SC-200 Manage a security operations environment Practice Test 33 — 15 Questions

Question 1

Your organization plans to use Microsoft Sentinel for incident management. Which TWO are native incident management features in Sentinel?

Accepted Answer

Incident comments and collaboration. Microsoft Sentinel provides native incident comments and collaboration features that allow analysts to add notes, tag team members, and maintain a running audit trail directly within the incident record. This is a built-in capability, not requiring any external integration or additional licensing.

Answer

Automated email notifications on incident creation

Answer

Integration with ServiceNow via out-of-the-box connector

Answer

Integration with Microsoft Teams for incident chat

Question 2

You are configuring Microsoft Defender for Cloud Apps with Cloud Discovery. You need to ensure that logs from your network proxies are processed correctly. Which THREE steps are required?

Accepted Answer

Upload the log files manually or configure automatic log upload using the log collector.. Microsoft Defender for Cloud Apps Cloud Discovery requires log data from network proxies to be ingested either by manually uploading log files or by configuring automatic log upload via the log collector. The log collector is a Docker-based container that parses and normalizes proxy logs before forwarding them to Defender for Cloud Apps, enabling shadow IT discovery without manual intervention.

Answer

Install the Microsoft Defender for Cloud Apps connector in Sentinel.

Answer

Enable Azure Information Protection for labeling.

Question 3

Your organization uses Microsoft Sentinel and wants to reduce alert fatigue. Which TWO actions should you take to improve the quality of incidents?

Accepted Answer

Configure alert grouping in analytics rules to combine related alerts into one incident.. Configuring alert grouping in analytics rules consolidates multiple related alerts into a single incident, reducing noise and helping analysts focus on the root cause rather than triaging individual alerts. This directly improves incident quality by providing a richer context and reducing alert fatigue.

Answer

Create separate incidents for each alert.

Answer

Create automation rules to close all low-severity incidents automatically.

Answer

Increase the severity of all low-severity alerts to high.

Question 4

You are investigating a phishing incident in Microsoft Defender for Office 365. Which THREE pieces of information are available in the Threat Explorer?

Accepted Answer

Sender IP address. Sender IP address is available in Threat Explorer because it is a core property of email message trace data in Microsoft Defender for Office 365. Threat Explorer captures the originating IP address from the SMTP session header, which is essential for identifying the source of a phishing attack and correlating with threat intelligence feeds.

Answer

Email body content

Answer

User's mailbox audit log

Question 5

You are a Microsoft Security Operations Analyst for a large enterprise with 50,000 users. Your organization uses Microsoft Defender XDR, Microsoft Sentinel, and Microsoft Defender for Cloud Apps. The security team has observed an increase in alerts related to SaaS applications (e.g., Box, Salesforce) accessed from unusual locations. You need to design a solution to automatically investigate and respond to these alerts. The solution should: (1) correlate user activity across multiple SaaS apps, (2) automatically isolate a user's account if the risk score exceeds 90, and (3) create an incident in Sentinel. Which approach should you use?

Accepted Answer

Configure Microsoft Defender for Cloud Apps to use session policies that require reauthentication or block access when risk is high, and stream alerts to Sentinel.. Microsoft Defender for Cloud Apps provides session policies that can automatically block access or require reauthentication when risk is high, and it streams alerts to Microsoft Sentinel to create incidents. This meets all requirements: correlating activity across SaaS apps, automatic response based on risk score, and incident creation in Sentinel. Option A requires manual trigger, which is not automated. Option B focuses on endpoint device risk, not SaaS application activity. Option D involves creating separate analytics rules per app and a playbook, which is less integrated and may not provide the same automatic isolation as Defender for Cloud Apps session policies.

Answer

Use Microsoft Sentinel UEBA to detect anomalies and manually trigger a playbook to block the user.

Answer

Deploy Microsoft Defender for Endpoint on all devices and use device risk as a factor for conditional access.

Answer

Create analytics rules in Sentinel for each SaaS app and a playbook to isolate accounts using Microsoft Entra ID conditional access.

Question 6

Your company has a hybrid identity environment with Microsoft Entra ID and on-premises Active Directory. You recently deployed Microsoft Defender for Identity (MDI) to monitor on-premises domain controllers. The SOC team needs to receive alerts from MDI in Microsoft Sentinel. You have already installed the MDI sensor on all domain controllers and confirmed that the MDI portal shows alerts. However, no MDI alerts appear in Sentinel. The Microsoft Defender for Identity data connector in Sentinel shows 'Connected'. What should you do next?

