SC-200 Manage a security operations environment Practice Test 35 — 15 Questions

Question 1

Which TWO actions require the Global Administrator role in Microsoft 365?

Accepted Answer

Configure tenant-wide settings in Microsoft 365. Configuring tenant-wide settings in Microsoft 365 requires the Global Administrator role because these settings affect the entire organization, including security, compliance, and user management. Only the Global Administrator has the broadest permissions to modify such high-level configurations, as defined by Microsoft's role-based access control (RBAC) model.

Answer

Create a data loss prevention (DLP) policy in Microsoft Purview

Answer

Create a custom role in Microsoft Defender XDR

Answer

View the Microsoft 365 Defender incident queue

Question 2

Which THREE actions can you perform using Microsoft Sentinel automation rules?

Accepted Answer

Run a playbook. Automation rules in Microsoft Sentinel can trigger a playbook as an automated response to an incident or alert. Playbooks are based on Azure Logic Apps and allow you to run complex workflows, such as gathering additional data, sending notifications, or taking remediation actions, directly from the automation rule.

Answer

Create a new analytics rule

Answer

Add threat intelligence indicators to Sentinel

Question 3

Which TWO Microsoft 365 security solutions include capabilities for managing security incidents?

Accepted Answer

Microsoft Defender XDR. Microsoft Defender XDR (B) is correct because it natively correlates alerts across endpoints, identities, email, and cloud apps into unified incidents, providing incident management through the Microsoft Defender portal with investigation, automated response, and remediation capabilities. Microsoft Sentinel (E) is correct because it is a cloud-native SIEM/SOAR solution that creates incidents from analytics rules and offers full incident management, including triage, investigation graphs, automation rules, and playbooks. Microsoft Intune (A) is a device and application management (MDM/MAM) service and does not provide security incident management. Microsoft Entra ID Protection (C) detects identity-based risks and generates risk detections and risky user/sign-in reports, but it is not an incident management solution. Microsoft Purview (D) focuses on data governance, compliance, and information protection (e.g., DLP, eDiscovery), not on managing security incidents.

Answer

Microsoft Intune

Answer

Microsoft Entra ID Protection

Answer

Microsoft Purview

Question 4

Refer to the exhibit. You are reviewing an analytics rule in Microsoft Sentinel. The rule is enabled but has not generated any alerts in the past 24 hours. What is the most likely cause?

Accepted Answer

The query uses 'Location == Unknown' but the actual sign-in location is not 'Unknown'. The rule has generated no alerts because the query condition 'Location == Unknown' does not match any actual sign-in locations. Suppression only suppresses alerts after an initial alert has been generated; it does not prevent the first alert. With zero alerts, the most likely cause is that the query returns no results, not suppression.

Answer

The triggerThreshold is set to 0, which means no alerts will be generated

Answer

Suppression is enabled with a duration of 6 hours, which may be suppressing new alerts after the first one

Answer

The queryFrequency is 1 hour and the queryPeriod is 7 days, which is a mismatch

Question 5

Refer to the exhibit. You are deploying a Microsoft Sentinel workspace using an ARM template. After deployment, you notice the workspace is in a disabled state for ingesting data. Which parameter is most likely causing this?

Accepted Answer

The dailyQuotaInGB parameter sets a daily cap that may have been exceeded. The dailyQuotaInGB parameter sets a daily ingestion cap for the Log Analytics workspace. If this cap is reached, data ingestion is disabled until the next day, causing the workspace to appear in a disabled state for ingesting data. This is the most likely cause because the question explicitly states the workspace is disabled for data ingestion, which aligns with the behavior of the daily cap being exceeded.

Answer

The location parameter is set to 'eastus' but Sentinel is not available in that region

Answer

The retentionInDays parameter is set to 90, which is less than the default 30 days

Answer

The workspaceName parameter is set to 'SentinelWorkspace' but the name must be globally unique

Question 6

Refer to the exhibit. You have an analytics rule in Microsoft Sentinel that uses this KQL query. The rule is configured to run every hour and alert when the result count is greater than 0. Which type of attack is this rule most likely detecting?

