SC-200 Manage a security operations environment Practice Test 32 — 15 Questions

Question 1

You are managing a Microsoft Defender XDR environment. The security team wants to receive email notifications when a new incident is created with severity 'High' or 'Medium'. They also want to ensure that notifications are sent only for incidents that are not automatically resolved by AIR. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an email notification rule in Microsoft Defender XDR with conditions for severity and status set to 'Active'.. Microsoft Defender XDR allows you to create email notification rules specifically for incidents, with conditions to filter by severity (e.g., High, Medium) and status (e.g., Active). This ensures notifications are sent only for new incidents that are not automatically resolved by AIR, as AIR-resolved incidents would have a status of 'Resolved' or 'Redirected', not 'Active'.

Answer

Create a playbook in Microsoft Sentinel that sends an email when an incident is created.

Answer

Configure an automation rule in Microsoft Sentinel to send email notifications.

Answer

Configure alert service settings in the Microsoft 365 Defender portal to send emails for high and medium severity alerts.

Question 2

Your organization has deployed Microsoft Sentinel. You need to ensure that user and entity behavior analytics (UEBA) is enabled for all data sources. What is the minimum role required to enable UEBA in Microsoft Sentinel?

Accepted Answer

Microsoft Sentinel Contributor. To enable UEBA in Microsoft Sentinel, you need the Microsoft Sentinel Contributor role because it includes the necessary permissions to manage Sentinel settings, including turning on UEBA for all data sources. This role allows you to access the UEBA configuration blade and modify the analytics settings, which is the minimum privilege required for this task.

Answer

Global Administrator

Answer

Security Reader

Answer

Log Analytics Contributor

Question 3

You are responsible for Microsoft Defender for Cloud Apps. The security team reports that they are not receiving alerts for suspicious activities from a specific connected app (Salesforce). You verify that the app is connected and the log collection is working. What should you check next?

Accepted Answer

Ensure that the anomaly detection policy for Salesforce is enabled in Defender for Cloud Apps.. Since the app is connected and log collection is verified, the issue is likely that the anomaly detection policy for Salesforce is disabled. Defender for Cloud Apps uses built-in anomaly detection policies to generate alerts for suspicious activities; if the policy is turned off, no alerts will be raised even though data flows correctly. Enabling the policy ensures that behavioral baselines and threat detection are applied to the Salesforce logs.

Answer

Review the IP address ranges configured for the Salesforce app.

Answer

Check if the Salesforce app connector is properly configured in Microsoft Entra ID.

Answer

Verify that the Salesforce tenant is licensed for Microsoft Entra ID P2.

Question 4

You are using Microsoft Sentinel to manage incidents. You want to automatically close incidents that are older than 90 days and have a status of 'New'. What is the most efficient way to achieve this?

Accepted Answer

Create a playbook that runs on a schedule (e.g., daily) and closes incidents that meet the criteria.. A scheduled playbook can run daily, query all incidents older than 90 days with status 'New', and close them efficiently. Option A is wrong: workbooks are for visualization, not for closing incidents. Option C is wrong: analytics rules generate incidents, but they cannot close incidents after creation. Option D is wrong: automation rules trigger on incident updates, not on a schedule; they would not automatically close incidents that are never updated, and they cannot be set to run periodically without an update event.

Answer

Create a workbook that shows old incidents and manually close them.

Answer

Modify the analytics rule to automatically close incidents after 90 days.

Answer

Create an automation rule that triggers on incident update and closes the incident if the created time is older than 90 days.

Question 5

Your organization uses Microsoft Defender for Identity. The security team wants to monitor for suspected DCSync attacks. Which Windows Event ID should you monitor to detect DCSync activity?

Accepted Answer

Event ID 4662: An operation was performed on an object.. Event ID 4662 logs any operation performed on an Active Directory object, including the directory service access control entry for the DS-Replication-Get-Changes-All extended right (control access right 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2). A DCSync attack uses this right to replicate domain credentials from a domain controller, so monitoring 4662 with the specific object type and access mask for replication is the correct detection method.

Answer

Event ID 4776: The domain controller attempted to validate the credentials for an account.

Answer

Event ID 4648: A logon was attempted using explicit credentials.

Answer

Event ID 4624: An account was successfully logged on.

Question 6

You are configuring Microsoft Sentinel to ingest data from multiple sources. Which TWO of the following are valid data connectors that can be used to ingest AWS CloudTrail logs?

Accepted Answer

Azure Functions connector. The AWS S3 connector (Option C) is a valid data connector for ingesting AWS CloudTrail logs into Microsoft Sentinel by reading the logs directly from an S3 bucket. The Azure Functions connector (Option A) is also valid because it can be configured to trigger on CloudTrail log delivery to S3, using a function app to parse and forward the logs to Sentinel via the Log Analytics HTTP Data Collector API.