Accepted Answer

Enable the Microsoft 365 Defender connector in Sentinel, as MDI alerts are ingested through that connector.. MDI alerts are ingested into Sentinel via the Microsoft 365 Defender connector, not the MDI connector directly. The MDI connector is for other data. Option A is not needed; Option C is for health; Option D is incorrect because the connector is already connected.

Answer

Update the MDI sensor to the latest version.

Answer

Reconfigure the MDI data connector to select all alert severities.

Answer

Check the MDI sensor health status on each domain controller.

Question 7

Your organization uses Microsoft Sentinel and has a requirement to retain log data for two years for compliance purposes. You have configured the Log Analytics workspace with a retention policy of 90 days. You need to extend the retention to two years while minimizing costs. The data must remain queryable. What should you do?

Accepted Answer

Configure an archive policy to move older data to Azure Storage hot tier and use Log Analytics workspace archive retention.. Long-term retention with queryability is best achieved by configuring archive to Azure Storage with hot access. Option A is costly; Option B is costly; Option C is for cold storage and not queryable.

Answer

Increase the workspace retention to 730 days.

Answer

Export logs to Azure Blob Storage with cool access tier.

Answer

Enable unlimited retention for the workspace.

Question 8

Your company has a hybrid environment with Microsoft Sentinel and Microsoft Defender for Cloud. You notice that the 'Priority' field in Sentinel incidents is not being populated correctly. You need to ensure that Sentinel incidents inherit the priority from Microsoft Defender for Cloud alerts. What should you configure?

Accepted Answer

Configure the Microsoft Defender for Cloud data connector to map severity and use an automation rule to set priority based on severity.. Microsoft Defender for Cloud alerts include a severity field, and the Microsoft Defender for Cloud data connector in Sentinel can ingest this severity. By mapping the severity in the connector configuration, you can then use an automation rule to set the Sentinel incident's 'Priority' field based on the mapped severity, ensuring inheritance from Defender for Cloud alerts.

Answer

Enable the 'Sync incidents and alerts' setting in Microsoft Defender XDR.

Answer

Use a workbook to display priority and manually update incidents.

Answer

Create an analytics rule that queries Microsoft Defender for Cloud alerts and sets the priority in the incident creation.

Question 9

Your organization uses Microsoft Sentinel. You need to design a solution to automatically respond to a specific type of incident by sending an email to the SOC manager and creating a ticket in ServiceNow. What should you use?

Accepted Answer

Create a playbook in Microsoft Sentinel and trigger it with an automation rule.. Microsoft Sentinel uses Azure Logic Apps-based playbooks to execute complex, multi-step automated responses, such as sending an email and creating a ServiceNow ticket. An automation rule is required to trigger the playbook when an incident meets specific criteria, as analytics rules alone cannot directly invoke external systems like ServiceNow.

Answer

Create an analytics rule that directly sends an email.

Answer

Create a workbook that triggers a webhook.

Answer

Create an automation rule that sends an email and creates a ticket.

Question 10

Your security team uses Microsoft Sentinel and Microsoft Purview. You need to classify incidents that involve sensitive data according to Microsoft Purview's sensitivity labels. Which THREE components should you use?

Accepted Answer

Analytics rules that trigger on data sensitivity events from Microsoft Purview.. Microsoft Purview's data sensitivity events, such as when a file is labeled with a specific sensitivity label, can be ingested into Microsoft Sentinel via the Purview Data Connector. Analytics rules can then be configured to trigger on these events, allowing the security team to automatically generate incidents when sensitive data is detected or mishandled, directly integrating Purview's classification into Sentinel's incident pipeline.

Answer

Microsoft Defender for Cloud to apply sensitivity labels.

Answer

Microsoft Intune compliance policies to label data.

Question 11

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You are responsible for managing the security operations environment. Recently, the SOC team reported that incidents from Microsoft Defender for Endpoint are not appearing in Microsoft Sentinel. You have already configured the data connector for Microsoft Defender XDR and verified that logs are flowing into the 'SecurityAlert' table. However, incidents are not being created in Sentinel. What should you do?

Accepted Answer

Enable 'Create incidents from Microsoft 365 Defender' in the Microsoft Defender XDR data connector.. Incident creation from Defender XDR requires enabling the 'Microsoft 365 Defender' incident creation in the data connector. Option B is wrong because analytics rules are not needed; incidents come from the connector. Option C is wrong because that connector is for alerts, not incidents. Option D is wrong because streaming is not the issue.

Answer

Create an analytics rule that queries the SecurityAlert table and generates incidents.

