SC-200 Manage a security operations environment Practice Test 35 — 15 Questions

Question 1

Your organization is implementing Microsoft Sentinel. You need to design a solution to automatically disable a user account in Microsoft Entra ID when a high-severity incident is triggered in Microsoft Sentinel related to that user. Which component should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A playbook that uses the Microsoft Graph API to disable the user.. A playbook is the correct component because it is an automated workflow that can be triggered by a Microsoft Sentinel incident. By using the Microsoft Graph API within the playbook, you can programmatically disable a user account in Microsoft Entra ID, which is the required action for a high-severity incident. This aligns with the need for an automated response that integrates Sentinel with identity management.

Answer

An analytics rule that includes a query to disable the user.

Answer

An automation rule that runs a PowerShell script on a hybrid worker.

Answer

A workbook that triggers a webhook to disable the user.

Question 2

Your SOC uses Microsoft Sentinel and Microsoft Defender for Cloud Apps. You need to configure a policy that triggers when a user downloads a large number of files from SharePoint Online within a short period. Which policy type should you use?

Accepted Answer

Activity policy. An activity policy in Microsoft Defender for Cloud Apps is designed to monitor and respond to specific user activities, such as downloading a large number of files from SharePoint Online within a short period. This policy type allows you to set thresholds and triggers based on user actions, making it the correct choice for detecting anomalous download behavior.

Answer

Session policy

Answer

File policy

Answer

Anomaly detection policy

Question 3

Which TWO actions can be performed using automation rules in Microsoft Sentinel? (Select TWO.)

Accepted Answer

Assign an incident to a specific owner.. Automation rules in Microsoft Sentinel can perform actions such as assigning an incident to a specific owner. This is a built-in action within the automation rule configuration, allowing you to automatically set the owner field of an incident based on conditions like severity or rule ID, without requiring a playbook.

Answer

Create a new incident from an alert.

Answer

Modify the query of an existing analytics rule.

Answer

Delete an incident automatically.

Question 4

Your SOC team uses Microsoft Sentinel with multiple workspaces across regions. You need to implement a solution that allows analysts to query all workspaces from a single location without moving data. Which feature should you configure?

Accepted Answer

Use cross-workspace queries with workspace() expressions in KQL.. Cross-workspace queries using the `workspace()` expression in KQL allow analysts to query multiple Log Analytics workspaces from a single query context without moving or centralizing the data. This is the native Microsoft Sentinel feature designed for multi-workspace environments, enabling seamless querying across regions while keeping data in its original workspace.

Answer

Export data to Azure Data Explorer and query there.

Answer

Create a single Log Analytics workspace and have all data sources send logs there.

Answer

Configure Azure Lighthouse to manage all workspaces.

Question 5

Your Microsoft Sentinel environment is not generating incidents from a custom KQL detection rule. The rule runs successfully in the Log Analytics query editor but no incidents appear. What is the most likely cause?

Accepted Answer

The rule is set to create alerts but not incidents. The most likely cause is that the rule is set to create alerts but not incidents. In Microsoft Sentinel, analytics rules have a toggle to 'Create incidents' from alerts. If this toggle is disabled, alerts are generated but not grouped into incidents. The query running successfully in Log Analytics confirms the rule logic works, but incidents will not appear unless the incident creation toggle is enabled. Entity mapping is not required for incident creation; it enhances correlation but is not a prerequisite.

Answer

The rule's alert grouping settings are misconfigured

Answer

The rule's query schedule is too long

Answer

The rule does not have entity mapping configured

Question 6

Refer to the exhibit. You are analyzing a KQL query for a Microsoft Sentinel scheduled rule. The query is intended to detect devices that have both a high number of process executions and network connections to a single IP within an hour. However, the query returns no results even though there are devices meeting the criteria. What is the most likely cause?