Accepted Answer

Brute force attack on user accounts. The KQL query counts failed sign-in events (ResultType != 0) aggregated by User, IPAddress, and a 5-minute bin, then filters for users with more than 10 failures. This pattern of multiple rapid failed logins from the same IP against a single user is the classic signature of a brute force attack, where an attacker tries many passwords to guess credentials. The rule triggers when the count exceeds 10 within any 5-minute window, making it highly specific to brute force detection.

Answer

Privileged account misuse

Answer

Data exfiltration via sign-in

Answer

Account takeover from a new location

Question 7

Your organization uses Microsoft Sentinel in a hybrid environment with on-premises servers and Azure VMs. You need to ensure that all Windows servers forward their security events to Sentinel. The security team wants to use Windows Security Events via AMA connector. Windows servers are not domain-joined and are managed by a third-party RMM tool. What is the most efficient way to deploy the AMA agent?

Accepted Answer

Onboard the servers to Azure Arc and deploy the AMA agent via policy or script.. Azure Arc provides a control plane for non-Azure and on-premises servers, enabling them to be managed like Azure resources. Once onboarded to Azure Arc, you can deploy the Azure Monitor Agent (AMA) via Azure Policy or custom scripts, which is the most efficient method for non-domain-joined servers managed by a third-party RMM tool, as it avoids manual intervention and leverages Azure's centralized management.

Answer

Use Group Policy Objects (GPO) to push the agent installation.

Answer

Use Microsoft Intune to deploy the AMA agent to all servers.

Answer

Manually install the agent on each server using the setup wizard.

Question 8

You are a SOC analyst using Microsoft Sentinel. You have a scheduled analytics rule that generates incidents from KQL queries. Recently, incidents are being created but automatically closed within minutes without any actions taken. You suspect a configuration issue. What should you check first?

Accepted Answer

Review the incident automation rules that might have a 'Close incident' action triggered by a condition.. Incident automation rules in Microsoft Sentinel can be configured to automatically close incidents when specific conditions are met, such as a related alert being resolved or a playbook completing. Since the incidents are being closed within minutes without manual intervention, an automation rule with a 'Close incident' action is the most likely cause, as it directly triggers closure based on conditions. Checking this first aligns with the SOC analyst's need to identify automated actions that could prematurely close incidents.

Answer

Verify the 'Alert grouping' settings in the analytics rule; they might be grouping alerts incorrectly.

Answer

Check if the analytics rule has a 'Suppression' setting enabled that causes the incident to close.

Answer

Examine the entity mapping configuration; it might be causing the incident to close automatically.

Question 9

You are configuring Microsoft Defender for Cloud Apps to enhance visibility into your organization's SaaS app usage. You need to ensure that risky user activities are automatically suspended. What should you configure?

Accepted Answer

Create a session policy to block or limit activities based on risk.. Session policies in Microsoft Defender for Cloud Apps allow you to monitor and control user activities in real time based on risk level. By configuring a session policy with the 'block' or 'limit' action triggered by risk factors (e.g., anomalous location, impossible travel), you can automatically suspend risky user activities without disrupting legitimate usage.

Answer

Set up IP address range policies.

Answer

Configure app discovery policies.

Answer

Define file policies to protect sensitive data.

Question 10

Your organization uses Microsoft Sentinel with a Log Analytics workspace in the East US region. You have deployed the Microsoft Defender for Cloud connector. You notice that security alerts from Defender for Cloud are not appearing as incidents in Sentinel. You have confirmed that the connector is enabled and data is flowing. What is the most likely cause?

Accepted Answer

You need to create an analytics rule with a rule template that uses the SecurityAlert table.. The Microsoft Defender for Cloud connector ingests security alerts into the Log Analytics workspace's SecurityAlert table, but incidents in Microsoft Sentinel are generated only by analytics rules. Without a configured analytics rule that queries the SecurityAlert table (such as the built-in 'Create incidents based on Microsoft Defender for Cloud alerts' template), no incidents will be created even if data is flowing. Option C correctly identifies this missing step.

Answer

The Sentinel workspace does not have required permissions to create incidents.

