SC-200 Manage a security operations environment Practice Test 36 — 15 Questions

Question 1

Your organization uses Microsoft Defender XDR (formerly Microsoft 365 Defender). You need to configure role-based access control (RBAC) for the security team. Which TWO built-in roles can be assigned in Microsoft 365 Defender to manage incidents and alerts?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Security Operator. Security Operator and Security Administrator are the two built-in roles in Microsoft 365 Defender that include permissions to manage incidents and alerts. Security Operator can view and respond to incidents and alerts, while Security Administrator has full access to all security features, including the ability to edit policies and manage incidents. These roles are specifically designed for security operations tasks within Defender XDR.

Answer

Global Administrator

Answer

Compliance Administrator

Answer

Security Reader

Question 2

Your organization has multiple offices across the globe and uses Microsoft Sentinel as the primary SIEM. You have deployed Azure Arc on all on-premises servers to manage them centrally. The security team needs to collect Windows Security Events from all servers, including domain controllers, and forward them to Sentinel using the Windows Security Events via AMA connector. The team also wants to minimize administrative overhead when adding new servers. The current environment includes: 500 on-premises Windows servers (200 domain controllers, 300 member servers) managed via Azure Arc, 200 Azure VMs running Windows Server, and a centralized Log Analytics workspace named 'LAW-Security' in the East US region. You have already installed the Azure Monitor Agent (AMA) on all servers via Azure Arc and Azure VMs. However, you notice that security events from domain controllers are not appearing in Sentinel. You have verified that the AMA agent is running and the data collection rule (DCR) is correctly configured to collect Security events. No other issues are present. You need to ensure that security events from domain controllers are collected. What should you do?

Accepted Answer

Check the network connectivity from the domain controllers to the Log Analytics workspace endpoint. Ensure that the domain controllers can reach the required URLs.. Domain controllers often have more restrictive network policies, and they must be able to reach the Log Analytics workspace endpoint (the data collection endpoint and the Log Analytics service) to send events. The AMA agent is running and the DCR is configured, but if domain controllers cannot connect to the required URLs (e.g., *.ods.opinsights.azure.com, *.oms.opinsights.azure.com, etc.), events will not be collected. Option A is incorrect because the connector configuration is not the issue; the connector is already working for other servers. Option B is incorrect because restarting the agent does not address network issues. Option C is incorrect because the DCR namespace is irrelevant; the DCR configuration is correct for other servers.

Answer

Reinstall the Windows Security Events via AMA connector in Sentinel.

Answer

Restart the Azure Monitor Agent on all domain controllers.

Answer

Recreate the data collection rule with a different namespace.

Question 3

Your organization uses Microsoft Defender for Endpoint (MDE) and Microsoft Sentinel. You have configured the Microsoft Defender for Endpoint connector in Sentinel to ingest alerts and incidents. The security team wants to automatically create a Sentinel incident when an MDE alert of severity 'High' or 'Critical' is generated. Additionally, they want to assign the incident to a specific SOC tier based on the alert title. For example, if the alert title contains 'Ransomware', assign to Tier 3; otherwise assign to Tier 2. You need to implement this automation efficiently. You have already enabled the connector and verified that MDE alerts are flowing into Sentinel. What is the best approach?

Accepted Answer

Create an automation rule that triggers on incident creation for High and Critical severity. The rule runs a playbook that uses Logic Apps to parse the alert title and assign the incident to the appropriate tier using the Microsoft Sentinel connector 'Update incident' action.. The requirement is conditional logic based on alert title ('Ransomware' → Tier 3, otherwise Tier 2), which cannot be expressed with simple automation-rule conditions alone. An automation rule can trigger on incident creation and filter by severity, then invoke a playbook; the playbook (Logic Apps) can parse the alert title and use the Microsoft Sentinel 'Update incident' action to set the owner to the correct tier. This combines Sentinel's native automation rule engine with Logic Apps' flexible conditional branching.

Answer

Create an automation rule that triggers when an incident is created with a condition on alert severity, and set the owner to the appropriate group. Then create another automation rule for 'Ransomware' alerts.

Answer

Configure an automation rule with a condition on the alert title using KQL, then set the owner.

Answer

Modify the Microsoft Defender for Endpoint analytics rule to include a custom mapping that assigns the incident to a specific owner based on the alert title.

Question 4

Your organization uses Microsoft Sentinel and Microsoft Defender for Cloud Apps to monitor cloud application usage. You have a custom analytics rule that detects multiple failed login attempts from different IP addresses for the same user within 5 minutes. This rule generates an incident. The security team wants to automatically suspend the user in Microsoft Entra ID (formerly Azure AD) when such an incident is created, but only if the user is not a member of the 'Emergency Access' group. You need to implement this automation. You have already created the analytics rule. What should you do next?

