SC-200 Manage a security operations environment Practice Test 33 — 15 Questions

Question 1

Refer to the exhibit. You are deploying a Microsoft Sentinel workspace using an ARM template. After deployment, you notice the workspace is in a disabled state for ingesting data. Which parameter is most likely causing this?

Accepted Answer

The dailyQuotaInGB parameter sets a daily cap that may have been exceeded. Option D is correct because the 'dailyQuotaInGB' parameter sets a daily cap on data ingestion. If the cap is reached, ingestion stops until the next day. The workspace will be in a disabled state. Option A is the workspace name, not an issue. Option B is location, irrelevant. Option C is retention, not ingestion.

Answer

The location parameter is set to 'eastus' but Sentinel is not available in that region

Answer

The retentionInDays parameter is set to 90, which is less than the default 30 days

Answer

The workspaceName parameter is set to 'SentinelWorkspace' but the name must be globally unique

Question 2

Refer to the exhibit. You have an analytics rule in Microsoft Sentinel that uses this KQL query. The rule is configured to run every hour and alert when the result count is greater than 0. Which type of attack is this rule most likely detecting?

Accepted Answer

Brute force attack on user accounts. Option A is correct because the query looks for users with high-risk sign-ins (both during and aggregated) and counts them; more than 5 high-risk sign-ins in a day suggests a brute force attempt where many failed attempts lead to high risk. Option B would be more about unusual locations. Option C would be about many downloads. Option D would be about privilege escalation.

Answer

Privileged account misuse

Answer

Data exfiltration via sign-in

Answer

Account takeover from a new location

Question 3

Your organization uses Microsoft Sentinel in a hybrid environment with on-premises servers and Azure VMs. You need to ensure that all Windows servers forward their security events to Sentinel. The security team wants to use Windows Security Events via AMA connector. Windows servers are not domain-joined and are managed by a third-party RMM tool. What is the most efficient way to deploy the AMA agent?

Accepted Answer

Onboard the servers to Azure Arc and deploy the AMA agent via policy or script.. Option B is correct because deploying via Azure Arc allows centralized management using Azure policies or scripts for non-domain-joined servers. Option A is wrong because GPO requires domain membership. Option C is wrong because Microsoft Intune typically manages Azure VMs, not on-premises non-domain-joined servers. Option D is wrong because manual installation is not efficient for multiple servers.

Answer

Use Group Policy Objects (GPO) to push the agent installation.

Answer

Use Microsoft Intune to deploy the AMA agent to all servers.

Answer

Manually install the agent on each server using the setup wizard.

Question 4

You are a SOC analyst using Microsoft Sentinel. You have a scheduled analytics rule that generates incidents from KQL queries. Recently, incidents are being created but automatically closed within minutes without any actions taken. You suspect a configuration issue. What should you check first?

Accepted Answer

Review the incident automation rules that might have a 'Close incident' action triggered by a condition.. Option A is correct because incident automation rules can close incidents based on conditions. Option B is wrong because suppression is about preventing alerts. Option C is wrong because alert grouping affects how alerts are combined, not closure. Option D is wrong because entity mapping does not close incidents.

Answer

Verify the 'Alert grouping' settings in the analytics rule; they might be grouping alerts incorrectly.

Answer

Check if the analytics rule has a 'Suppression' setting enabled that causes the incident to close.

Answer

Examine the entity mapping configuration; it might be causing the incident to close automatically.

Question 5

You are configuring Microsoft Defender for Cloud Apps to enhance visibility into your organization's SaaS app usage. You need to ensure that risky user activities are automatically suspended. What should you configure?

Accepted Answer

Create a session policy to block or limit activities based on risk.. Option B is correct because session policies allow real-time control of user sessions based on risk level. Option A is wrong because app discovery only identifies apps used. Option C is wrong because file policies govern data protection. Option D is wrong because IP address ranges are used for location-based policies, not activity control.

Answer

Set up IP address range policies.

Answer

Configure app discovery policies.

Answer

Define file policies to protect sensitive data.

Question 6

Your organization uses Microsoft Sentinel with a Log Analytics workspace in the East US region. You have deployed the Microsoft Defender for Cloud connector. You notice that security alerts from Defender for Cloud are not appearing as incidents in Sentinel. You have confirmed that the connector is enabled and data is flowing. What is the most likely cause?

