SC-200 Manage a security operations environment Practice Test 35 — 15 Questions

Question 1

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You are configuring a new automation rule in Sentinel to automatically assign incidents to the appropriate SOC tier based on severity: Low and Medium to Tier 1, High to Tier 2, and Critical to Tier 3. You have created three separate automation rules, one for each tier. However, only the rule for Critical incidents is working. The other rules do not assign incidents. You verify that the other rules are enabled and have the correct conditions. What is the most likely cause?

Accepted Answer

The automation rule for Critical incidents has a higher order number and is processed first, preventing other rules from running.. Option D is correct because automation rules are processed in order, and if the first rule (e.g., for Critical) matches, it will stop processing subsequent rules. The rules for lower severities may never trigger if the incident also meets the conditions of a higher priority rule. Option A is wrong because multiple rules can exist. Option B is wrong because role assignments are not the issue. Option C is wrong because rules can be ordered.

Answer

The automation rules for Tier 1 and Tier 2 are set to trigger on incident update instead of creation.

Answer

The SOC Tier 1 and Tier 2 users do not have the appropriate permissions to own incidents.

Answer

Automation rules cannot be created separately for each severity; you must use a single rule with multiple conditions.

Question 2

Your organization uses Microsoft Sentinel and has enabled UEBA. A security analyst observes that a user account with no prior administrative activity performed a high volume of Azure Resource Manager operations. The analyst wants to investigate further. Which Microsoft Sentinel feature should the analyst use to quickly identify if this behavior is anomalous based on the user's historical profile?

Accepted Answer

User and Entity Behavior Analytics (UEBA). Option D is correct because UEBA in Microsoft Sentinel provides user entity analytics that profile normal behavior and detect anomalies. The other options are not primarily designed for user behavior anomaly detection based on historical profiles.

Answer

Hunting queries

Answer

Workbooks

Answer

Analytics rules

Question 3

You are a Microsoft Security Operations Analyst. Your organization recently deployed Microsoft Defender for Cloud Apps. You need to ensure that alerts generated by Defender for Cloud Apps are automatically forwarded to Microsoft Sentinel. What should you configure?

Accepted Answer

In Microsoft Sentinel, add the Microsoft Defender for Cloud Apps data connector.. Option A is correct because the data connector in Microsoft Sentinel for Microsoft Defender for Cloud Apps enables ingestion of alerts. The other options do not forward alerts to Sentinel.

Answer

In Microsoft Sentinel, create an analytics rule with a query that pulls data from Defender for Cloud Apps API.

Answer

In Microsoft Defender for Cloud Apps, configure SIEM integration.

Answer

In Microsoft Sentinel, configure a playbook to retrieve alerts from Defender for Cloud Apps.

Question 4

Your organization uses Microsoft Defender for Identity. You need to monitor for potential lateral movement attacks using pass-the-hash techniques. Which entity type in Microsoft Defender for Identity should you focus on in the security alert timeline?

Accepted Answer

Account. Option B is correct because pass-the-hash attacks involve compromised accounts, and Defender for Identity alerts include 'Account' entities. The other options are not the primary entity for lateral movement alerts.

Answer

IP address

Answer

Device

Answer

Computer

Question 5

A company uses Microsoft Sentinel with the Microsoft 365 Defender connector. The security team notices that alerts from Microsoft Defender for Endpoint (MDE) are not appearing in Sentinel. The MDE data connector status shows 'Connected'. Which step should you take to troubleshoot this issue?

Accepted Answer

Check the Microsoft 365 Defender portal to ensure MDE alerts are being generated and forwarded to Microsoft 365 Defender.. Option D is correct because the Microsoft 365 Defender connector brings in alerts from all Defender products, including MDE. If the connector is connected but alerts are missing, the issue is likely that the alerts are not being forwarded to Microsoft 365 Defender. Option A is not correct because MDE alerts are not a separate connector; Option B is not correct because the connector is already 'Connected'; Option C is not correct because ingestion rules filter after ingestion.

Answer

Verify that the Microsoft 365 Defender connector is configured to ingest MDE alerts.

Answer

Check if the Microsoft Defender for Endpoint data connector is added.

Answer

Verify that the ingestion rules in Sentinel are not filtering out MDE alerts.

Question 6

Your organization is using Microsoft Sentinel and has deployed the Microsoft Entra ID (Azure AD) connector. You need to create an analytics rule that triggers an incident when a user from a specific IP address is assigned the Global Administrator role. The IP address is not in your trusted IP list. Which KQL query should you use as the rule logic?

Accepted Answer

AuditLogs | where ActivityDisplayName == 'Add member to role' and TargetResources[0].displayName == 'Global Administrator' and InitiatedBy.app.ipAddress !in (dynamic(['10.0.0.1', '10.0.0.2'])). Option C is correct because it filters AuditLogs for 'Add member to role' activity for the Global Administrator role and checks that the IP address is not in the trusted IP list. The other options have incorrect logic or syntax.

Answer

AuditLogs | where ActivityDisplayName == 'Add member to role' and TargetResources[0].displayName == 'Global Administrator' and InitiatedBy.app.ipAddress == '10.0.0.1'

Answer

AuditLogs | where ActivityDisplayName == 'Add member to role' and TargetResources[0].displayName == 'Global Administrator' and InitiatedBy.app.ipAddress !has '10.0.'

