SC-200 Manage a security operations environment Practice Test 31 — 15 Questions

Question 1

You are a SOC analyst using Microsoft Defender for Endpoint. You need to investigate a device that is suspected of being compromised. You want to collect a memory dump for offline analysis. Which action should you take from the Microsoft Defender XDR portal?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Initiate a live response session and use the 'Collect memory dump' command.. The 'Collect memory dump' command is a built-in capability within a live response session in Microsoft Defender for Endpoint. This command allows you to capture a full memory dump of the device for offline forensic analysis, which is essential for investigating a suspected compromise. It is specifically designed for this purpose and does not require additional scripting or external tools.

Answer

Isolate the device from the network to prevent further damage.

Answer

Run a PowerShell script through live response to copy the memory dump.

Answer

Run a full antivirus scan on the device.

Question 2

Your organization wants to use Microsoft Sentinel's built-in threat intelligence feeds to enrich alerts. Which data connector should you enable?

Accepted Answer

Threat Intelligence - TAXII connector.. The Threat Intelligence - TAXII connector is the correct choice because it ingests threat intelligence feeds from STIX/TAXII servers, which are the standard protocol (Trusted Automated eXchange of Intelligence Indicator) used by built-in threat intelligence feeds. This connector allows Microsoft Sentinel to pull indicators of compromise (IOCs) from external threat intelligence sources, enriching alerts with context like malicious IPs, domains, or hashes.

Answer

Office 365 connector.

Answer

Microsoft 365 Defender connector.

Answer

Microsoft Defender for Cloud connector.

Question 3

You are configuring a Microsoft Sentinel workbook to display incident metrics. You want to show the average time to triage incidents over the last 30 days. Which data source should you use?

Accepted Answer

SecurityIncident table.. The SecurityIncident table in Microsoft Sentinel contains all incident-related data, including timestamps for creation, triage, and resolution. To calculate the average time to triage (e.g., the time between incident creation and the first triage action), you query this table using KQL to compute the mean duration. The other tables (CommonSecurityLog, SecurityAlert, SigninLogs) do not store incident lifecycle metadata.

Answer

CommonSecurityLog table.

Answer

SecurityAlert table.

Answer

SigninLogs table.

Question 4

Your organization uses Microsoft Sentinel to manage security incidents. The security team wants to automatically assign incidents to the appropriate analyst based on the incident’s severity and category. Which feature should you configure?

Accepted Answer

Automation rules. Automation rules in Microsoft Sentinel allow you to automatically assign incidents to specific analysts or teams based on conditions such as severity and category. This is the correct feature because it provides a rule-based engine that triggers on incident creation or update, enabling automatic assignment without manual intervention.

Answer

Analytics rules

Answer

Playbooks

Answer

Watchlists

Question 5

Your organization has Microsoft Defender for Cloud Apps and Microsoft Sentinel integrated. The security team wants to receive alerts when a user's activity from an anonymous IP address exceeds a certain risk score. What should you configure in Defender for Cloud Apps?

Accepted Answer

Activity policy. Activity policies in Microsoft Defender for Cloud Apps allow you to monitor and respond to specific user activities based on conditions such as IP address categories (e.g., anonymous proxy) and risk scores. This policy type can trigger alerts when a user's activity from an anonymous IP address exceeds a defined risk score threshold, meeting the security team's requirement.

Answer

Anomaly detection policy

Answer

File policy

Answer

App discovery policy

Question 6

Your organization uses Microsoft Defender XDR for threat detection and response. The security team wants to automatically isolate a compromised device when a specific malware alert is triggered, but only if the device is not a critical server. What is the most efficient way to achieve this?

Accepted Answer

Configure an automation rule in Microsoft Defender XDR. Automation rules in Microsoft Defender XDR allow you to define conditions (e.g., malware alert triggered) and actions (e.g., isolate device) with scoping filters (e.g., exclude devices tagged as 'critical server'). This provides a no-code, built-in mechanism that runs automatically without manual intervention or external scripting, making it the most efficient approach for conditional automated response.

Answer

Use advanced hunting to find devices and then manually isolate

Answer

Use PowerShell scripts in a playbook

Answer

Create a custom detection rule

Question 7

Your organization uses Microsoft Sentinel and wants to ensure that all incident-related data is retained for at least 90 days for compliance purposes. Which configuration should you check?

Accepted Answer

Log Analytics workspace retention settings. Log Analytics workspace retention settings directly control how long raw data ingested into Microsoft Sentinel is stored. For compliance requiring 90-day retention of incident-related data, you must configure the workspace retention period to at least 90 days (or use archive policies for longer retention). Incident data in Sentinel is derived from this underlying workspace data, so retention settings at the workspace level ensure the data persists for the required duration.

Answer

Watchlist settings

Answer

Analytics rule settings

Answer

Incident settings in Sentinel

Question 8

Your organization is using Microsoft Defender for Identity (MDI) and Microsoft Sentinel. The security team wants to correlate alerts from MDI with other data sources in Sentinel. What is the recommended approach?

