SC-200 Manage a security operations environment Practice Test 34 — 15 Questions

Question 1

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You need to configure a solution that automatically escalates incidents that have been in 'New' status for more than 4 hours. The escalation should change the status to 'Active' and assign the incident to a senior analyst. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an automation rule that triggers when an incident is created, with a condition 'Time since created > 4 hours' and actions to set status and owner.. Automation rules in Microsoft Sentinel can be configured with a condition such as 'Time since created > 4 hours' to target incidents that have been in 'New' status for more than 4 hours. The rule can then take actions to change the status to 'Active' and assign the incident to a senior analyst. Option B is incorrect because analytics rules generate alerts and incidents when they are created, but they do not update existing incidents after a delay. Option C is incorrect because Microsoft Defender XDR focuses on cross-domain detection and response, not on managing Sentinel incident lifecycle status changes. Option D is incorrect because while a playbook could be used to update incidents, it would need to be triggered by an automation rule or a recurring schedule; simply creating a playbook that runs every hour is not a direct built-in functionality—it requires additional setup such as a Logic Apps recurrence trigger, making it less efficient than an automation rule.

Answer

Modify the analytics rule to update the incident after 4 hours.

Answer

Configure Microsoft Defender XDR to escalate incidents older than 4 hours.

Answer

Create a playbook that runs every hour and updates incidents.

Question 2

Your organization uses Microsoft Sentinel. You need to ensure that all incidents are classified with a specific classification when closed. The classification must be chosen from a predefined list. What should you configure?

Accepted Answer

Configure incident settings in Sentinel to define custom classifications.. You can create a custom classification in the Sentinel settings under 'Incident settings'. Option A is wrong because automation rules can set classification but not define the list. Option B is wrong because playbooks can set classification but not define options. Option C is wrong because analytics rules don't handle incident closure.

Answer

Modify the analytics rule to require classification.

Answer

Create a playbook that validates classification before closure.

Answer

Create an automation rule that enforces classification on closure.

Question 3

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You need to configure a solution that automatically escalates incidents that have been in 'New' status for more than 4 hours. The escalation should change the status to 'Active' and assign the incident to a senior analyst. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an automation rule that runs when an incident is created, queries the watchlist, and if the subscription matches, applies the label.. An automation rule can be configured to run when an incident is created, query a watchlist to check if the subscription matches, and apply the label 'Critical Subscription' to the incident. This is the most efficient method as it works across all data sources without modifying individual analytics rules. Option A is incorrect because using a playbook is more complex and slower than an automation rule for this simple condition. Option B is incorrect because it requires manual modification of each analytics rule, which is not scalable. Option D is incorrect because creating a separate analytics rule for each subscription would lead to rule proliferation and is inefficient.

Answer

Create a playbook that runs on all incidents and checks the watchlist to apply the label.

Answer

Modify each analytics rule to include the subscription ID in the incident title.

Answer

Create a separate analytics rule for the subscription that generates incidents with the label.

Question 4

Your SOC team needs to ensure that all incidents in Microsoft Sentinel are assigned to an analyst within 30 minutes of creation. Which TWO configurations should you implement?

Accepted Answer

Create a playbook that uses the Update Incident action to set the owner field.. A playbook (an Azure Logic Apps workflow) can use the 'Update Incident' action to programmatically set the owner field on an incident. This allows you to implement custom assignment logic, such as round-robin or based on analyst skill set, triggered by an automation rule or manually. Option C is correct because an automation rule can directly set the owner field when an incident is created, without needing a playbook, by using the 'Update incident' action within the rule itself. Both configurations ensure incidents are assigned within the required 30-minute window.

Answer

Set up a playbook that sends an email to the SOC manager when an incident is created.

Answer

Configure a Microsoft Teams connector to post incidents to a channel.

Answer

Modify the analytics rule to include a custom details field for analyst name.

Question 5

Your organization uses Microsoft Defender XDR and Microsoft Sentinel in a hybrid deployment. You need to ensure that all incidents from Defender XDR are synchronized to Sentinel and that any changes to incident status in Sentinel are reflected back in Defender XDR. Which THREE components or configurations are required?

Accepted Answer

Automation rules that trigger on incident status change and call a playbook to update the other platform.. The correct answers are A, B, and C. Option A: Automation rules are required to trigger a playbook when an incident status changes in Sentinel, allowing the change to be reflected back to Defender XDR for bidirectional sync. Option B: The Microsoft Defender XDR data connector ingests incidents from Defender XDR into Sentinel. Option C: The bi-directional incident synchronization setting must be enabled in the data connector configuration to sync status changes both ways. Option D is incorrect because the Microsoft Defender for Cloud Apps connector ingests alerts from Cloud Apps, not incidents. Option E is incorrect because mail flow rules are for email routing, not incident synchronization.