Answer

Verify the Azure Sentinel solution is installed and enable the streaming of incidents.

Answer

Configure the Microsoft Defender for Endpoint data connector.

Question 12

Your organization uses Microsoft Sentinel and Microsoft Entra ID. You need to implement a solution that automatically disables a user account in Microsoft Entra ID when a high-severity incident involving that user is created in Sentinel. The solution must also send a notification to the security team. You have a playbook that disables the user and sends an email. What should you configure to trigger the playbook?

Accepted Answer

Create an automation rule that runs when an incident is created with severity High and triggers the playbook.. Automation rules can trigger playbooks when an incident is created with specific conditions, such as severity High. Option A is incorrect because scheduled playbooks do not trigger in real-time on incident creation. Option B is incorrect because workbooks are for reporting and cannot trigger playbooks. Option D is incorrect because analytics rules generate alerts, not incidents; playbooks configured as response actions on analytics rules would run on alert creation, not incident creation.

Answer

Configure the playbook to run on a schedule and query incidents.

Answer

Create a workbook that triggers the playbook when a high-severity incident appears.

Answer

Configure the playbook as a response action in the analytics rule that generates the incident.

Question 13

Your organization uses Microsoft Sentinel and Microsoft Defender for Cloud. You need to ensure that all security alerts from Microsoft Defender for Cloud are ingested into Sentinel and that incidents are automatically created for alerts with severity 'High' or higher. You have already connected Microsoft Defender for Cloud to Sentinel using the data connector. However, no incidents are being created. What should you do?

Accepted Answer

Create an analytics rule that uses the SecurityAlert table and generates incidents for high severity.. The Microsoft Defender for Cloud data connector ingests alerts into the SecurityAlert table in Microsoft Sentinel, but it does not automatically create incidents. To generate incidents from these alerts, you must create an analytics rule that queries the SecurityAlert table and uses the 'Group by' and 'Alert grouping' settings to create incidents for alerts with severity 'High' or higher. Option B is incorrect because streaming policies are used to forward logs to other destinations, not to create incidents in Sentinel. Option C is incorrect because the Defender for Cloud data connector does not have a toggle to create incidents; it only enables the ingestion of alerts. Option D is incorrect because automation rules act on alerts that have already been ingested and can perform actions like changing severity or assigning ownership, but they do not create incidents; incident creation is solely the function of analytics rules.

Answer

Configure a streaming policy to forward Defender for Cloud incidents.

Answer

Enable 'Create incidents' in the Microsoft Defender for Cloud data connector.

Answer

Create an automation rule that runs on alert ingestion and creates incidents.

Question 14

Your organization uses Microsoft Sentinel. The SOC manager wants to track the average time to triage incidents. You need to create a report that shows this metric. What should you use?

Accepted Answer

Create a workbook that uses KQL to query incident data and display the average time.. Microsoft Sentinel workbooks can be built using Kusto Query Language (KQL) to query the SecurityIncident table and compute the average time to triage, allowing the SOC manager to track this metric. Option B is incorrect because playbooks are designed for automation and response, not for creating reports. Option C is incorrect because automation rules are for automated incident handling, not for reporting or logging custom metrics. Option D is incorrect because analytics rules are used to generate alerts based on queries, not to produce reports.

Answer

Create a playbook that sends a report via email.

Answer

Create an automation rule that logs the triage time to a custom table.

Answer

Create an analytics rule that calculates the time to triage.

Question 15

Your organization uses Microsoft Sentinel. You have a custom analytics rule that generates incidents based on a KQL query. The rule is configured to run every 5 minutes. You notice that the rule is generating duplicate incidents for the same event. What should you do to prevent duplicates?

Accepted Answer

Enable entity mapping in the analytics rule and set appropriate entities.. To prevent duplicate incidents in Microsoft Sentinel, you should enable entity mapping in the analytics rule and set appropriate entities (option D). Entity mapping allows Sentinel to group alerts into a single incident based on common entities (e.g., user, host, IP address). Option A is wrong because automation rules can delete incidents post-creation but do not prevent duplicates at source. Option B is wrong because grouping alerts by time only (within 5 minutes) may still miss duplicates if events are spaced beyond that window; entity mapping provides more precise deduplication. Option C is wrong because playbooks run after incident creation and cannot prevent duplicates from being generated in the first place.

Answer

Create an automation rule that deletes duplicate incidents.

Answer

Set the rule to group alerts into a single incident if they occur within 5 minutes.

Answer

Create a playbook that checks for duplicates before incident creation.