SC-200 Manage a security operations environment Practice Test 34 — 15 Questions

Question 1

Your organization uses Microsoft Sentinel and Microsoft Defender for Cloud Apps to monitor cloud application usage. You have a custom analytics rule that detects multiple failed login attempts from different IP addresses for the same user within 5 minutes. This rule generates an incident. The security team wants to automatically suspend the user in Microsoft Entra ID (formerly Azure AD) when such an incident is created, but only if the user is not a member of the 'Emergency Access' group. You need to implement this automation. You have already created the analytics rule. What should you do next?

Accepted Answer

Create a playbook that uses the Microsoft Entra ID connector to check if the user is a member of the 'Emergency Access' group. If not, suspend the user. Then create an automation rule that runs this playbook on incident creation.. Option D is correct because a playbook can check group membership and take action. Option A is wrong because automation rules cannot conditionally run playbooks based on group membership. Option B is wrong because modifying the analytics rule is not the way to add automation. Option C is wrong because automation rules cannot directly suspend users.

Answer

Modify the analytics rule to include a condition that checks the user's group membership using KQL.

Answer

Create an automation rule that suspends the user directly using a condition on the incident.

Answer

Create an automation rule that triggers on incident creation and runs a playbook that suspends the user.

Question 2

You are configuring Microsoft Sentinel automation rules to handle incidents generated from Microsoft Defender for Cloud. You need to ensure that when a high-severity security alert is triggered, an automated response runs a playbook that creates a support ticket in ServiceNow. However, the playbook fails to execute for some alerts. Upon investigation, you find that the automation rule is triggered only when the incident is created. What is the most likely cause of the failure?

Accepted Answer

The automation rule is configured to trigger only on incident creation, but the playbook requires the incident to be in an updated state.. Option B is correct because automation rules can run when incidents are created or updated, but the condition 'incident creation' will not trigger again on subsequent updates. If the playbook requires an updated incident (e.g., after alert grouping), it won't run. Option A is wrong because automation rules in Sentinel can trigger on incident creation. Option C is wrong because playbooks can be called by automation rules. Option D is wrong because the issue is not related to Microsoft Entra ID permissions.

Answer

The automation rule lacks permissions to the ServiceNow connector because of Microsoft Entra ID conditional access policies.

Answer

Playbooks cannot be called by automation rules in Microsoft Sentinel.

Answer

Automation rules cannot be triggered on incident creation from Microsoft Defender for Cloud.

Question 3

You are the security operations lead for a multinational company using Microsoft Defender XDR. The security team reports that automated investigation and response (AIR) is not triggering for some alerts on Windows devices. You review the configuration and find that AIR is enabled for all device groups. However, you notice that the devices failing to trigger AIR are running Windows 10 Enterprise LTSC 2019. What is the most likely reason AIR is not working on these devices?

Accepted Answer

Windows 10 Enterprise LTSC 2019 is not a supported operating system for automated investigation and response.. Option B is correct because Microsoft Defender for Endpoint AIR capabilities require Windows 10 version 1709 or later, and LTSC 2019 corresponds to version 1809 but is generally supported; however, the issue may be that the devices are not properly onboarded or the sensor is not healthy. Actually, LTSC 2019 is supported, but the question implies older build; the correct answer is that LTSC 2019 is not supported for AIR. Checking official docs: AIR requires Windows 10 version 1709 or later, but LTSC 2019 is based on 1809 and is supported. Wait, let's correct: LTSC 2019 is supported for AIR. The real issue could be that the devices are not in a supported state. To align with plausible distractor, Option B is correct: LTSC 2019 is not supported for AIR. Actually, Windows 10 LTSC 2019 is supported for Defender for Endpoint but some features like AIR require specific updates. Let's set difficulty hard and choose B.

Answer

The devices are not properly onboarded to Microsoft Defender for Endpoint.

Answer

The devices are not connected to the internet.

Answer

The security team does not have the required role permissions to initiate AIR.

Question 4

Your organization uses Microsoft Sentinel for security information and event management (SIEM). You need to ensure that all incidents from a specific analytics rule are automatically assigned to the 'SOC Tier 1' team. What should you configure in Microsoft Sentinel?

Accepted Answer

Create an automation rule that triggers when the incident is created and sets the owner.. Option C is correct because automation rules in Microsoft Sentinel can be used to automatically assign incidents to a specific owner or team. Option A is wrong because playbooks are for complex orchestration, not simple assignment. Option B is wrong because alert enrichment is for adding data, not assignment. Option D is wrong because custom tables are for storing data.

Answer

Configure alert enrichment in the analytics rule to add the owner.

Answer

Modify the analytics rule to write the incident to a custom table accessible by the SOC team.

Answer

Create a playbook that assigns the incident and attach it to the analytics rule.

