SC-200 Manage a security operations environment Practice Test 32 — 15 Questions

Question 1

You are reviewing the automation rule configuration shown in the exhibit. What is the purpose of this rule?

Accepted Answer

Run a playbook to isolate a device when an incident with 'Malware' in the alert title is created. The automation rule is configured to trigger when an incident is created with 'Malware' in the alert title. The action specified is to run a playbook, which in Microsoft Sentinel can perform complex remediation steps such as isolating a device. Option C correctly identifies this combination of trigger condition and action.

Answer

Automatically resolve incidents related to malware

Answer

Automatically close incidents with 'Malware' in the title

Answer

Create a playbook for malware alerts

Question 2

You are reviewing the KQL query shown in the exhibit. What is the purpose of this query?

Accepted Answer

Identify high-severity alert names that occurred more than 10 times in the last 24 hours. The query uses `summarize` with `count()` on `AlertName`, then filters with `where count_ > 10`. This groups high-severity alerts by name and returns only those names that appear more than 10 times in the last 24 hours. The `project` statement outputs only the `AlertName` and its count, confirming the purpose is to identify frequently occurring high-severity alert names.

Answer

Count the number of high-severity alerts per hour

Answer

Return the timestamp of each high-severity alert

Answer

List all high-severity incidents in the last 24 hours

Question 3

You are reviewing the ARM template snippet shown in the exhibit. What is the purpose of this template?

Accepted Answer

Create a saved search in a Log Analytics workspace. The ARM template snippet defines a saved search resource of type 'Microsoft.OperationalInsights/workspaces/savedSearches'. This resource type is specifically used to create a saved query within a Log Analytics workspace, which can then be used for log queries, alert rules, or workbooks. Option C correctly identifies this purpose.

Answer

Create a workbook in Azure Monitor

Answer

Create an analytics rule in Microsoft Sentinel

Answer

Create a data connector in Microsoft Sentinel

Question 4

Your security team needs to assign a custom role in Microsoft Sentinel that allows read and write access to incidents but not to analytics rules. Which built-in role should you use as a base for the custom role?

Accepted Answer

Microsoft Sentinel Responder. The Microsoft Sentinel Responder role is the correct base because it grants read and write access to incidents while explicitly excluding write permissions to analytics rules. This aligns with the requirement for incident management without allowing modifications to detection logic.

Answer

Microsoft Sentinel Reader

Answer

Microsoft Sentinel Contributor

Answer

Global Administrator

Question 5

Your organization uses Microsoft Defender for Cloud to monitor hybrid workloads. You need to ensure that security alerts from on-premises servers are sent to Microsoft Sentinel. What should you configure?

Accepted Answer

Connect the on-premises servers to Azure Arc and deploy the Log Analytics agent.. Azure Arc enables on-premises servers to be managed as Azure resources, allowing the Log Analytics agent to be deployed and configured to forward security alerts to a Log Analytics workspace integrated with Microsoft Sentinel. This is the standard method for ingesting security events from hybrid workloads into Sentinel without requiring third-party connectors or complex network configurations.

Answer

Install a third-party SIEM connector on the servers and forward logs to Sentinel.

Answer

Deploy Azure Policy on the servers to audit security settings.

Answer

Configure a site-to-site VPN to Azure and enable network logging.

Question 6

Your Microsoft Defender XDR environment is experiencing high false positive rates for a specific type of alert. You need to reduce the noise without completely disabling the alert. What is the most effective method?

Accepted Answer

Create a custom detection rule to tune the detection logic.. Creating a custom detection rule allows you to refine the detection logic by adding specific conditions, such as excluding known benign processes or IP addresses, thereby reducing false positives while retaining the alert's core detection capability. This approach directly tunes the detection mechanism rather than masking or disabling it, aligning with the goal of reducing noise without completely disabling the alert.

Answer

Create a suppression rule for the alert.

Answer

Use an automation rule to automatically close the false positive incidents.

Answer

Disable the built-in detection rule.

Question 7

Your security operations center (SOC) uses Microsoft Sentinel. Analysts need to collaborate on incidents by adding comments and changing severity. Which feature should they use?

Accepted Answer

Incident management. Incident management in Microsoft Sentinel provides the built-in capability for SOC analysts to collaborate on incidents by adding comments and changing severity. This feature allows multiple analysts to work on the same incident, track changes, and update the severity level directly within the incident interface, which is essential for effective teamwork and triage.

Answer

Hunting

Answer

Playbooks

Answer

Workbooks

Question 8

Your organization has Microsoft Defender for Office 365 enabled. Users report that phishing emails are being delivered to their inboxes. You need to improve the filtering. What should you do first?

Accepted Answer

Review phishing emails in Threat Explorer and adjust anti-phishing policies.. Reviewing the Threat Explorer in Defender for Office 365 allows you to analyze detected phishing emails and understand why they were delivered, then adjust policies accordingly. Option A is wrong because increasing spam confidence level might block legitimate email. Option C is wrong because disabling third-party connectors doesn't help. Option D is wrong because enabling secure by default is already enabled.

Answer

Increase the spam confidence level threshold.

Answer

Disable third-party email connectors.

