecurityAlert' table is not a standard table in Microsoft Sentinel; the correct table is 'SecurityAlert' (no hyphen) but actually the table is 'SecurityAlert'? Wait, the table is 'SecurityAlert' indeed in Microsoft Sentinel. However, the query uses 'has' operator which is case-insensitive but the column name 'AlertName' might be 'AlertName'? Actually, the column is 'AlertName' (capital N). But the most common reason for no results is that the 'SecurityAlert' table may not be populated if no alerts have been generated, or the time range is not specified. However, the exhibit shows no time filter, so the query runs on the default 24-hour range. Option A is plausible. Option B is wrong because 'has' works on strings. Option C is wrong because 'AlertSeverity' is a valid column. Option D is wrong because 'summarize' works fine.

Answer

The column 'AlertSeverity' does not exist in the SecurityAlert table.

Answer

The 'summarize' operator is misspelled.

Answer

The 'has' operator is case-sensitive and the alert names are capitalized differently.

Question 6

You are reviewing a PowerShell script used for automated response on a Windows 10 device managed by Microsoft Defender for Endpoint. What is the intended outcome of this script?

Accepted Answer

It triggers a quick scan if any Trojan detection exists.. Option D is correct because the script retrieves threat detections containing 'Trojan' and if found, initiates a quick scan. Option A is wrong because the script doesn't remove threats, only scans. Option B is wrong because it doesn't exclude anything. Option C is wrong because it doesn't update signatures.

Answer

It removes all Trojan threats from the device.

Answer

It updates the antimalware signatures and then performs a scan.

Answer

It configures Windows Defender to exclude Trojan files.

Question 7

You are a security operations analyst at a company that uses Microsoft Sentinel. You need to ensure that all incidents generated from Microsoft Defender for Cloud Apps are automatically assigned to the same SOC team. The team uses Microsoft Teams to collaborate. Which configuration should you implement?

Accepted Answer

Create an automation rule that sets the owner to the team entity.. Option B is correct because automation rules in Microsoft Sentinel can be configured to automatically assign incidents to a specific owner (team) based on conditions like provider. Microsoft Teams integration for collaboration is done via the Teams connector or custom solutions, not directly through automation rules. Automation rules handle assignment, not direct Teams messaging. Playbooks can post to Teams but assignment is done by automation rules. So B is the most direct and correct answer.

Answer

Create a playbook that assigns the incident to the team and configure an automation rule to run it.

Answer

Configure the Microsoft Defender for Cloud Apps connector to assign incidents to the team.

Answer

Use a logic app to automatically post incidents to a Teams channel and have the team claim them.

Question 8

Your organization uses Microsoft Defender XDR. You need to ensure that when a user reports a phishing email using the built-in Outlook add-in, the incident is automatically created in Microsoft Sentinel with high severity and a custom tag 'Phishing-Reported'. What is the most efficient way to achieve this?

Accepted Answer

Configure the 'User-reported phishing' policy in Microsoft Defender XDR to create an incident in Microsoft Sentinel with high severity and the tag.. Option A is correct because Microsoft Defender XDR has a built-in automation for user-reported phishing that can create incidents. You can configure the policy to set severity and add tags. Option B requires custom development. Option C is an alternative but less integrated. Option D is wrong because automation rules in Sentinel trigger on existing incidents, not on email reports directly.

Answer

Set up an automation rule in Microsoft Sentinel to tag incidents from 'Microsoft Defender' connector with the tag when severity is high.

Answer

Create a Power Automate flow that reads from the unified audit log and creates a Sentinel incident via API.

Answer

Use a playbook triggered by a Microsoft Sentinel analytics rule that monitors for 'PhishDeliver' events.

Question 9

Your team uses Microsoft Sentinel to monitor multiple Azure subscriptions. You need to grant a junior analyst the ability to view incidents and run playbooks, but not modify analytics rules or data connectors. Which built-in role should you assign?

Accepted Answer

Microsoft Sentinel Responder. Option C is correct because Microsoft Sentinel Responder allows viewing incidents and running playbooks, but not modifying analytics rules or connectors. Reader only allows viewing. Contributor allows modifications. Automation Contributor is for runbooks/automation accounts, not Sentinel-specific.

Answer

Microsoft Sentinel Contributor

Answer

Automation Contributor

Answer

Microsoft Sentinel Reader

Question 10

You are configuring Microsoft Sentinel to ingest logs from a third-party firewall via Syslog. After configuring the data connector, you notice that no logs are appearing. You verify that the firewall is sending logs to the Syslog collector. What is the most likely cause?