Answer

AuditLogs | where ActivityDisplayName == 'Add member to role' and TargetResources[0].displayName == 'Global Administrator' and InitiatedBy.app.ipAddress !in ('trusted IP list')

Question 7

Your organization uses Microsoft Defender for Office 365. You need to configure a policy that automatically moves emails detected as 'Bulk' to the user's Junk Email folder. However, users must be able to override this by adding the sender to their Safe Senders list. What should you configure?

Accepted Answer

Anti-spam policy with Bulk email threshold set to a value that triggers junk action. Option B is correct because the anti-spam policy in Defender for Office 365 has a 'Bulk email threshold' that can be set, and users can override via Safe Senders. Option A is for phishing, not bulk; Option C is for malware; Option D is for connection filtering.

Answer

Anti-phishing policy

Answer

Malware filter policy

Answer

Connection filter policy

Question 8

A security operations center (SOC) uses Microsoft Sentinel. You need to ensure that when a high-severity incident is created, an automated email notification is sent to the on-call security engineer. Which automation option should you use?

Accepted Answer

Create a playbook that sends an email and associate it with an automation rule that triggers on high-severity incidents.. Option D is correct because playbooks can be triggered by incidents and include actions like sending emails. Automation rules can trigger playbooks. The other options do not directly send emails.

Answer

Set an analytics rule to run a KQL query and send email.

Answer

Create a workbook that emails the on-call engineer daily.

Answer

Configure a logic app manually triggered by the analyst.

Question 9

Your organization uses Microsoft Defender XDR. You need to investigate a potential ransomware incident that has affected multiple devices. The security team wants to identify the initial access vector. Which advanced hunting table should you query to find the process that initiated the encryption?

Accepted Answer

DeviceProcessEvents. Option A is correct because DeviceProcessEvents contains process creation events, which can show which process started the ransomware. Option B has file creation, not process; Option C has network connections; Option D has registry events.

Answer

DeviceRegistryEvents

Answer

DeviceFileEvents

Answer

DeviceNetworkEvents

Question 10

Your organization uses Microsoft Sentinel with the Azure Activity connector. Which TWO actions should you take to ensure that all subscription-level activity logs are being ingested into Sentinel?

Accepted Answer

Assign the 'Reader' role to the Sentinel managed identity on each subscription.. Options A and C are correct because the connector must have the required permissions and be configured for the correct subscriptions. Option B is not needed for Activity logs; Option D is for diagnostics settings, not necessary; Option E is incorrect.

Answer

Install the Azure Activity solution from the content hub.

Answer

Enable diagnostic settings on each subscription to stream logs to the Sentinel Log Analytics workspace.

Answer

Use the Azure Policy initiative to deploy the connector.

Question 11

Your Microsoft Defender XDR environment has an advanced hunting query that returns devices potentially affected by a known vulnerability. You want to create a custom detection rule that triggers an alert when more than 10 devices are affected. Which THREE steps are required?

Accepted Answer

Set the rule frequency and threshold to trigger when the query returns more than 10 results.. Options A, C, and D are correct. You need to save the query as a custom detection rule, configure the threshold, and set the action to generate an alert. Option B is not required because the rule runs on a scheduled basis; Option E is for Power Automate flows, not necessary.

Answer

Assign the rule to a severity level.

Answer

Create a Power Automate flow to send an email when the rule triggers.

Question 12

Your organization plans to use Microsoft Sentinel for incident management. Which TWO are native incident management features in Sentinel?

Accepted Answer

Incident comments and collaboration. Options B and D are correct because Sentinel supports assignment to analysts and incident comments. Options A and C are not native features; Option E is not part of incident management.

Answer

Automated email notifications on incident creation

Answer

Integration with ServiceNow via out-of-the-box connector

Answer

Integration with Microsoft Teams for incident chat

Question 13

You are configuring Microsoft Defender for Cloud Apps with Cloud Discovery. You need to ensure that logs from your network proxies are processed correctly. Which THREE steps are required?

Accepted Answer

Upload the log files manually or configure automatic log upload using the log collector.. Options A, B, and E are correct. Logs must be in a supported format, uploaded to Defender for Cloud Apps, and matched with the source IP ranges of your organization. Option C is not required; Option D is not required for Cloud Discovery.

Answer

Install the Microsoft Defender for Cloud Apps connector in Sentinel.

Answer

Enable Azure Information Protection for labeling.

Question 14

Your organization uses Microsoft Sentinel and wants to reduce alert fatigue. Which TWO actions should you take to improve the quality of incidents?

Accepted Answer

Configure alert grouping in analytics rules to combine related alerts into one incident.. Options B and D are correct because grouping related alerts into incidents and using tuning rules reduce noise. Option A increases noise; Option C is not recommended; Option E is for automation, not quality.

Answer

Create separate incidents for each alert.

Answer

Create automation rules to close all low-severity incidents automatically.

Answer

Increase the severity of all low-severity alerts to high.

Question 15

You are investigating a phishing incident in Microsoft Defender for Office 365. Which THREE pieces of information are available in the Threat Explorer?

Accepted Answer

Sender IP address. Options A, B, and C are correct. Threat Explorer provides email details, delivery actions, and sender IP. Option D is available in a different tool; Option E is not available.

Answer

Email body content

Answer

User's mailbox audit log