Answer

Enable the 'Secure by default' setting in Exchange Online.

Question 9

Your organization uses Microsoft Defender for Cloud Apps. You need to create a policy that alerts when a user downloads more than 10 files from SharePoint in 5 minutes. What type of policy should you create?

Accepted Answer

Activity policy. An Activity policy in Microsoft Defender for Cloud Apps is designed to monitor and respond to specific user activities, such as file downloads from SharePoint, based on predefined thresholds. By configuring the policy with a threshold of more than 10 downloads within 5 minutes, it triggers an alert when the activity exceeds this limit, enabling detection of potential data exfiltration or anomalous user behavior.

Answer

App permissions policy

Answer

Session policy

Answer

Anomaly detection policy

Question 10

Your SOC team uses Microsoft Sentinel's UEBA to detect insider threats. You want to ensure that UEBA can correlate activities across multiple data sources. Which data source must be enabled for UEBA to function properly?

Accepted Answer

Microsoft Entra ID audit logs. Microsoft Sentinel's UEBA relies on Microsoft Entra ID (formerly Azure AD) audit logs as the primary identity source to establish a baseline of user behavior and correlate activities across different data sources. Without these logs, UEBA cannot map activities to specific user identities, which is essential for detecting anomalous behavior patterns indicative of insider threats.

Answer

Azure Activity logs

Answer

Office 365 audit logs

Answer

Windows Security Events

Question 11

Your organization is implementing Microsoft Sentinel. You need to ensure that security events from AWS CloudTrail are collected. What should you configure?

Accepted Answer

AWS S3 connector in Sentinel.. The AWS S3 connector in Microsoft Sentinel is the correct solution because AWS CloudTrail logs are stored in an S3 bucket. Sentinel's native AWS S3 connector ingests these logs by polling the S3 bucket for new CloudTrail events, parsing them into the Sentinel workspace for security monitoring. This is the designated method for collecting CloudTrail data into Sentinel, as documented by Microsoft.

Answer

Azure Policy to audit AWS resources.

Answer

Microsoft Defender for Cloud to monitor AWS.

Answer

A REST API connector to call CloudTrail API.

Question 12

Which THREE actions are recommended practices for managing Microsoft Sentinel costs?

Accepted Answer

Set daily caps on high-volume tables.. Setting daily caps on high-volume tables is a recommended practice because it prevents unexpected cost overruns by limiting the amount of data ingested into expensive tables like SecurityEvent or CommonSecurityLog. Microsoft Sentinel bills per GB ingested, so capping tables that generate large volumes of noise (e.g., verbose Windows event logs) directly controls costs without necessarily impacting security visibility, as critical alerts can still be generated from other sources.

Answer

Ingest all logs to ensure complete visibility.

Answer

Increase retention period to 1 year for all tables.

Question 13

Which TWO permissions are required to create and manage automation rules in Microsoft Sentinel?

Accepted Answer

Microsoft Sentinel Responder. Microsoft Sentinel Contributor (E) is correct because it grants full management of Microsoft Sentinel resources, including creating, editing, and deleting automation rules. Microsoft Sentinel Responder (C) is also correct because it can manage incidents, run playbooks, and create and edit automation rules. Microsoft Sentinel Automation Contributor (B) is not sufficient for a user to create or manage automation rules; it is used to allow the Microsoft Sentinel service to run playbooks triggered by automation rules. Microsoft Sentinel Reader (A) only allows viewing data and incidents, so it cannot create or modify automation rules. Log Analytics Contributor (D) manages the underlying Log Analytics workspace but does not grant the Sentinel-specific permissions needed for automation rules.

Answer

Microsoft Sentinel Reader

Answer

Microsoft Sentinel Automation Contributor

Answer

Log Analytics Contributor

Question 14

Which TWO data connectors are available in Microsoft Sentinel to ingest data from Microsoft 365 services?

Accepted Answer

Microsoft Entra ID. Microsoft Entra ID (formerly Azure Active Directory) is a correct data connector because it ingests sign-in logs, audit logs, and provisioning events from Microsoft's identity service into Microsoft Sentinel. This connector uses the Microsoft Graph API to pull identity-related telemetry, which is essential for monitoring authentication anomalies and privilege escalation.

Answer

Azure Active Directory

Answer

Microsoft Defender for Cloud

Answer

Amazon Web Services

Question 15

Refer to the exhibit. A SOC analyst runs the KQL query in Microsoft Sentinel to identify the top 10 alert names by count. They notice the results include alerts with low severity that are not relevant. What should they add to the query to focus on high-severity alerts only?

Accepted Answer

Add 'where Severity == "High"' before the summarize clause.. In KQL, the `where` clause must be placed before the `summarize` clause to filter raw events before aggregation. Placing `where Severity == "High"` before `summarize` ensures that only high-severity alerts are counted, preventing low-severity alerts from appearing in the top 10 results. This is a fundamental KQL query execution order: filtering first reduces the dataset for aggregation, improving both accuracy and performance.

Answer

Add 'order by Severity' to the query.

Answer

Add 'where Severity == "High"' after the summarize clause.

Answer

Change the time range to last 24 hours.