Accepted Answer

You need to create an analytics rule with a rule template that uses the SecurityAlert table.. Option C is correct because analytics rules must be created to generate incidents from alerts. Option A is wrong because the connector is working. Option B is wrong because incident creation is not automatic from the connector alone. Option D is wrong because permissions are not the issue if data is flowing.

Answer

The Sentinel workspace does not have required permissions to create incidents.

Answer

There is a delay in incident creation; wait for 24 hours.

Answer

The Microsoft Defender for Cloud connector is not properly configured.

Question 7

Your organization uses Microsoft Defender for Office 365. You need to ensure that when a user reports a phishing email via the built-in Outlook add-in, an automated investigation is triggered in Microsoft 365 Defender. What should you configure?

Accepted Answer

Enable user-reported message settings in the Microsoft 365 Defender portal.. Option D is correct because the user-reported message settings define how reported emails trigger automated actions. Option A is wrong because anti-phishing policies protect against phishing, not handling user reports. Option B is wrong because safe attachments policies handle attachments. Option C is wrong because safe links policies handle URLs.

Answer

Define a safe links policy.

Answer

Configure an anti-phishing policy.

Answer

Set up a safe attachments policy.

Question 8

You are a security administrator for a multinational company using Microsoft Sentinel. You need to ensure that critical incidents are automatically escalated to the on-call team via email and SMS. The on-call schedule uses Microsoft Teams channel. What is the most efficient way to achieve this?

Accepted Answer

Build a playbook using Microsoft Teams connector to post a message in the on-call channel with an adaptive card that allows acknowledge and escalate.. Option B is correct because Playbook with Teams connector can send adaptive cards and use logic for escalation. Option A is wrong because automation rules alone cannot send SMS. Option C is wrong because an analytics rule only triggers incidents. Option D is wrong because workbooks are for visualization, not automation.

Answer

Create an automation rule that sends email directly to the on-call team.

Answer

Configure the analytics rule to send an email when the incident is created.

Answer

Use a workbook to display critical incidents and expect the team to monitor it.

Question 9

Your organization uses Microsoft Defender for Endpoint. You need to ensure that when a high severity alert is generated, an automated investigation is launched immediately. What is the correct configuration?

Accepted Answer

In Microsoft 365 Defender, configure automated investigation and response settings to automatically investigate alerts.. Option A is correct because automated investigation settings in Microsoft 365 Defender configure the automation level. Option B is wrong because alert suppression does not start investigation. Option C is wrong because indicators are for threat intelligence. Option D is wrong because advanced hunting is a query tool, not automated response.

Answer

Create a custom indicator in Microsoft Defender for Endpoint.

Answer

Use advanced hunting to create a custom detection rule.

Answer

In Microsoft Defender for Endpoint, set up an alert suppression rule.

Question 10

Your organization uses Microsoft Sentinel and has enabled UEBA (User and Entity Behavior Analytics). You notice that the UEBA timeline is not populating for some users. You have verified that the data sources are connected and the UEBA feature is enabled. What could be the issue?

Accepted Answer

There is insufficient data to build baselines for those users; UEBA needs at least 14 days of data.. Option C is correct because UEBA requires a minimum amount of data over time to establish baselines. Option A is wrong because UEBA does not require user consent. Option B is wrong because data is flowing. Option D is wrong because UEBA uses existing data.

Answer

Users must opt in to UEBA tracking.

Answer

UEBA only works with Azure Active Directory (now Microsoft Entra ID) audit logs.

Answer

The data sources are not sending logs for those users.

Question 11

Your organization is implementing Microsoft Sentinel and needs to ensure that incident response activities are compliant with regulatory requirements. You need to track and document all changes made to analytics rules and playbooks. Which TWO features should you enable?

Accepted Answer

Activity logs (Azure Monitor). Option B and E are correct because Change tracking tracks resource modifications, and audit logs record user actions. Option A is wrong because Microsoft Purview is for data governance, not Sentinel changes. Option C is wrong because workbooks are for visualization. Option D is wrong because automation rules do not log changes themselves.

Answer

Sentinel workbooks

Answer

Automation rules

Answer

Microsoft Purview Compliance Manager

Question 12

Your organization uses Microsoft Defender XDR (formerly Microsoft 365 Defender). You need to configure role-based access control (RBAC) for the security team. Which TWO built-in roles can be assigned in Microsoft 365 Defender to manage incidents and alerts?