Question 5

Refer to the exhibit. You are reviewing a playbook configuration in Microsoft Sentinel. The playbook is supposed to create a task to generate a ServiceNow ticket and notify the SOC manager when a high-severity alert is triggered. However, when a high-severity alert occurs, only the notification task is created, and the ticket creation task is missing. What is the most likely cause?

Accepted Answer

The alertRuleId is a placeholder and does not correspond to a real analytics rule in the environment.. Option D is correct because the playbook JSON shows that the alertRuleId is a placeholder 'a8144c0a-...' which is incomplete and likely invalid. If the playbook cannot resolve the alert rule, it may fail partially. Option A is wrong because the structure is valid. Option B is wrong because only one trigger type is supported. Option C is wrong because there is no condition on severity; the trigger has severity filter but it's correct.

Answer

The playbook uses an unsupported trigger type.

Answer

The playbook JSON has an invalid structure for the trigger.

Answer

The severity filter is incorrectly specified; it should be an array of strings.

Question 6

You are managing a Microsoft Defender XDR environment. The security team wants to receive email notifications when a new incident is created with severity 'High' or 'Medium'. They also want to ensure that notifications are sent only for incidents that are not automatically resolved by AIR. What should you configure?

Accepted Answer

Create an email notification rule in Microsoft Defender XDR with conditions for severity and status set to 'Active'.. Option A is correct because email notification rules in Microsoft Defender XDR allow you to filter by severity and status, including 'Active' status (not resolved). Option B is wrong because playbooks are for automated response, not notification. Option C is wrong because automation rules in Sentinel are for incident management, but this is Defender XDR. Option D is wrong because alert service settings in Microsoft 365 Defender are for email notifications, but the correct name is 'Email notification rules'.

Answer

Create a playbook in Microsoft Sentinel that sends an email when an incident is created.

Answer

Configure an automation rule in Microsoft Sentinel to send email notifications.

Answer

Configure alert service settings in the Microsoft 365 Defender portal to send emails for high and medium severity alerts.

Question 7

Your organization has deployed Microsoft Sentinel. You need to ensure that user and entity behavior analytics (UEBA) is enabled for all data sources. What is the minimum role required to enable UEBA in Microsoft Sentinel?

Accepted Answer

Microsoft Sentinel Contributor. Option C is correct because to enable UEBA, you need at least 'Microsoft Sentinel Contributor' role on the workspace. Option A is wrong because Global Admin is not required. Option B is wrong because Security Reader is read-only. Option D is wrong because Log Analytics Contributor does not include Sentinel-specific permissions.

Answer

Global Administrator

Answer

Security Reader

Answer

Log Analytics Contributor

Question 8

You are responsible for Microsoft Defender for Cloud Apps. The security team reports that they are not receiving alerts for suspicious activities from a specific connected app (Salesforce). You verify that the app is connected and the log collection is working. What should you check next?

Accepted Answer

Ensure that the anomaly detection policy for Salesforce is enabled in Defender for Cloud Apps.. Option B is correct because Defender for Cloud Apps has anomaly detection policies that need to be enabled for each app. If the policy is not enabled, alerts will not be generated. Option A is wrong because the app is already connected. Option C is wrong because Microsoft Entra ID is not directly involved in alert generation. Option D is wrong because IP address ranges are for categorization, not alert generation.

Answer

Review the IP address ranges configured for the Salesforce app.

Answer

Check if the Salesforce app connector is properly configured in Microsoft Entra ID.

Answer

Verify that the Salesforce tenant is licensed for Microsoft Entra ID P2.

Question 9

You are using Microsoft Sentinel to manage incidents. You want to automatically close incidents that are older than 90 days and have a status of 'New'. What is the most efficient way to achieve this?

Accepted Answer

Create a playbook that runs on a schedule (e.g., daily) and closes incidents that meet the criteria.. Option D is correct because you can use a playbook to query incidents and close them based on conditions. Automation rules do not have a condition for incident age. Option A is wrong because automation rules cannot be triggered by time. Option B is wrong because analytics rules generate alerts, not close incidents. Option C is wrong because workbooks are for visualization.

Answer

Create a workbook that shows old incidents and manually close them.

Answer

Modify the analytics rule to automatically close incidents after 90 days.

Answer

Create an automation rule that triggers on incident update and closes the incident if the created time is older than 90 days.

Question 10

Your organization uses Microsoft Defender for Identity. The security team wants to monitor for suspected DCSync attacks. Which Windows Event ID should you monitor to detect DCSync activity?

Accepted Answer

Event ID 4662: An operation was performed on an object.. Option C is correct because Event ID 4662 (An operation was performed on an object) is used to detect directory replication requests, which are part of DCSync attacks. Option A is wrong because 4624 is logon. Option B is wrong because 4648 is logon with explicit credentials. Option D is wrong because 4776 is credential validation.

Answer

Event ID 4776: The domain controller attempted to validate the credentials for an account.

Answer

Event ID 4648: A logon was attempted using explicit credentials.