Answer

Microsoft Defender for Cloud Apps connector.

Answer

Configure a mail flow rule in Exchange Online.

Question 6

Your SOC is implementing a Microsoft Sentinel workspace with multiple content hub solutions. You need to ensure that only approved analytics rules are enabled and that any custom rules are reviewed before activation. Which THREE actions should you take?

Accepted Answer

Use Microsoft Sentinel Repositories (CI/CD) to manage analytics rules via Azure DevOps or GitHub.. Microsoft Sentinel Repositories (CI/CD) enables you to manage analytics rules as code via Azure DevOps or GitHub, allowing you to enforce a review and approval process before rules are deployed to production. This ensures that only approved custom rules are activated, aligning with the requirement to review custom rules before activation.

Answer

Configure Threat Intelligence - Taxii connector to import rules from an external feed.

Answer

Use the Hunting blade to create custom hunting queries instead of analytics rules.

Question 7

Your organization has a Microsoft Sentinel workspace in the East US region. You have deployed the Microsoft Defender XDR connector and are ingesting incidents from Microsoft Defender for Endpoint, Defender for Office 365, and Defender for Identity. The SOC team reports that some incidents from Defender for Office 365 are missing in Sentinel, but all incidents from the other sources appear correctly. You have verified that the connector is enabled and that there are no ingestion errors. The missing incidents are related to phishing emails that were detected by Defender for Office 365 and automatically remediated (soft deleted) by the system. The incidents are visible in the Microsoft 365 Defender portal. What should you do to ensure these incidents appear in Sentinel?

Accepted Answer

Create a new analytics rule using the Office 365 connector to generate incidents from Defender for Office 365 alerts.. Incidents from Defender for Office 365 that are automatically remediated (soft deleted) may not be ingested by the Microsoft Defender XDR connector because they are already resolved. To capture these incidents, you need to create an analytics rule using the Office 365 connector, which ingests raw alerts from Defender for Office 365, to generate incidents from those alerts. Option A is incorrect because an automation rule cannot create incidents from alerts that are not ingested; it can only automate responses on existing incidents. Option C is incorrect because the region of the connector does not affect ingestion of specific incident types; the issue is with auto-resolved incidents, not location. Option D is incorrect because the connector is already enabled and functioning for other sources; re-enabling it will not change the behavior for auto-resolved incidents.

Answer

Create an automation rule that triggers on missing incidents and creates them manually.

Answer

Create a new Microsoft Defender XDR connector in a different region to capture all incidents.

Answer

Re-enable the Microsoft Defender XDR connector and restart the data ingestion.

Question 8

Your company uses Microsoft Sentinel as its SIEM and has enabled User and Entity Behavior Analytics (UEBA) to detect insider threats. The UEBA timeline for a user shows several high-risk events, including unusual data exfiltration to an external site and multiple failed logons from a new geographic location. You are asked to create a custom analytics rule that generates an incident when a user exhibits both high-risk behaviors within a 24-hour period. You have the necessary KQL skills. However, when you test the rule, it does not generate any incidents even though the behavior exists. You have confirmed that the UEBA tables (BehaviorAnalytics, IdentityInfo) are populated and that the rule is enabled with a frequency of 1 hour. What is the most likely reason the rule is not firing?

Accepted Answer

The UEBA data has not yet been fully processed and may take up to 24 hours to appear in the tables.. UEBA data may not be immediately available for querying; there can be a delay (up to 24 hours) before behavior data is fully processed and available in the BehaviorAnalytics and IdentityInfo tables. This explains why the rule doesn't fire despite the behavior existing. Option A is incorrect because the rule is enabled and the tables are confirmed populated. Option B is incorrect because the query references the correct tables. Option D is incorrect because a frequency of 1 hour is acceptable; the issue is data latency, not frequency.

Answer

The analytics rule is not enabled for the correct workspace.

Answer

The KQL query is referencing the wrong tables.

Answer

The rule's frequency is too long; it should be set to 5 minutes.

Question 9

Your SOC team uses Microsoft Sentinel workbooks to monitor the security posture. One workbook shows a chart of incidents by severity over the last 7 days. The workbook uses a KQL query that queries the SecurityIncident table. Recently, the workbook stopped displaying data. You check the workspace and confirm that incidents are being created and are visible in the Sentinel portal. You also verify that the workbook has not been modified. What is the most likely cause?

