SC-200 Manage a security operations environment Practice Test 32 — 15 Questions

Question 1

Which THREE of the following are capabilities of Microsoft Defender XDR's automated investigation and response (AIR) that can be enabled or configured by a security operations analyst? (Choose three.)

Accepted Answer

Automatically block an email message or attachment.. Options A, C, and D are correct. AIR can automatically take remediation actions like isolating devices (A), suspend users (C), and block email messages (D). Option B is wrong because AIR does not automatically create analytics rules; that's a Sentinel feature. Option E is wrong because AIR does not modify DLP policies; that's Purview.

Answer

Automatically modify Data Loss Prevention policies.

Answer

Automatically create new analytics rules based on incident patterns.

Question 2

Which TWO of the following are required to enable Microsoft Sentinel to receive alerts from Microsoft Defender for Cloud? (Choose two.)

Accepted Answer

Install the 'Microsoft Defender for Cloud' data connector in Microsoft Sentinel.. Options A and B are correct. You need to enable the connector in Sentinel (A) and ensure Defender for Cloud is enabled on the subscription (B). Option C is optional for multi-cloud, not required. Option D is wrong because Defender for Cloud generates alerts without Azure Policy. Option E is wrong because the Log Analytics agent is not needed for Defender for Cloud alerts.

Answer

Deploy the Log Analytics agent on all VMs.

Answer

Connect a non-Azure machine using Azure Arc.

Answer

Assign an Azure Policy to enable Defender for Cloud.

Question 3

Your organization uses Microsoft Sentinel and Microsoft Defender for Cloud. You need to ensure that security incidents from Defender for Cloud are automatically sent to Sentinel. What should you configure?

Accepted Answer

Configure the Microsoft Defender for Cloud data connector. The data connector 'Microsoft Defender for Cloud' (formerly Azure Security Center) in Sentinel enables continuous ingestion of alerts and incidents. Option B is correct. Option A is a legacy connector for Azure Active Directory (now Entra ID). Option C is for Microsoft 365 Defender. Option D is a custom connector that requires extra setup.

Answer

Configure the Azure Active Directory data connector

Answer

Create an Azure Event Hub and push Defender for Cloud alerts to Sentinel via a custom connector

Answer

Configure the Microsoft 365 Defender data connector

Question 4

A security analyst receives a high-severity incident in Microsoft Sentinel for a user who is suspected of lateral movement. The analyst wants to automatically run a playbook that isolates the user's machine and disables their account when such an incident is created. What is the most efficient way to achieve this?

Accepted Answer

Create an automation rule that triggers the playbook when the incident is created. Option D is correct because it uses an automation rule to trigger the playbook on incident creation, which is the recommended approach. Option A and B add unnecessary latency. Option C is manual and not automated.

Answer

Configure a Logic Apps trigger to poll for new incidents every minute

Answer

Train analysts to manually run the playbook when they see the incident

Answer

Create an analytics rule that runs a playbook as part of its alert generation

Question 5

Your company is deploying Microsoft Defender for Endpoint. You need to ensure that all devices report their security baseline compliance to Microsoft Intune. Which configuration should you use?

Accepted Answer

Assign a Security Baseline policy in Microsoft Intune to the device groups. Option A is correct because Security Baselines in Intune allow you to assess and enforce compliance. Option B is for device-level configuration, but not specifically for baseline compliance. Option C is for Defender for Cloud Apps, not endpoints. Option D is for Windows Update, not baseline compliance.

Answer

Configure a device configuration profile in Microsoft Intune

Answer

Deploy Windows Update for Business reports

Answer

Enable Microsoft Defender for Cloud Apps session controls

Question 6

You manage a Microsoft Sentinel workspace with multiple analytics rules. You notice that an analytics rule has not generated any alerts in the past month despite relevant data being ingested. The rule uses a custom KQL query that joins two tables. What is the most likely cause?

Accepted Answer

The join condition in the KQL query is incorrect, resulting in no matching records. Option C is correct because a missing join field would prevent any results from the KQL query, leading to no alerts. Option A is less likely because the rule would still run. Option B would cause an error, not just silence. Option D would generate alerts on other data.

Answer

The rule is using an unsupported KQL function

Answer

The data connector for the tables is disabled

Answer

The rule is running on a schedule of 5 minutes but the data arrives every hour

Question 7

You are configuring Microsoft Defender for Cloud Apps. You need to create a policy that alerts when a user downloads more than 100 files in 10 minutes from SharePoint. Which policy type should you use?

Accepted Answer

Activity policy. Option B is correct because Activity policies in Microsoft Defender for Cloud Apps allow you to define conditions based on a single activity or multiple activities from a user. Option A is for OAuth apps. Option C is for detecting anomalous file sharing. Option D is for cloud discovery.