Answer

Office 365 connector

Answer

Microsoft Defender for Cloud connector

Answer

Syslog connector

Question 7

You are managing Microsoft Defender for Endpoint. Which TWO actions can be taken directly from the Microsoft 365 Defender portal to respond to a compromised device?

Accepted Answer

Run a full antivirus scan on the device.. The Microsoft 365 Defender portal allows security operators to initiate a full antivirus scan on a compromised device directly from the device's action menu. This leverages Microsoft Defender Antivirus to detect and remediate threats without requiring local user interaction, providing an immediate response capability within the unified security operations interface.

Answer

Block the user's sign-in from Microsoft Entra ID.

Answer

Remotely wipe the device.

Answer

Reset the device's local administrator password.

Question 8

You are configuring Microsoft Sentinel analytics rules. Which THREE of the following are valid types of analytics rules in Microsoft Sentinel?

Accepted Answer

Fusion rule. Fusion rule is correct because it is a valid Microsoft Sentinel analytics rule type that uses advanced machine learning algorithms to correlate multiple low-fidelity security alerts across different products into high-fidelity incidents. It is designed to detect multi-stage attacks by combining signals from various sources like Microsoft Defender for Endpoint, Azure Active Directory, and Microsoft Cloud App Security, reducing alert fatigue.

Answer

Watchlist rule

Answer

Playbook rule

Question 9

You are a security operations analyst for a large enterprise with a hybrid environment. Your organization uses Microsoft Sentinel as the central SIEM, Microsoft Defender for Cloud for Azure workloads, Microsoft Defender for Endpoint for endpoints, and Microsoft Defender for Identity for on-premises Active Directory. Recently, the security team has been overwhelmed by a high volume of low-severity incidents from Defender for Cloud that are not actionable. These incidents are generated from the built-in 'ASC Default' policy initiative. You need to reduce the noise without disabling the entire policy. The security team still wants to be alerted on high-severity incidents. You have been asked to implement a solution that automatically suppresses low-severity incidents from Defender for Cloud but still allows high-severity ones to be created in Sentinel. You must not modify the policy initiative itself. What should you do?

Accepted Answer

Create an automation rule that triggers when an incident is created from Defender for Cloud with severity Low or Medium, and set the status to Closed.. Creating an automation rule that triggers on incident creation from Defender for Cloud with severity Low or Medium and sets the status to 'Closed' reduces noise from low-severity incidents while still allowing high-severity incidents to appear. Option A is incorrect because adding a new analytics rule does not suppress the incidents generated by the built-in 'ASC Default' rule. Option B is incorrect because the built-in 'ASC Default' analytics rule cannot be modified; it is tied to the data connector. Option C is incorrect because disabling the data connector stops all Defender for Cloud incidents, including high-severity ones.

Answer

Create a new analytics rule that creates incidents only for high-severity alerts from Defender for Cloud.

Answer

Modify the 'ASC Default' analytics rule in Sentinel to only trigger on high-severity alerts.

Answer

Turn off the Defender for Cloud data connector in Sentinel.

Question 10

You are the lead security operations analyst for a company that uses Microsoft Defender XDR. The company has recently deployed Microsoft Copilot for Security to help analysts investigate incidents. During a recent incident involving a potential ransomware attack on multiple devices, the analysts used Copilot to generate an investigation summary and recommended actions. However, the analysts report that Copilot's responses are not specific to the incident; they are generic and do not include device-specific details. You need to ensure that Copilot provides context-aware responses that include specific device information from the incident. What should you do?

Accepted Answer

Instruct analysts to use the 'Investigate' capability in Copilot and provide the incident ID.. To get context-aware responses with device-specific details, analysts must use the 'Investigate' capability within Copilot and provide the incident ID. This enables Copilot to retrieve and analyze data specific to that incident, including device information from Defender XDR. Option A is incorrect because assigning a role in Entra ID does not affect Copilot's access to incident details. Option B is incorrect because the Defender XDR data connector in Sentinel is for ingesting data into Sentinel, not for providing context to Copilot. Option D is incorrect because Copilot does not rely on custom plugins for this functionality; the built-in 'Investigate' capability is designed for this purpose.

Answer

Assign the Microsoft 365 Defender role to the analysts in Microsoft Entra ID.

Answer

Enable the Microsoft Defender XDR data connector in Microsoft Sentinel.

Answer

Configure a custom plugin in Copilot to fetch device data from Defender XDR.

Question 11

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You are configuring a new automation rule in Sentinel to automatically assign incidents to the appropriate SOC tier based on severity: Low and Medium to Tier 1, High to Tier 2, and Critical to Tier 3. You have created three separate automation rules, one for each tier. However, only the rule for Critical incidents is working. The other rules do not assign incidents. You verify that the other rules are enabled and have the correct conditions. What is the most likely cause?