Accepted Answer

Enable the Microsoft Defender for Identity data connector in Sentinel. The Microsoft Defender for Identity data connector in Microsoft Sentinel is the recommended approach because it provides native, out-of-the-box integration that automatically ingests MDI alerts and events into Sentinel without requiring additional infrastructure or manual configuration. This connector leverages the Microsoft Graph Security API to pull alerts, enabling seamless correlation with other data sources for unified threat detection and investigation.

Answer

Export MDI logs manually to Sentinel

Answer

Configure MDI to send syslog to Sentinel

Answer

Create a playbook to pull MDI alerts

Question 9

Your organization has Microsoft Sentinel deployed across multiple workspaces for different business units. The security team wants to view a unified incident queue across all workspaces. What should you implement?

Accepted Answer

Create cross-workspace queries and use the incident view with workspace references. Microsoft Sentinel supports cross-workspace incident viewing through the use of workspace references in queries and the unified incident view. By configuring cross-workspace queries and enabling the incident view with workspace references, the security team can aggregate and display incidents from multiple Sentinel workspaces in a single queue, providing a unified view without moving data.

Answer

Use Microsoft Defender XDR portal to view all incidents

Answer

Use Azure Lighthouse to manage multiple workspaces

Answer

Configure a single workspace to receive all incidents

Question 10

Your organization uses Microsoft Sentinel to manage security incidents. The security team wants to automatically close low-severity incidents after 24 hours if no activity has occurred. Which feature should you use?

Accepted Answer

Playbooks. A playbook (Azure Logic App) built on a Recurrence trigger — not an incident trigger — is the correct mechanism. Automation rules only fire in response to a Sentinel incident event (created/updated) and have no built-in condition to detect elapsed inactivity time; they cannot poll on a schedule. A recurrence-triggered playbook, by contrast, can run periodically (e.g., hourly), query the Sentinel incidents REST API for Low-severity incidents that have had no updates in the last 24 hours, and close them automatically — this is Microsoft's documented pattern for automated stale-incident closure.

Answer

Automation rules

Answer

Watchlists

Answer

Analytics rules

Question 11

Your organization is using Microsoft Defender for Cloud Apps to protect cloud applications. The security team wants to be alerted when a user shares a sensitive file with an external user. What should you configure?

Accepted Answer

File policy. File policies in Microsoft Defender for Cloud Apps are specifically designed to monitor and respond to events involving files stored in connected cloud apps, such as when a sensitive file is shared with an external user. You can configure a file policy with a filter for 'External' sharing and apply a content inspection rule to detect sensitive information types, triggering an alert when the condition is met.

Answer

Activity policy

Answer

App discovery policy

Answer

Anomaly detection policy

Question 12

Your organization uses Microsoft Sentinel and has multiple workspaces for different regions. The security team wants to use a single workbook to display data from all workspaces. What is the correct approach?

Accepted Answer

Create a workbook with cross-workspace queries using the workspace() expression. Microsoft Sentinel workbooks support cross-workspace queries using the `workspace()` expression in Kusto Query Language (KQL). This allows a single workbook to aggregate and display data from multiple Sentinel workspaces without moving or duplicating the data, meeting the security team's requirement efficiently.

Answer

Export data from all workspaces to a single Azure Data Lake

Answer

Create a workbook in one workspace and configure it to use Azure Lighthouse

Answer

Create a workbook in each workspace and merge them manually

Question 13

Which TWO of the following are valid data connectors in Microsoft Sentinel? (Select two.)

Accepted Answer

Office 365. Office 365 is a valid Microsoft Sentinel data connector because it ingests audit logs from Exchange Online, SharePoint Online, Teams, and other Office 365 services via the Office 365 Management Activity API. This connector enables security monitoring of user and admin activities across the Microsoft 365 tenant, making it a core data source for insider threat detection and compliance scenarios.

Answer

Windows Defender Firewall

Answer

Microsoft Forms

Answer

Azure DevOps

Question 14

Which TWO of the following are valid actions that can be performed by an automation rule in Microsoft Sentinel? (Select two.)

Accepted Answer

Assign incident to an analyst. Automation rules in Microsoft Sentinel can assign incidents to specific analysts or groups as part of incident response workflows. This action helps ensure accountability and proper triage by routing incidents to the appropriate personnel based on criteria like severity or type.

Answer

Delete a watchlist

Answer

Create a task

Answer

Modify an analytics rule

Question 15

Which THREE of the following are valid components of Microsoft Defender XDR? (Select three.)

Accepted Answer

Microsoft Defender for Endpoint. Microsoft Defender XDR is a unified security operations platform that integrates signals from multiple Microsoft security products. Microsoft Defender for Endpoint provides endpoint detection and response (EDR) capabilities, including behavioral-based detection and automated investigation. It is a core component of the XDR solution, enabling cross-domain correlation of alerts from endpoints.

Answer

Microsoft Purview

Answer

Microsoft Sentinel