Answer

Anomaly detection policy

Answer

File policy

Answer

Cloud discovery policy

Question 8

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You want to use a Microsoft Copilot for Security to summarize an incident in Microsoft Defender XDR. What is the minimum role required?

Accepted Answer

Security Reader. Option A is correct because the Security Reader role can view incidents but not edit; Copilot for Security requires at least Security Reader to access incident data. Option B is overly permissive for just viewing summaries. Option C is for managing security settings. Option D is an Azure role, not a Microsoft 365 role.

Answer

Security Administrator

Answer

Reader

Answer

Global Administrator

Question 9

You have a Microsoft Sentinel workspace that ingests logs from multiple sources. The log analytics workspace is in the East US region. You have a requirement to keep logs for 90 days for active investigation, then archive them to an Azure storage account for compliance for 5 years. What should you configure?

Accepted Answer

Set the retention period to 90 days and configure a data export rule to send logs older than 90 days to Azure Blob Storage. Option C is correct because Azure Log Analytics allows you to set a retention policy and then enable data archiving to Azure storage using a data export rule. Option A deletes logs after 90 days. Option B is for interactive retention only. Option D is for diagnostic settings, not for archiving after retention.

Answer

Set the retention period to 5 years and use purging for data older than 90 days

Answer

Set the retention period to 90 days and enable 'Archive' in the workspace retention settings

Answer

Configure diagnostic settings to send logs to storage with a retention of 90 days

Question 10

Your security team uses Microsoft Defender for Cloud to assess the security posture of Azure resources. You need to ensure that all virtual machines have endpoint protection enabled. Which policy initiative should you assign?

Accepted Answer

Deploy Microsoft Defender for Endpoint. Option B is correct because the 'Deploy Microsoft Defender for Endpoint' policy initiative includes policies to install and configure endpoint protection on VMs. Option A is about monitoring logs. Option C is about security configuration baselines. Option D is about storage encryption.

Answer

Enable encryption on Azure VMs

Answer

Deploy Windows Defender Exploit Guard

Answer

Azure Security Benchmark

Question 11

You are a security analyst. An incident in Microsoft Sentinel is assigned to you. The incident contains multiple alerts. You want to group related alerts into a single incident to reduce noise. What feature should you use?

Accepted Answer

Incident grouping settings in the analytics rule. Option C is correct because incident grouping settings in analytics rules allow you to group alerts into a single incident based on criteria like entities or time window. Option A is for incident management, not grouping. Option B is for automating actions. Option D is for enriching alerts with threat intelligence.

Answer

Automation rules

Answer

Threat intelligence indicators

Answer

Incident details tab

Question 12

Which TWO actions require the Global Administrator role in Microsoft 365?

Accepted Answer

Configure tenant-wide settings in Microsoft 365. Correct options are A and B because managing roles in Azure AD (Entra ID) and configuring Microsoft 365 tenant-level settings both require Global Administrator. Option C can be done by Security Administrator. Option D can be done by Security Reader. Option E can be done by Compliance Administrator.

Answer

Create a data loss prevention (DLP) policy in Microsoft Purview

Answer

Create a custom role in Microsoft Defender XDR

Answer

View the Microsoft 365 Defender incident queue

Question 13

Which THREE actions can you perform using Microsoft Sentinel automation rules?

Accepted Answer

Run a playbook. Correct options are A, B, and D. Automation rules can change incident severity, assign incidents, and run playbooks. Option C is done by analytics rule templates, not automation rules. Option E is done by threat intelligence indicators.

Answer

Create a new analytics rule

Answer

Add threat intelligence indicators to Sentinel

Question 14

Which TWO Microsoft 365 security solutions include capabilities for managing security incidents?

Accepted Answer

Microsoft Defender XDR. Correct options are A and B. Microsoft Sentinel is a SIEM that manages incidents, and Microsoft Defender XDR has an incident management queue. Option C is for endpoint management. Option D is for compliance. Option E is for identity protection but not incident management in the same sense.

Answer

Microsoft Intune

Answer

Microsoft Entra ID Protection

Answer

Microsoft Purview

Question 15

Refer to the exhibit. You are reviewing an analytics rule in Microsoft Sentinel. The rule is enabled but has not generated any alerts in the past 24 hours. What is the most likely cause?

Accepted Answer

Suppression is enabled with a duration of 6 hours, which may be suppressing new alerts after the first one. Option C is correct. The suppression is enabled with a duration of 6 hours, meaning after an alert is generated, no new alerts are created for the same rule for 6 hours. If an alert was generated yesterday, suppression could prevent new alerts. Option A is possible but less likely because the query uses 'unknown' location which may still match. Option B is not an issue; the rule will run every hour. Option D is not a problem.

Answer

The triggerThreshold is set to 0, which means no alerts will be generated

Answer

The queryFrequency is 1 hour and the queryPeriod is 7 days, which is a mismatch

Answer

The query uses 'Location == Unknown' but the actual sign-in location is not 'Unknown'