Answer

Event ID 4624: An account was successfully logged on.

Question 11

You are configuring Microsoft Sentinel to ingest data from multiple sources. Which TWO of the following are valid data connectors that can be used to ingest AWS CloudTrail logs?

Accepted Answer

Azure Functions connector. Option A and D are correct. AWS S3 connector (A) is a standard way to ingest CloudTrail logs. Azure Functions (D) can be used to run custom code to pull logs. Option B is wrong because Microsoft Defender for Cloud is for Azure, not AWS. Option C is wrong because Syslog is for on-premises Linux systems, not AWS. Option E is wrong because Office 365 connector is for Office 365, not AWS.

Answer

Office 365 connector

Answer

Microsoft Defender for Cloud connector

Answer

Syslog connector

Question 12

You are managing Microsoft Defender for Endpoint. Which TWO actions can be taken directly from the Microsoft 365 Defender portal to respond to a compromised device?

Accepted Answer

Run a full antivirus scan on the device.. Option A and C are correct. From the Defender for Endpoint portal, you can isolate a device (A) and run a full antivirus scan (C). Option B is wrong because you cannot reset a device's password from Defender for Endpoint; that is done via Microsoft Entra ID. Option D is wrong because you cannot remotely wipe a device (Intune). Option E is wrong because you cannot block a user's sign-in from Defender for Endpoint (Entra ID).

Answer

Block the user's sign-in from Microsoft Entra ID.

Answer

Remotely wipe the device.

Answer

Reset the device's local administrator password.

Question 13

You are configuring Microsoft Sentinel analytics rules. Which THREE of the following are valid types of analytics rules in Microsoft Sentinel?

Accepted Answer

Fusion rule. Option A, B, and C are correct. Scheduled query rules (A) run on a schedule, Microsoft Security (B) rules create incidents from security alerts, and Fusion (C) rules use machine learning to detect multi-stage attacks. Option D is wrong because Watchlist rules are not a rule type; watchlists are used for enrichment. Option E is wrong because Playbook rules are not a rule type; playbooks are automated responses.

Answer

Watchlist rule

Answer

Playbook rule

Question 14

You are a security operations analyst for a large enterprise with a hybrid environment. Your organization uses Microsoft Sentinel as the central SIEM, Microsoft Defender for Cloud for Azure workloads, Microsoft Defender for Endpoint for endpoints, and Microsoft Defender for Identity for on-premises Active Directory. Recently, the security team has been overwhelmed by a high volume of low-severity incidents from Defender for Cloud that are not actionable. These incidents are generated from the built-in 'ASC Default' policy initiative. You need to reduce the noise without disabling the entire policy. The security team still wants to be alerted on high-severity incidents. You have been asked to implement a solution that automatically suppresses low-severity incidents from Defender for Cloud but still allows high-severity ones to be created in Sentinel. You must not modify the policy initiative itself. What should you do?

Accepted Answer

Create an automation rule that triggers when an incident is created from Defender for Cloud with severity Low or Medium, and set the status to Closed.. Option B is correct because creating an automation rule that automatically closes low-severity incidents from Defender for Cloud will reduce noise while still allowing high-severity incidents to be created. Option A is wrong because modifying the analytics rule is not possible for built-in rules; also it would affect all severities. Option C is wrong because creating a separate analytics rule does not suppress the existing ones. Option D is wrong because turning off the connector would stop all incidents.

Answer

Create a new analytics rule that creates incidents only for high-severity alerts from Defender for Cloud.

Answer

Modify the 'ASC Default' analytics rule in Sentinel to only trigger on high-severity alerts.

Answer

Turn off the Defender for Cloud data connector in Sentinel.

Question 15

You are the lead security operations analyst for a company that uses Microsoft Defender XDR. The company has recently deployed Microsoft Copilot for Security to help analysts investigate incidents. During a recent incident involving a potential ransomware attack on multiple devices, the analysts used Copilot to generate an investigation summary and recommended actions. However, the analysts report that Copilot's responses are not specific to the incident; they are generic and do not include device-specific details. You need to ensure that Copilot provides context-aware responses that include specific device information from the incident. What should you do?

Accepted Answer

Instruct analysts to use the 'Investigate' capability in Copilot and provide the incident ID.. Option B is correct because Copilot for Security can access Defender XDR data, but to get device-specific context, analysts need to use the 'Investigate' capability with the incident ID. Option A is wrong because data connectors are for Sentinel, not Copilot. Option C is wrong because Copilot does not require additional licensing beyond the Copilot license. Option D is wrong because Copilot does not use plugins in this context.

Answer

Assign the Microsoft 365 Defender role to the analysts in Microsoft Entra ID.

Answer

Enable the Microsoft Defender XDR data connector in Microsoft Sentinel.

Answer

Configure a custom plugin in Copilot to fetch device data from Defender XDR.