Accepted Answer

Create a playbook that uses the Microsoft Entra ID connector to check if the user is a member of the 'Emergency Access' group. If not, suspend the user. Then create an automation rule that runs this playbook on incident creation.. The requirement has two parts: conditional logic (check Emergency Access group membership) and an action (suspend the user). Playbooks are the only Sentinel component that can run arbitrary logic and call the Microsoft Entra ID connector to both check group membership and disable the account. The automation rule then binds that playbook to incident creation, giving the correct end-to-end flow.

Answer

Modify the analytics rule to include a condition that checks the user's group membership using KQL.

Answer

Create an automation rule that suspends the user directly using a condition on the incident.

Answer

Create an automation rule that triggers on incident creation and runs a playbook that suspends the user.

Question 5

You are configuring Microsoft Sentinel automation rules to handle incidents generated from Microsoft Defender for Cloud. You need to ensure that when a high-severity security alert is triggered, an automated response runs a playbook that creates a support ticket in ServiceNow. However, the playbook fails to execute for some alerts. Upon investigation, you find that the automation rule is triggered only when the incident is created. What is the most likely cause of the failure?

Accepted Answer

The automation rule is configured to trigger only on incident creation, but the playbook requires the incident to be in an updated state.. The automation rule is configured to trigger only on incident creation. However, the playbook requires the incident to be in an updated state to execute, meaning the automation rule does not fire when the incident is updated after creation. This mismatch causes the playbook to fail for alerts that require an update trigger.

Answer

The automation rule lacks permissions to the ServiceNow connector because of Microsoft Entra ID conditional access policies.

Answer

Playbooks cannot be called by automation rules in Microsoft Sentinel.

Answer

Automation rules cannot be triggered on incident creation from Microsoft Defender for Cloud.

Question 6

Your organization uses Microsoft Sentinel for security information and event management (SIEM). You need to ensure that all incidents from a specific analytics rule are automatically assigned to the 'SOC Tier 1' team. What should you configure in Microsoft Sentinel?

Accepted Answer

Create an automation rule that triggers when the incident is created and sets the owner.. Automation rules in Microsoft Sentinel allow you to define conditions (such as incident creation) and actions (such as setting the owner) without requiring a playbook or custom code. This provides a lightweight, native way to automatically assign incidents from a specific analytics rule to the 'SOC Tier 1' team by filtering on the rule's name or ID in the automation rule's condition.

Answer

Configure alert enrichment in the analytics rule to add the owner.

Answer

Modify the analytics rule to write the incident to a custom table accessible by the SOC team.

Answer

Create a playbook that assigns the incident and attach it to the analytics rule.

Question 7

You are managing a Microsoft Defender XDR environment. The security team wants to receive email notifications when a new incident is created with severity 'High' or 'Medium'. They also want to ensure that notifications are sent only for incidents that are not automatically resolved by AIR. What should you configure?

Accepted Answer

Create an email notification rule in Microsoft Defender XDR with conditions for severity and status set to 'Active'.. Microsoft Defender XDR allows you to create email notification rules specifically for incidents, with conditions to filter by severity (e.g., High, Medium) and status (e.g., Active). This ensures notifications are sent only for new incidents that are not automatically resolved by AIR, as AIR-resolved incidents would have a status of 'Resolved' or 'Redirected', not 'Active'.

Answer

Create a playbook in Microsoft Sentinel that sends an email when an incident is created.

Answer

Configure an automation rule in Microsoft Sentinel to send email notifications.

Answer

Configure alert service settings in the Microsoft 365 Defender portal to send emails for high and medium severity alerts.

Question 8

Your organization has deployed Microsoft Sentinel. You need to ensure that user and entity behavior analytics (UEBA) is enabled for all data sources. What is the minimum role required to enable UEBA in Microsoft Sentinel?

Accepted Answer

Microsoft Sentinel Contributor. To enable UEBA in Microsoft Sentinel, you need the Microsoft Sentinel Contributor role because it includes the necessary permissions to manage Sentinel settings, including turning on UEBA for all data sources. This role allows you to access the UEBA configuration blade and modify the analytics settings, which is the minimum privilege required for this task.

Answer

Global Administrator

Answer

Security Reader

Answer

Log Analytics Contributor

Question 9

You are responsible for Microsoft Defender for Cloud Apps. The security team reports that they are not receiving alerts for suspicious activities from a specific connected app (Salesforce). You verify that the app is connected and the log collection is working. What should you check next?

Accepted Answer

Ensure that the anomaly detection policy for Salesforce is enabled in Defender for Cloud Apps.. Since the app is connected and log collection is verified, the issue is likely that the anomaly detection policy for Salesforce is disabled. Defender for Cloud Apps uses built-in anomaly detection policies to generate alerts for suspicious activities; if the policy is turned off, no alerts will be raised even though data flows correctly. Enabling the policy ensures that behavioral baselines and threat detection are applied to the Salesforce logs.

Answer

Review the IP address ranges configured for the Salesforce app.