Answer

There is a delay in incident creation; wait for 24 hours.

Answer

The Microsoft Defender for Cloud connector is not properly configured.

Question 11

Your organization uses Microsoft Defender for Office 365. You need to ensure that when a user reports a phishing email via the built-in Outlook add-in, an automated investigation is triggered in Microsoft 365 Defender. What should you configure?

Accepted Answer

Enable user-reported message settings in the Microsoft 365 Defender portal.. Enabling user-reported message settings in the Microsoft 365 Defender portal allows messages reported via the built-in Outlook add-in to automatically trigger an automated investigation (AIR) in Microsoft 365 Defender. This configuration ties the user reporting action directly to the incident response workflow, enabling the system to analyze the reported email and initiate remediation steps without manual intervention.

Answer

Define a safe links policy.

Answer

Configure an anti-phishing policy.

Answer

Set up a safe attachments policy.

Question 12

You are a security administrator for a multinational company using Microsoft Sentinel. You need to ensure that critical incidents are automatically escalated to the on-call team via email and SMS. The on-call schedule uses Microsoft Teams channel. What is the most efficient way to achieve this?

Accepted Answer

Build a playbook using Microsoft Teams connector to post a message in the on-call channel with an adaptive card that allows acknowledge and escalate.. It uses a Microsoft Teams connector playbook triggered by an automation rule to post an adaptive card in the on-call channel. This allows the on-call team to acknowledge or escalate the incident directly from Teams, fulfilling the requirement for email and SMS escalation through the Teams channel schedule. Automation rules in Sentinel can trigger playbooks based on incident creation or update, making this the most efficient integrated approach.

Answer

Create an automation rule that sends email directly to the on-call team.

Answer

Configure the analytics rule to send an email when the incident is created.

Answer

Use a workbook to display critical incidents and expect the team to monitor it.

Question 13

Your organization uses Microsoft Defender for Endpoint. You need to ensure that when a high severity alert is generated, an automated investigation is launched immediately. What is the correct configuration?

Accepted Answer

In Microsoft 365 Defender, configure automated investigation and response settings to automatically investigate alerts.. Microsoft 365 Defender's automated investigation and response (AIR) capabilities allow you to configure automatic investigation for alerts of specific severity levels. By enabling this setting for high severity alerts, Defender for Endpoint will immediately launch an investigation when such an alert is generated, without requiring manual intervention.

Answer

Create a custom indicator in Microsoft Defender for Endpoint.

Answer

Use advanced hunting to create a custom detection rule.

Answer

In Microsoft Defender for Endpoint, set up an alert suppression rule.

Question 14

Your organization uses Microsoft Sentinel and has enabled UEBA (User and Entity Behavior Analytics). You notice that the UEBA timeline is not populating for some users. You have verified that the data sources are connected and the UEBA feature is enabled. What could be the issue?

Accepted Answer

There is insufficient data to build baselines for those users; UEBA needs at least 14 days of data.. UEBA requires a minimum of 14 days of historical data to establish behavioral baselines for each user. Without sufficient data, the timeline cannot detect anomalies or populate entries. Even if data sources are connected and UEBA is enabled, the feature will not generate timeline events until baselines are built.

Answer

Users must opt in to UEBA tracking.

Answer

UEBA only works with Azure Active Directory (now Microsoft Entra ID) audit logs.

Answer

The data sources are not sending logs for those users.

Question 15

Your organization is implementing Microsoft Sentinel and needs to ensure that incident response activities are compliant with regulatory requirements. You need to track and document all changes made to analytics rules and playbooks. Which TWO features should you enable?

Accepted Answer

Activity logs (Azure Monitor). Activity logs (Azure Monitor) record all management-plane operations, including changes to analytics rules and playbooks, while Azure Resource Change History (Change tracking) captures resource-level modifications. Together they provide comprehensive audit trails for regulatory compliance. Workbooks (A) are for visualization, Automation rules (B) trigger responses but don't log changes themselves, and Microsoft Purview (E) is for broader data governance, not operational change tracking.

Answer

Sentinel workbooks

Answer

Automation rules

Answer

Microsoft Purview Compliance Manager