SC-200 Manage a security operations environment Practice Test 31 — 15 Questions

Question 1

Your organization uses Microsoft Defender for Office 365. You need to ensure that when a user reports a phishing email via the built-in Outlook add-in, an automated investigation is triggered in Microsoft 365 Defender. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable user-reported message settings in the Microsoft 365 Defender portal.. Enabling user-reported message settings in the Microsoft 365 Defender portal allows messages reported via the built-in Outlook add-in to automatically trigger an automated investigation (AIR) in Microsoft 365 Defender. This configuration ties the user reporting action directly to the incident response workflow, enabling the system to analyze the reported email and initiate remediation steps without manual intervention.

Answer

Define a safe links policy.

Answer

Configure an anti-phishing policy.

Answer

Set up a safe attachments policy.

Question 2

You are a security administrator for a multinational company using Microsoft Sentinel. You need to ensure that critical incidents are automatically escalated to the on-call team via email and SMS. The on-call schedule uses Microsoft Teams channel. What is the most efficient way to achieve this?

Accepted Answer

Build a playbook using Microsoft Teams connector to post a message in the on-call channel with an adaptive card that allows acknowledge and escalate.. It uses a Microsoft Teams connector playbook triggered by an automation rule to post an adaptive card in the on-call channel. This allows the on-call team to acknowledge or escalate the incident directly from Teams, fulfilling the requirement for email and SMS escalation through the Teams channel schedule. Automation rules in Sentinel can trigger playbooks based on incident creation or update, making this the most efficient integrated approach.

Answer

Create an automation rule that sends email directly to the on-call team.

Answer

Configure the analytics rule to send an email when the incident is created.

Answer

Use a workbook to display critical incidents and expect the team to monitor it.

Question 3

Your organization uses Microsoft Sentinel and has enabled UEBA (User and Entity Behavior Analytics). You notice that the UEBA timeline is not populating for some users. You have verified that the data sources are connected and the UEBA feature is enabled. What could be the issue?

Accepted Answer

There is insufficient data to build baselines for those users; UEBA needs at least 14 days of data.. UEBA requires a minimum of 14 days of historical data to establish behavioral baselines for each user. Without sufficient data, the timeline cannot detect anomalies or populate entries. Even if data sources are connected and UEBA is enabled, the feature will not generate timeline events until baselines are built.

Answer

Users must opt in to UEBA tracking.

Answer

UEBA only works with Azure Active Directory (now Microsoft Entra ID) audit logs.

Answer

The data sources are not sending logs for those users.

Question 4

Your organization is implementing Microsoft Sentinel and needs to ensure that incident response activities are compliant with regulatory requirements. You need to track and document all changes made to analytics rules and playbooks. Which TWO features should you enable?

Accepted Answer

Activity logs (Azure Monitor). Activity logs (Azure Monitor) record all management-plane operations, including changes to analytics rules and playbooks, while Azure Resource Change History (Change tracking) captures resource-level modifications. Together they provide comprehensive audit trails for regulatory compliance. Workbooks (A) are for visualization, Automation rules (B) trigger responses but don't log changes themselves, and Microsoft Purview (E) is for broader data governance, not operational change tracking.

Answer

Sentinel workbooks

Answer

Automation rules

Answer

Microsoft Purview Compliance Manager

Question 5

Your organization uses Microsoft Defender for Office 365. You need to ensure that when a user reports a phishing email via the built-in Outlook add-in, an automated investigation is triggered in Microsoft 365 Defender. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Security Operator. Security Operator and Security Administrator are the two built-in roles in Microsoft 365 Defender that include permissions to manage incidents and alerts. Security Operator can view and respond to incidents and alerts, while Security Administrator has full access to all security features, including the ability to edit policies and manage incidents. These roles are specifically designed for security operations tasks within Defender XDR.

Answer

Global Administrator

Answer

Compliance Administrator

Answer

Security Reader

Question 6

Your organization has multiple offices across the globe and uses Microsoft Sentinel as the primary SIEM. You have deployed Azure Arc on all on-premises servers to manage them centrally. The security team needs to collect Windows Security Events from all servers, including domain controllers, and forward them to Sentinel using the Windows Security Events via AMA connector. The team also wants to minimize administrative overhead when adding new servers. The current environment includes: 500 on-premises Windows servers (200 domain controllers, 300 member servers) managed via Azure Arc, 200 Azure VMs running Windows Server, and a centralized Log Analytics workspace named 'LAW-Security' in the East US region. You have already installed the Azure Monitor Agent (AMA) on all servers via Azure Arc and Azure VMs. However, you notice that security events from domain controllers are not appearing in Sentinel. You have verified that the AMA agent is running and the data collection rule (DCR) is correctly configured to collect Security events. No other issues are present. You need to ensure that security events from domain controllers are collected. What should you do?