Accepted Answer

The join condition does not include a time window, causing mismatches. The join between DeviceProcessEvents and DeviceNetworkEvents lacks a time window constraint (e.g., 'on $left.Timestamp between ($right.Timestamp - 1h) and ($right.Timestamp + 1h)'). Without this, the join matches events across arbitrary time ranges, causing mismatches where a device's process executions and network connections to a single IP occur at different times, even if both happen within the same hour. This results in no rows being returned when the intended detection requires temporal proximity.

Answer

The threshold variable is not used correctly

Answer

The DeviceProcessEvents and DeviceNetworkEvents tables are from different data sources

Answer

The summarize function cannot count process executions

Question 7

Your SOC is investigating an incident in Microsoft Sentinel. You need to quickly identify all related alerts and entities across the timeline. What Microsoft Sentinel feature should you use?

Accepted Answer

Open the incident investigation graph.. The incident investigation graph in Microsoft Sentinel provides a visual, interactive map of all alerts, entities (such as users, IP addresses, hosts), and their relationships linked to a specific incident. This allows SOC analysts to quickly see the full scope of an incident across the timeline without manually correlating data, making it the correct tool for this scenario.

Answer

Run a hunting query.

Answer

Review the analytics rule that generated the incident.

Answer

Use the Incident workbook.

Question 8

Which TWO features are available in Microsoft Sentinel to automate incident response?

Accepted Answer

Playbooks based on Azure Logic Apps.. Playbooks based on Azure Logic Apps are correct because they provide a native, low-code automation framework within Microsoft Sentinel. They allow security analysts to define and execute complex, multi-step response actions—such as isolating a compromised VM, blocking an IP address, or opening a ticket—triggered by alerts or incidents. This directly automates incident response workflows without manual intervention.

Answer

Workbooks.

Answer

Kusto Query Language (KQL) queries.

Answer

UEBA.

Question 9

Your security team uses Microsoft Defender XDR (formerly Microsoft 365 Defender) to investigate incidents. You notice that some alerts from Microsoft Defender for Endpoint are not being automatically correlated into incidents as expected. You have confirmed that the relevant alert sources are enabled in the Microsoft Defender XDR portal. What is the most likely cause?

Accepted Answer

Incident correlation rules are not enabled for the relevant alert sources.. Microsoft Defender XDR uses built-in correlation logic to automatically group related alerts from different sources (e.g., Defender for Endpoint, Defender for Office 365) into incidents. If alerts from a specific source, such as Defender for Endpoint, are not being correlated, the most likely cause is that the incident correlation rules for that source are not enabled in the Microsoft Defender XDR portal. Enabling the alert source alone is insufficient; the correlation engine must be explicitly activated for each source to aggregate alerts into incidents.

Answer

Alert tuning rules are causing the alerts to be excluded.

Answer

Automation rules in Microsoft Sentinel are deleting the alerts.

Answer

Alert suppression rules are blocking the alerts.

Question 10

Your organization uses Microsoft Defender for Cloud to monitor hybrid workloads. You need to ensure that security alerts from on-premises servers running Windows Server 2022 are forwarded to Microsoft Sentinel. The servers are not yet onboarded to Azure Arc. What should you do first?

Accepted Answer

Onboard the servers to Azure Arc and enable Defender for Cloud.. On-premises servers must first be onboarded to Azure Arc to establish a management identity and connectivity with Azure. Without Azure Arc, Defender for Cloud cannot apply its security policies or forward alerts to Microsoft Sentinel. Enabling Defender for Cloud on the servers after Arc onboarding allows security alerts to be collected and forwarded to Sentinel.

Answer

Install the Azure Monitor Agent on the servers.

Answer

Deploy Azure Policy to enable Defender for Cloud on the servers.

Answer

Install Microsoft Defender for Endpoint on the servers.

Question 11

Your organization has Microsoft Defender for Cloud Apps and Microsoft Sentinel integrated. You need to create an automated playbook that, when a Microsoft Sentinel incident is created from a Defender for Cloud Apps alert, automatically suspends the user in Microsoft Entra ID and sends a notification to the security team. Which two connectors should you use in the playbook?