Accepted Answer

The syslog daemon on the collector is not configured to forward logs to the Log Analytics workspace.. Option A is correct because a common issue is that the Syslog collector (e.g., Linux VM) does not have the required syslog daemon (rsyslog) properly configured to forward logs to Log Analytics. Option B is less likely because connectors are usually enabled by default. Option C is wrong because KQL is for querying, not ingestion. Option D is wrong because the data connector for Syslog uses the Log Analytics agent, not AMA by default.

Answer

The firewall is sending logs in a format incompatible with the Azure Monitor Agent.

Answer

The ingestion cost is too high and Sentinel throttled the connection.

Answer

The data connector is disabled in the Log Analytics workspace.

Question 11

Your organization uses Microsoft Defender for Cloud to assess security posture. You need to ensure that any new Azure subscription automatically has Microsoft Defender for Cloud enabled with the 'Defender for Cloud (CSPM)' plan active. What should you do?

Accepted Answer

Assign a built-in Azure Policy initiative that deploys Microsoft Defender for Cloud configuration to subscriptions.. Option D is correct because Azure Policy can be used to enforce that Defender for Cloud is enabled on subscriptions. Specifically, the built-in policy 'Configure Azure Defender to be enabled on SQL Servers' but for general CSPM you need custom or built-in 'Deploy Microsoft Defender for Cloud configuration'. Option A is manual. Option B is for on-boarding to Sentinel. Option C is for Azure Arc, not subscriptions.

Answer

Create an automation account that runs a PowerShell script daily to check and enable Defender for Cloud.

Answer

Configure Azure Arc to enforce the plan on new subscriptions.

Answer

Use Microsoft Sentinel's 'Subscription Migration' playbook.

Question 12

Your SOC team uses Microsoft Sentinel to manage incidents. You want to categorize incidents based on the MITRE ATT&CK technique. You notice that some incidents are not being tagged with the correct technique. What should you check first?

Accepted Answer

The analytics rule that generated the incident has the correct MITRE ATT&CK technique selected.. Option A is correct because the mapping of alerts to MITRE techniques is done in the analytics rule itself. If the rule does not have the correct technique configured, incidents won't be tagged. Option B is for enrichment, not the source. Option C is about data ingestion. Option D is about automation, not the initial mapping.

Answer

The playbook assigned to the incident is overriding the technique tag.

Answer

The incident creation rule in the automation section is misconfigured.

Answer

The data connector for the source service is not ingesting the required fields.

Question 13

Your organization uses Microsoft Purview Data Loss Prevention (DLP) policies. You need to investigate an incident where sensitive data was shared externally. You want to view the details in Microsoft Sentinel. What should you ensure is configured?

Accepted Answer

The Microsoft 365 data connector in Microsoft Sentinel is enabled and configured to collect DLP alerts.. Option B is correct because Microsoft Purview DLP alerts can be ingested into Microsoft Sentinel via the Microsoft 365 connector (now part of Microsoft Defender XDR connector). Option A is for DLP policy management, not ingestion. Option C is for auditing. Option D is for internal sharing.

Answer

The SharePoint site is configured for external sharing.

Answer

The DLP policy must be set to 'Audit only' mode.

Answer

The unified audit log is enabled and the DLP events are being generated.

Question 14

You are configuring a Microsoft Sentinel analytics rule to detect brute-force attacks on your Azure Virtual Machines. The rule uses the 'SecurityEvent' table. You notice that the rule is not generating incidents even though you see failed logon events in the logs. What should you check?

Accepted Answer

The analytics rule is enabled and the query is correctly filtering for event ID 4625.. Option A is correct because the 'SecurityEvent' table collects Windows security events, but the event ID for failed logon (4625) must be included in the query and the rule must be enabled. If the rule is not enabled, it won't generate incidents. Option B is about data source configuration, but the table is already populated. Option C is about retention, not detection. Option D is about automation rules, not analytics rules.

Answer

An automation rule is suppressing incidents with the same name.

Answer

The workspace retention period is set to less than 90 days.

Answer

The Log Analytics agent is not installed on the VMs.

Question 15

Which TWO of the following are valid methods to ingest custom logs into Microsoft Sentinel? (Choose two.)

Accepted Answer

Use the Azure Monitor Agent to collect custom logs via data collection rules.. Options A and D are correct. Custom logs can be ingested via Log Analytics agent using custom log collection (A) or via Azure Monitor Agent with custom log upload (D). Option B is for Windows events, not custom logs. Option C is for Linux syslog. Option E is for Application Insights, not custom logs.

Answer

Use Windows Event Forwarding to send custom logs to Sentinel.

Answer

Use the Application Insights connector to ingest custom logs.

Answer

Configure the syslog daemon to forward custom application logs.