Accepted Answer

Check the network connectivity from the domain controllers to the Log Analytics workspace endpoint. Ensure that the domain controllers can reach the required URLs.. Domain controllers often have more restrictive network policies, and they must be able to reach the Log Analytics workspace endpoint (the data collection endpoint and the Log Analytics service) to send events. The AMA agent is running and the DCR is configured, but if domain controllers cannot connect to the required URLs (e.g., *.ods.opinsights.azure.com, *.oms.opinsights.azure.com, etc.), events will not be collected. Option A is incorrect because the connector configuration is not the issue; the connector is already working for other servers. Option B is incorrect because restarting the agent does not address network issues. Option C is incorrect because the DCR namespace is irrelevant; the DCR configuration is correct for other servers.

Answer

Reinstall the Windows Security Events via AMA connector in Sentinel.

Answer

Restart the Azure Monitor Agent on all domain controllers.

Answer

Recreate the data collection rule with a different namespace.

Question 7

Your organization uses Microsoft Defender for Endpoint (MDE) and Microsoft Sentinel. You have configured the Microsoft Defender for Endpoint connector in Sentinel to ingest alerts and incidents. The security team wants to automatically create a Sentinel incident when an MDE alert of severity 'High' or 'Critical' is generated. Additionally, they want to assign the incident to a specific SOC tier based on the alert title. For example, if the alert title contains 'Ransomware', assign to Tier 3; otherwise assign to Tier 2. You need to implement this automation efficiently. You have already enabled the connector and verified that MDE alerts are flowing into Sentinel. What is the best approach?

Accepted Answer

Create an automation rule that triggers on incident creation for High and Critical severity. The rule runs a playbook that uses Logic Apps to parse the alert title and assign the incident to the appropriate tier using the Microsoft Sentinel connector 'Update incident' action.. The best approach because automation rules can trigger on incident creation with conditions on severity (High/Critical), and then run a playbook. The playbook, built with Logic Apps, can parse the alert title from the incident's related alerts and use the Microsoft Sentinel connector's 'Update incident' action to set the owner to the appropriate SOC tier. Option A is incorrect because, while automation rules can trigger on severity, they cannot dynamically assign the owner based on the alert title without a playbook. Option B is incorrect because automation rules do not support KQL conditions on alert title; they only support conditions on incident properties like severity, status, or tag. Option D is incorrect because the Microsoft Defender for Endpoint analytics rule is not configurable for custom owner assignment based on alert title; that logic belongs in Sentinel automation.

Answer

Create an automation rule that triggers when an incident is created with a condition on alert severity, and set the owner to the appropriate group. Then create another automation rule for 'Ransomware' alerts.

Answer

Configure an automation rule with a condition on the alert title using KQL, then set the owner.

Answer

Modify the Microsoft Defender for Endpoint analytics rule to include a custom mapping that assigns the incident to a specific owner based on the alert title.

Question 8

You are configuring Microsoft Sentinel automation rules to handle incidents generated from Microsoft Defender for Cloud. You need to ensure that when a high-severity security alert is triggered, an automated response runs a playbook that creates a support ticket in ServiceNow. However, the playbook fails to execute for some alerts. Upon investigation, you find that the automation rule is triggered only when the incident is created. What is the most likely cause of the failure?

Accepted Answer

The automation rule is configured to trigger only on incident creation, but the playbook requires the incident to be in an updated state.. The automation rule is configured to trigger only on incident creation. However, the playbook requires the incident to be in an updated state to execute, meaning the automation rule does not fire when the incident is updated after creation. This mismatch causes the playbook to fail for alerts that require an update trigger.

Answer

The automation rule lacks permissions to the ServiceNow connector because of Microsoft Entra ID conditional access policies.

Answer

Playbooks cannot be called by automation rules in Microsoft Sentinel.

Answer

Automation rules cannot be triggered on incident creation from Microsoft Defender for Cloud.

Question 9

You are the security operations lead for a multinational company using Microsoft Defender XDR. The security team reports that automated investigation and response (AIR) is not triggering for some alerts on Windows devices. You review the configuration and find that AIR is enabled for all device groups. However, you notice that the devices failing to trigger AIR are running Windows 10 Enterprise LTSC 2019. What is the most likely reason AIR is not working on these devices?

Accepted Answer

Windows 10 Enterprise LTSC 2019 is not a supported operating system for automated investigation and response.. Automated investigation and response (AIR) in Microsoft Defender for Endpoint requires a supported Windows version. Windows 10 Enterprise LTSC 2019 (Long-Term Servicing Channel) is not a supported operating system for AIR because it lacks the necessary components and update cadence to support the automation engine. Even if AIR is enabled globally and devices are properly onboarded, the feature will not trigger on unsupported OS versions.

Answer

The devices are not properly onboarded to Microsoft Defender for Endpoint.

Answer

The devices are not connected to the internet.

Answer

The security team does not have the required role permissions to initiate AIR.

Question 10

Your organization uses Microsoft Sentinel for security information and event management (SIEM). You need to ensure that all incidents from a specific analytics rule are automatically assigned to the 'SOC Tier 1' team. What should you configure in Microsoft Sentinel?