Accepted Answer

Microsoft Entra ID and Microsoft Teams. Microsoft Entra ID provides the identity management action to suspend a user account, and Microsoft Teams enables sending a notification to the security team via a Teams channel or chat. This combination directly fulfills the requirements of suspending the user in Entra ID and notifying the team when a Sentinel incident is triggered from a Defender for Cloud Apps alert.

Answer

Microsoft Power BI and Microsoft Teams

Answer

Azure Automation and Microsoft Sentinel

Answer

Microsoft Entra ID and Outlook.com

Question 12

Your organization uses Microsoft Sentinel for security operations. You need to ensure that critical alerts are automatically assigned to the appropriate SOC tier for investigation. What should you configure in Microsoft Sentinel?

Accepted Answer

Create an automation rule that sets the incident owner. Automation rules in Microsoft Sentinel allow you to automatically assign incidents to specific owners based on conditions like severity or alert type. This ensures critical alerts are routed to the appropriate SOC tier without manual intervention, directly meeting the requirement.

Answer

Create a playbook that assigns the incident to a user

Answer

Use a watchlist to map alert types to owners

Answer

Configure an analytics rule to set the owner

Question 13

Refer to the exhibit. You have created a scheduled analytics rule in Microsoft Sentinel as shown. The rule is not generating any incidents, even though you know Copilot for Microsoft 365 is accessing sensitive files. What is the most likely cause?

Accepted Answer

The table being queried does not contain Copilot events. The rule queries the 'SensitivityLabelEvents' table, which tracks sensitivity label changes but does not contain Copilot for Microsoft 365 events. Copilot events are stored in the 'MicrosoftCopilotAudit' table (or 'CloudAppEvents' with specific filters). Since the query targets the wrong table, no matching records are returned, and no incidents are generated.

Answer

The triggerThreshold is too high

Answer

The severity is set to Medium, which suppresses incidents

Answer

The queryFrequency is too short

Question 14

Your organization uses Microsoft Defender for Cloud Apps and Microsoft Sentinel. You discover that a user is performing unusual bulk downloads from SharePoint. You need to automatically create an incident in Sentinel and suspend the user in Microsoft Entra ID. What should you use?

Accepted Answer

Create a scheduled analytics rule in Sentinel and use automation rules to trigger a playbook that suspends the user.. A scheduled analytics rule in Sentinel can detect the unusual bulk download behavior from SharePoint (via ingested logs from Defender for Cloud Apps or Office 365 connector). An automation rule on that analytics rule triggers a playbook (Azure Logic App) that uses the Microsoft Graph API to suspend the user in Microsoft Entra ID, creating an incident automatically as part of the rule's configuration.

Answer

Configure a Microsoft Entra ID Protection policy to require password reset for risky users.

Answer

Use a playbook triggered by an incident creation rule to suspend the user.

Answer

Configure a policy in Defender for Cloud Apps with a governance action to suspend the user.

Question 15

You are configuring Microsoft Defender for Cloud Apps session controls for a SharePoint site containing sensitive data. Which condition must be met to apply real-time monitoring?

Accepted Answer

Users must be configured with Conditional Access policies from Microsoft Entra ID.. Microsoft Defender for Cloud Apps session controls for SharePoint require users to be routed through the Cloud App Security proxy, which is invoked by Conditional Access policies in Microsoft Entra ID. Conditional Access app controls apply session policies to traffic when users access SharePoint, enabling real-time monitoring. The Microsoft Entra ID application proxy is designed for on-premises apps, not for SaaS apps like SharePoint Online. Therefore, the correct prerequisite is having Conditional Access policies configured.

Answer

The SharePoint site must be added as a custom app in Defender for Cloud Apps.

Answer

Users must access the site through Microsoft Entra ID application proxy.

Answer

A browser extension must be installed on all client devices.