Answer

Check if the Salesforce app connector is properly configured in Microsoft Entra ID.

Answer

Verify that the Salesforce tenant is licensed for Microsoft Entra ID P2.

Question 10

You are using Microsoft Sentinel to manage incidents. You want to automatically close incidents that are older than 90 days and have a status of 'New'. What is the most efficient way to achieve this?

Accepted Answer

Create a playbook that runs on a schedule (e.g., daily) and closes incidents that meet the criteria.. A scheduled playbook is the most efficient way to automatically close stale incidents because Microsoft Sentinel playbooks (Logic Apps) support recurrence triggers that can query the Sentinel incidents API on a schedule, filter by status 'New' and createdTime older than 90 days, and close them in bulk. This is a native, low-code automation path that doesn't require manual intervention or modifying detection logic.

Answer

Create a workbook that shows old incidents and manually close them.

Answer

Modify the analytics rule to automatically close incidents after 90 days.

Answer

Create an automation rule that triggers on incident update and closes the incident if the created time is older than 90 days.

Question 11

Your organization uses Microsoft Defender for Identity. The security team wants to monitor for suspected DCSync attacks. Which Windows Event ID should you monitor to detect DCSync activity?

Accepted Answer

Event ID 4662: An operation was performed on an object.. Event ID 4662 logs any operation performed on an Active Directory object, including the directory service access control entry for the DS-Replication-Get-Changes-All extended right (control access right 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2). A DCSync attack uses this right to replicate domain credentials from a domain controller, so monitoring 4662 with the specific object type and access mask for replication is the correct detection method.

Answer

Event ID 4776: The domain controller attempted to validate the credentials for an account.

Answer

Event ID 4648: A logon was attempted using explicit credentials.

Answer

Event ID 4624: An account was successfully logged on.

Question 12

You are configuring Microsoft Sentinel to ingest data from multiple sources. Which TWO of the following are valid data connectors that can be used to ingest AWS CloudTrail logs?

Accepted Answer

Azure Functions connector. The AWS S3 connector (Option C) is a valid data connector for ingesting AWS CloudTrail logs into Microsoft Sentinel by reading the logs directly from an S3 bucket. The Azure Functions connector (Option A) is also valid because it can be configured to trigger on CloudTrail log delivery to S3, using a function app to parse and forward the logs to Sentinel via the Log Analytics HTTP Data Collector API.

Answer

Office 365 connector

Answer

Microsoft Defender for Cloud connector

Answer

Syslog connector

Question 13

You are managing Microsoft Defender for Endpoint. Which TWO actions can be taken directly from the Microsoft 365 Defender portal to respond to a compromised device?

Accepted Answer

Run a full antivirus scan on the device.. The Microsoft 365 Defender portal allows security operators to initiate a full antivirus scan on a compromised device directly from the device's action menu. This leverages Microsoft Defender Antivirus to detect and remediate threats without requiring local user interaction, providing an immediate response capability within the unified security operations interface.

Answer

Block the user's sign-in from Microsoft Entra ID.

Answer

Remotely wipe the device.

Answer

Reset the device's local administrator password.

Question 14

You are configuring Microsoft Sentinel analytics rules. Which THREE of the following are valid types of analytics rules in Microsoft Sentinel?

Accepted Answer

Fusion rule. In Microsoft Sentinel, the analytics rule types available when creating a rule include Scheduled query rules (D), which run KQL queries on a defined frequency and trigger alerts based on results; Fusion rules (A), which use Microsoft's machine-learning correlation engine to detect multi-stage attacks across signals; and Microsoft Security rules (B), which create incidents from alerts generated by Microsoft security products like Defender and Microsoft 365. These three are the standard rule types offered in the Sentinel analytics rule wizard. Watchlist rule (C) is not a rule type — watchlists are data sources used to enrich queries and can be referenced inside scheduled rules, not a standalone analytics rule. Playbook rule (E) is also not a rule type — playbooks are Logic Apps used for automated response and are triggered by automation rules or analytics rules, not created as analytics rules themselves.

Answer

Watchlist rule

Answer

Playbook rule

Question 15

Your organization uses Microsoft Sentinel and has enabled UEBA. A security analyst observes that a user account with no prior administrative activity performed a high volume of Azure Resource Manager operations. The analyst wants to investigate further. Which Microsoft Sentinel feature should the analyst use to quickly identify if this behavior is anomalous based on the user's historical profile?

Accepted Answer

User and Entity Behavior Analytics (UEBA). UEBA is the correct feature because it builds a behavioral baseline for each user over time, including typical Azure Resource Manager activity patterns. When a user with no prior administrative history suddenly performs a high volume of ARM operations, UEBA can flag this as anomalous by comparing the current activity against the user's historical profile, surfacing the deviation in the UEBA investigation pane without requiring custom query creation.

Answer

Hunting queries

Answer

Workbooks

Answer

Analytics rules