Accepted Answer

Create an automation rule that triggers when the incident is created and sets the owner.. Automation rules in Microsoft Sentinel allow you to define conditions (such as incident creation) and actions (such as setting the owner) without requiring a playbook or custom code. This provides a lightweight, native way to automatically assign incidents from a specific analytics rule to the 'SOC Tier 1' team by filtering on the rule's name or ID in the automation rule's condition.

Answer

Configure alert enrichment in the analytics rule to add the owner.

Answer

Modify the analytics rule to write the incident to a custom table accessible by the SOC team.

Answer

Create a playbook that assigns the incident and attach it to the analytics rule.

Question 11

Refer to the exhibit. You are reviewing a playbook configuration in Microsoft Sentinel. The playbook is supposed to create a task to generate a ServiceNow ticket and notify the SOC manager when a high-severity alert is triggered. However, when a high-severity alert occurs, only the notification task is created, and the ticket creation task is missing. What is the most likely cause?

Accepted Answer

The alertRuleId is a placeholder and does not correspond to a real analytics rule in the environment.. The playbook uses the 'alertRuleId' field as a placeholder, which means it does not reference a real analytics rule in the environment. When the playbook runs, the condition that checks for the specific alert rule ID fails, so the action to create a ServiceNow ticket is skipped, while the notification task (which does not depend on that condition) still executes. In Microsoft Sentinel playbooks, the alertRuleId must match an existing analytics rule's identifier for conditional branching to work correctly.

Answer

The playbook uses an unsupported trigger type.

Answer

The playbook JSON has an invalid structure for the trigger.

Answer

The severity filter is incorrectly specified; it should be an array of strings.

Question 12

You are managing a Microsoft Defender XDR environment. The security team wants to receive email notifications when a new incident is created with severity 'High' or 'Medium'. They also want to ensure that notifications are sent only for incidents that are not automatically resolved by AIR. What should you configure?

Accepted Answer

Create an email notification rule in Microsoft Defender XDR with conditions for severity and status set to 'Active'.. Microsoft Defender XDR allows you to create email notification rules specifically for incidents, with conditions to filter by severity (e.g., High, Medium) and status (e.g., Active). This ensures notifications are sent only for new incidents that are not automatically resolved by AIR, as AIR-resolved incidents would have a status of 'Resolved' or 'Redirected', not 'Active'.

Answer

Create a playbook in Microsoft Sentinel that sends an email when an incident is created.

Answer

Configure an automation rule in Microsoft Sentinel to send email notifications.

Answer

Configure alert service settings in the Microsoft 365 Defender portal to send emails for high and medium severity alerts.

Question 13

Your organization has deployed Microsoft Sentinel. You need to ensure that user and entity behavior analytics (UEBA) is enabled for all data sources. What is the minimum role required to enable UEBA in Microsoft Sentinel?

Accepted Answer

Microsoft Sentinel Contributor. To enable UEBA in Microsoft Sentinel, you need the Microsoft Sentinel Contributor role because it includes the necessary permissions to manage Sentinel settings, including turning on UEBA for all data sources. This role allows you to access the UEBA configuration blade and modify the analytics settings, which is the minimum privilege required for this task.

Answer

Global Administrator

Answer

Security Reader

Answer

Log Analytics Contributor

Question 14

You are responsible for Microsoft Defender for Cloud Apps. The security team reports that they are not receiving alerts for suspicious activities from a specific connected app (Salesforce). You verify that the app is connected and the log collection is working. What should you check next?

Accepted Answer

Ensure that the anomaly detection policy for Salesforce is enabled in Defender for Cloud Apps.. Since the app is connected and log collection is verified, the issue is likely that the anomaly detection policy for Salesforce is disabled. Defender for Cloud Apps uses built-in anomaly detection policies to generate alerts for suspicious activities; if the policy is turned off, no alerts will be raised even though data flows correctly. Enabling the policy ensures that behavioral baselines and threat detection are applied to the Salesforce logs.

Answer

Review the IP address ranges configured for the Salesforce app.

Answer

Check if the Salesforce app connector is properly configured in Microsoft Entra ID.

Answer

Verify that the Salesforce tenant is licensed for Microsoft Entra ID P2.

Question 15

You are using Microsoft Sentinel to manage incidents. You want to automatically close incidents that are older than 90 days and have a status of 'New'. What is the most efficient way to achieve this?

Accepted Answer

Create a playbook that runs on a schedule (e.g., daily) and closes incidents that meet the criteria.. A scheduled playbook can run daily, query all incidents older than 90 days with status 'New', and close them efficiently. Option A is wrong: workbooks are for visualization, not for closing incidents. Option C is wrong: analytics rules generate incidents, but they cannot close incidents after creation. Option D is wrong: automation rules trigger on incident updates, not on a schedule; they would not automatically close incidents that are never updated, and they cannot be set to run periodically without an update event.

Answer

Create a workbook that shows old incidents and manually close them.

Answer

Modify the analytics rule to automatically close incidents after 90 days.

Answer

Create an automation rule that triggers on incident update and closes the incident if the created time is older than 90 days.