Accepted Answer

The automation rule for Critical incidents has a higher order number and is processed first, preventing other rules from running.. Automation rules in Microsoft Sentinel are processed in ascending order of their order number (lowest number runs first). When a rule triggers, it can optionally be configured to stop processing subsequent rules. In this scenario, the rule for Critical incidents likely has a lower order number (higher priority) and is set to stop processing further rules. If its conditions are too broad (e.g., triggered on all incidents), it will match and assign the incident, then stop processing. This prevents the rules for Tier 1 and Tier 2 from ever running, even for incidents that should be assigned to those tiers. Therefore, the most likely cause is that the Critical rule has a higher priority and is processed first, preventing the other rules from executing. Option B is correct.

Answer

The automation rules for Tier 1 and Tier 2 are set to trigger on incident update instead of creation.

Answer

The SOC Tier 1 and Tier 2 users do not have the appropriate permissions to own incidents.

Answer

Automation rules cannot be created separately for each severity; you must use a single rule with multiple conditions.

Question 12

Your organization uses Microsoft Sentinel and has enabled UEBA. A security analyst observes that a user account with no prior administrative activity performed a high volume of Azure Resource Manager operations. The analyst wants to investigate further. Which Microsoft Sentinel feature should the analyst use to quickly identify if this behavior is anomalous based on the user's historical profile?

Accepted Answer

User and Entity Behavior Analytics (UEBA). UEBA is the correct feature because it builds a behavioral baseline for each user over time, including typical Azure Resource Manager activity patterns. When a user with no prior administrative history suddenly performs a high volume of ARM operations, UEBA can flag this as anomalous by comparing the current activity against the user's historical profile, surfacing the deviation in the UEBA investigation pane without requiring custom query creation.

Answer

Hunting queries

Answer

Workbooks

Answer

Analytics rules

Question 13

You are a Microsoft Security Operations Analyst. Your organization recently deployed Microsoft Defender for Cloud Apps. You need to ensure that alerts generated by Defender for Cloud Apps are automatically forwarded to Microsoft Sentinel. What should you configure?

Accepted Answer

In Microsoft Sentinel, add the Microsoft Defender for Cloud Apps data connector.. The Microsoft Defender for Cloud Apps data connector in Microsoft Sentinel is the native integration that automatically forwards alerts and cloud discovery logs from Defender for Cloud Apps into Sentinel. This connector uses the Microsoft Graph Security API to ingest alerts without requiring additional configuration in Defender for Cloud Apps, enabling seamless correlation and investigation within Sentinel.

Answer

In Microsoft Sentinel, create an analytics rule with a query that pulls data from Defender for Cloud Apps API.

Answer

In Microsoft Defender for Cloud Apps, configure SIEM integration.

Answer

In Microsoft Sentinel, configure a playbook to retrieve alerts from Defender for Cloud Apps.

Question 14

Your organization uses Microsoft Defender for Identity. You need to monitor for potential lateral movement attacks using pass-the-hash techniques. Which entity type in Microsoft Defender for Identity should you focus on in the security alert timeline?

Accepted Answer

Account. In Microsoft Defender for Identity, lateral movement attacks using pass-the-hash (PtH) techniques are tracked at the account entity level because the attacker reuses a stolen NTLM hash to authenticate as a specific user account across multiple devices. The security alert timeline groups related activities by the compromised account, enabling analysts to trace the attacker's steps from the initial breach to subsequent resource access. Focusing on the account entity provides the clearest view of the authentication attempts and successful logons that indicate PtH behavior.

Answer

IP address

Answer

Device

Answer

Computer

Question 15

A company uses Microsoft Sentinel with the Microsoft 365 Defender connector. The security team notices that alerts from Microsoft Defender for Endpoint (MDE) are not appearing in Sentinel. The MDE data connector status shows 'Connected'. Which step should you take to troubleshoot this issue?

Accepted Answer

Check the Microsoft 365 Defender portal to ensure MDE alerts are being generated and forwarded to Microsoft 365 Defender.. The Microsoft 365 Defender connector in Microsoft Sentinel ingests alerts that have already been generated and forwarded by Microsoft Defender for Endpoint (MDE) to the Microsoft 365 Defender portal. Even if the connector status shows 'Connected', if MDE alerts are not being generated or forwarded to Microsoft 365 Defender (e.g., due to a licensing issue, misconfigured alert policy, or service health problem), they will never reach Sentinel. Therefore, the first troubleshooting step is to verify alert generation and forwarding at the source in the Microsoft 365 Defender portal.

Answer

Verify that the Microsoft 365 Defender connector is configured to ingest MDE alerts.

Answer

Check if the Microsoft Defender for Endpoint data connector is added.

Answer

Verify that the ingestion rules in Sentinel are not filtering out MDE alerts.