Accepted Answer

The Log Analytics workspace linked to the workbook has been moved or renamed.. Microsoft Sentinel workbooks are linked to a specific Log Analytics workspace. If the workspace is moved to a different resource group, subscription, or tenant, or if it is renamed, the workbook may lose its connection and stop displaying data. This would explain why incidents are still visible in Sentinel but the workbook shows no data. Option A is incorrect because the workbook was not deleted (it hasn't been modified). Option B is incorrect because the pricing tier does not affect workbook functionality; workbooks are available with any Sentinel tier. Option D is incorrect because the KQL query itself is fine; data is being ingested and the query worked previously without changes.

Answer

The workbook was accidentally deleted and needs to be re-created.

Answer

The workspace has been switched to a different pricing tier that does not support workbooks.

Answer

The KQL query in the workbook has a syntax error.

Question 10

You are managing a Microsoft Sentinel environment that ingests data from multiple sources: Microsoft 365, Azure Activity, and custom logs via AMA. The SOC manager has requested that all security events from Windows servers be collected and stored for 90 days for compliance purposes. You have configured the Windows Security Events via AMA data connector to collect all events (Event ID 4624, 4625, etc.) and set the workspace retention to 90 days. After a week, you notice that the daily ingested volume is higher than expected, exceeding the budget. You analyze the data and find that many low-severity informational events are being ingested, such as Event ID 5156 (Windows Filtering Platform allowed connection). The manager confirms that only security-relevant events are needed. What should you do to reduce ingestion volume while still meeting compliance requirements?

Accepted Answer

Modify the data collection rule (DCR) for the Windows Security Events connector to use a custom XPath query that excludes informational events (e.g., exclude Event ID 5156).. The AMA connector uses data collection rules (DCRs) that allow you to filter events based on custom XPath queries. By creating a custom XPath query that excludes informational events like Event ID 5156, you can reduce ingestion volume while still collecting security-relevant events (e.g., 4624, 4625) for the required 90-day retention. Option A is incorrect because reducing the workspace retention to 30 days would violate the compliance requirement for 90 days. Option B is incorrect because the Azure Activity data connector collects Azure resource logs, not Windows security events. Option D is incorrect because the legacy MMA connector is deprecated and does not provide the same filtering capabilities; AMA is the recommended solution.

Answer

Reduce the workspace retention period to 30 days to lower storage costs.

Answer

Configure the Azure Activity data connector to filter out low-severity events.

Answer

Disable the AMA-based connector and use the legacy MMA-based connector instead.

Question 11

Your organization has deployed Microsoft Sentinel and Microsoft Defender XDR. You have enabled bi-directional incident synchronization. The SOC team uses Microsoft Teams to collaborate on incidents. They have configured a playbook that posts incident details to a Teams channel whenever an incident is created. Recently, the playbook stopped posting messages. You check the playbook's run history in Azure Logic Apps and see that the run was successful with a 200 status code from the Teams connector. However, no message appears in the channel. You verify that the Teams webhook URL is correct and that the channel is active. What is the most likely cause?

Accepted Answer

The service principal or managed identity used by the Logic App has lost permissions to post messages in the Teams channel.. The most likely cause is that the service principal or managed identity used by the Logic App has lost permissions to post messages in the Teams channel. Even though the Logic App run returned a 200 status code from the Teams connector, that only indicates that the request was sent successfully; it does not guarantee that the Teams channel received the message if the identity lacks permissions. Option A is incorrect because the connector is installed and working (HTTP 200). Option B is incorrect because the playbook is not disabled; the run history shows it executed successfully. Option D is incorrect because if the channel were deleted and re-created, the webhook URL would be different, but the question states the webhook URL is correct.

Answer

The Microsoft Teams connector is not installed in the Logic Apps environment.

Answer

The playbook is disabled and needs to be re-enabled.

Answer

The Teams channel has been deleted and re-created with a different ID.

Question 12

Your organization has a Microsoft Sentinel workspace that ingests data from Microsoft 365 Defender (Defender for Endpoint, Office 365, Identity, Cloud Apps). You have configured a scheduled analytics rule to detect possible privilege escalation based on user activity. The rule runs every 5 minutes and looks at the last 5 minutes of data. Recently, the rule has been generating a high number of false positives. You analyze the alerts and find that they are triggered by legitimate administrative actions. You need to reduce false positives without completely disabling the rule. The rule uses a KQL query that joins the IdentityLogonEvents and CloudAppEvents tables. What should you do?

Accepted Answer

Modify the KQL query to exclude events from a list of known administrative user accounts or IP addresses.. Tuning the KQL query to exclude known administrative accounts or actions is the best way to reduce false positives. Option A is wrong because increasing the frequency would not reduce false positives. Option B is wrong because suppression can cause missed detections for other users. Option D is wrong because reducing lookback may miss legitimate events.