Accepted Answer

Security Operator. Option A and B are correct as these roles can manage incidents and alerts. Option C is wrong because Security Reader is read-only. Option D is wrong because Compliance Administrator manages compliance. Option E is wrong because Global Administrator is too broad.

Answer

Global Administrator

Answer

Compliance Administrator

Answer

Security Reader

Question 13

Your organization uses Microsoft Sentinel and you are designing a data retention strategy. You have a Log Analytics workspace with the following tables: SecurityEvent, SigninLogs, and CommonSecurityLog. The compliance team requires that SigninLogs be retained for 7 years, while other tables can be retained for 1 year. Which THREE steps must you take to meet this requirement?

Accepted Answer

Set the workspace retention to 7 years.. Option A, B, and D are correct. Option A is required to set workspace retention to the maximum (7 years) to allow for table-level retention. Option B is required to configure table-level retention for SigninLogs. Option D is required because the compliance team needs to retain for 7 years. Option C is wrong because archiving is not needed if retention is set to 7 years. Option E is wrong because interactive retention can be set to 7 years without archiving.

Answer

Set an archiving policy to move SigninLogs to cold storage after 1 year.

Answer

Enable Azure Data Explorer (ADX) for long-term storage.

Question 14

Your organization has multiple offices across the globe and uses Microsoft Sentinel as the primary SIEM. You have deployed Azure Arc on all on-premises servers to manage them centrally. The security team needs to collect Windows Security Events from all servers, including domain controllers, and forward them to Sentinel using the Windows Security Events via AMA connector. The team also wants to minimize administrative overhead when adding new servers. The current environment includes: 500 on-premises Windows servers (200 domain controllers, 300 member servers) managed via Azure Arc, 200 Azure VMs running Windows Server, and a centralized Log Analytics workspace named 'LAW-Security' in the East US region. You have already installed the Azure Monitor Agent (AMA) on all servers via Azure Arc and Azure VMs. However, you notice that security events from domain controllers are not appearing in Sentinel. You have verified that the AMA agent is running and the data collection rule (DCR) is correctly configured to collect Security events. No other issues are present. You need to ensure that security events from domain controllers are collected. What should you do?

Accepted Answer

Check the network connectivity from the domain controllers to the Log Analytics workspace endpoint. Ensure that the domain controllers can reach the required URLs.. Option A is correct because domain controllers often have restricted network access; they need to be able to reach the Log Analytics workspace endpoint. Option B is wrong because the DCR is already correctly configured. Option C is wrong because restarting the agent is not the solution. Option D is wrong because the connector is already working for other servers.

Answer

Reinstall the Windows Security Events via AMA connector in Sentinel.

Answer

Restart the Azure Monitor Agent on all domain controllers.

Answer

Recreate the data collection rule with a different namespace.

Question 15

Your organization uses Microsoft Defender for Endpoint (MDE) and Microsoft Sentinel. You have configured the Microsoft Defender for Endpoint connector in Sentinel to ingest alerts and incidents. The security team wants to automatically create a Sentinel incident when an MDE alert of severity 'High' or 'Critical' is generated. Additionally, they want to assign the incident to a specific SOC tier based on the alert title. For example, if the alert title contains 'Ransomware', assign to Tier 3; otherwise assign to Tier 2. You need to implement this automation efficiently. You have already enabled the connector and verified that MDE alerts are flowing into Sentinel. What is the best approach?

Accepted Answer

Create an automation rule that triggers on incident creation for High and Critical severity. The rule runs a playbook that uses Logic Apps to parse the alert title and assign the incident to the appropriate tier using the Microsoft Sentinel connector 'Update incident' action.. Option B is correct because it uses a playbook triggered by an automation rule on incident creation, which can then parse the alert title and assign the incident. Option A is wrong because automation rules cannot assign based on alert content directly. Option C is wrong because it's not efficient to modify the analytics rule. Option D is wrong because automation rules cannot assign owners directly based on dynamic conditions.

Answer

Create an automation rule that triggers when an incident is created with a condition on alert severity, and set the owner to the appropriate group. Then create another automation rule for 'Ransomware' alerts.

Answer

Configure an automation rule with a condition on the alert title using KQL, then set the owner.

Answer

Modify the Microsoft Defender for Endpoint analytics rule to include a custom mapping that assigns the incident to a specific owner based on the alert title.

SC-200 Manage a security operations environment Practice Test 33 — 15 Questions

Exhibit

SC-200 Manage a security operations environment Practice Test 33 — 15 Questions

Exhibit