Answer

Increase the rule's run frequency to every 30 minutes.

Answer

Reduce the query's lookback period to 1 minute.

Answer

Add an incident suppression rule that closes incidents from known admin accounts.

Question 13

Your company uses Microsoft Sentinel and has connected Microsoft 365 Defender. You have configured an automation rule that, when an incident is created with a high severity, triggers a playbook that sends an email to the SOC manager and creates a ticket in ServiceNow. Recently, the automation rule stopped triggering the playbook. You check the automation rule and see it is enabled. You also check the playbook and see it is enabled. However, the playbook's run history shows no new runs for the last 24 hours, even though high-severity incidents have been created. You verify that the incidents are indeed high severity and that the automation rule's conditions match. What is the most likely cause?

Accepted Answer

The automation rule has reached its maximum number of actions (trigger limit) and has been automatically disabled by Sentinel.. Automation rules in Microsoft Sentinel have a trigger limit (the number of times a rule can trigger actions) to prevent runaway automation. When this limit is reached, the rule is automatically disabled even though it appears enabled in the UI. This explains why the rule shows as enabled but no new runs occur. Option A is incorrect because the condition checks the incident severity at creation time, and changes after creation do not affect the rule. Option C is incorrect because the playbook is still enabled and exists; the issue is with the automation rule not triggering it. Option D is incorrect because the rule is enabled, and there is no indication of an administrator disabling it.

Answer

The incident severity was changed after creation, so the rule condition no longer matches.

Answer

The playbook has been deleted and needs to be re-created.

Answer

The automation rule was accidentally disabled by another administrator.

Question 14

Your organization uses Microsoft Defender XDR to protect endpoints. You need to ensure that all endpoints are reporting to the Defender for Endpoint service and that any devices that have not checked in for more than 7 days are flagged. You have created a custom detection rule in Microsoft Sentinel that queries the DeviceInfo table and generates an incident for devices with a last check-in time older than 7 days. After a week, you notice that no incidents have been generated, even though you know there are some inactive devices. You verify that the DeviceInfo table is populated with data. What is the most likely issue?

Accepted Answer

The KQL query has a logic error, such as using 'where LastSeen > ago(7d)' instead of 'where LastSeen < ago(7d)'.. The most likely issue is that the KQL query has a logic error. The query likely uses 'LastSeen > ago(7d)' which selects devices seen within the last 7 days, instead of 'LastSeen < ago(7d)' which selects devices not seen for more than 7 days. This explains why no incidents were generated despite inactive devices being present. Options B, C, and D are incorrect because the data is being ingested (DeviceInfo populated), no special license is needed, and the rule is enabled.

Answer

The Microsoft Defender XDR connector is not configured to send DeviceInfo data.

Answer

The DeviceInfo table requires a special license to query.

Answer

The analytics rule is not enabled.

Question 15

Your company has a hybrid environment with on-premises Active Directory and Microsoft Entra ID. You have deployed Microsoft Sentinel and configured the Microsoft Entra ID connector to collect sign-in logs and audit logs. The SOC team wants to be alerted when a user account is created in Entra ID, as this could indicate a malicious insider. You create a scheduled analytics rule that queries the AuditLogs table for 'Add user' activity. The rule runs every hour and looks back 1 hour. After a week, the rule has generated zero incidents. You know that new users are being created regularly. You test the query manually in Log Analytics and get results for the last hour. What is the most likely cause?

Accepted Answer

The analytics rule's query uses a different time filter than the manual query, such as using 'ago(1h)' but the rule's lookback is set to '5 minutes' in the rule settings.. The manual query in Log Analytics automatically uses the time picker's selected range (e.g., 'Last hour'), but the analytics rule's query may lack an explicit time filter, causing it to rely solely on the rule's lookback period. If the lookback period is set to a value such as 5 minutes while the rule runs every hour, the rule will only examine the most recent 5 minutes of data, missing events that occurred earlier in the hour. This mismatch explains why the manual test returns results but the rule does not. Option A is incorrect because the Microsoft Entra ID connector is enabled and collecting audit logs, as evidenced by the successful manual query. Option B is incorrect because the rule is enabled; otherwise, no incidents would ever be generated, and the manual test would not be relevant. Option D is incorrect because the AuditLogs table is available in the workspace, as shown by the manual query returning results.

Answer

The Microsoft Entra ID connector is not enabled.

Answer

The analytics rule is disabled.

Answer

The AuditLogs table is not available in the workspace.