SC-200 Manage a security operations environment Practice Test 36 — 15 Questions

Question 1

Which TWO are valid methods to ingest syslog data into Microsoft Sentinel?

Accepted Answer

Use the Syslog data connector from the Content hub. The Syslog data connector available from the Content hub in Microsoft Sentinel provides a direct, built-in method to ingest syslog data from on-premises or cloud-based syslog sources. This connector uses the Log Analytics agent (or the newer Azure Monitor Agent with a Data Collection Rule) to collect syslog messages forwarded by a syslog daemon, typically over UDP port 514 or TCP, and maps them to the Syslog table in Log Analytics. It is the standard, supported approach for syslog ingestion without requiring third-party tools or custom parsers.

Answer

Configure a syslog forwarder with the Cisco ASIM parser

Answer

Deploy a Splunk Universal Forwarder to send syslog to Sentinel

Answer

Install a Windows-based syslog collector and forward to Sentinel using the Azure Monitor agent

Question 2

Which THREE actions can be performed by automation rules in Microsoft Sentinel?

Accepted Answer

Assign an incident to a specific owner. Automation rules in Microsoft Sentinel can automatically assign incidents to specific owners based on conditions such as severity, entity type, or custom criteria. This action helps streamline incident response by ensuring the right personnel are notified and responsible for handling the incident without manual intervention.

Answer

Modify a data connector to ingest more logs

Answer

Create a new analytics rule

Question 3

Your organization uses Microsoft Sentinel with a workspace in the East US region. You have a playbook that runs an automation rule to create a support ticket in ServiceNow. The playbook fails intermittently with a timeout error. You have verified that the playbook's managed identity has the correct permissions. What should you check next?

Accepted Answer

Verify that the logic app's network connectivity allows outbound traffic to the ServiceNow endpoint, including any regional restrictions.. The playbook is a Logic App, and intermittent timeout errors when calling an external API (ServiceNow) often indicate network connectivity issues. Since the managed identity permissions are correct, the next logical step is to verify that the Logic App's outbound traffic is allowed to the ServiceNow endpoint, including any regional restrictions that might block or delay traffic from the East US region. This directly addresses the root cause of the timeout.

Answer

Ensure the playbook is assigned to an Azure Policy that allows outbound connections.

Answer

Check if the ServiceNow API has rate limits that are being exceeded.

Answer

Verify that the logic app's workflow is configured to use asynchronous operations.

Question 4

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. The security team wants to automatically create an incident in Microsoft Sentinel when a Microsoft Defender for Endpoint alert is triggered. What should you configure?

Accepted Answer

Enable the Microsoft Defender XDR connector in Microsoft Sentinel and select the incident creation settings.. The Microsoft Defender XDR connector in Microsoft Sentinel is specifically designed to ingest alerts and incidents from Microsoft Defender for Endpoint and other Defender products. By enabling this connector and configuring its incident creation settings, Sentinel automatically creates incidents when Defender for Endpoint alerts are triggered, without requiring custom logic or manual polling.

Answer

Set up a Logic App custom connector to poll Defender alerts.

Answer

Configure the Security Events connector to forward Defender alerts.

Answer

Create analytics rules in Microsoft Sentinel for each Defender alert type.

Question 5

Your organization has Microsoft Defender for Cloud Apps (MDA) connected to Microsoft Sentinel. The SOC team wants to receive alerts when a user accesses a sanctioned cloud app from an anonymous IP address. What should you configure?

Accepted Answer

Create an activity policy in Defender for Cloud Apps and connect it to Sentinel.. An activity policy in Defender for Cloud Apps can be configured to trigger alerts on specific user activities, such as accessing a sanctioned app from an anonymous IP address. This policy can then be connected to Microsoft Sentinel via the Defender for Cloud Apps data connector, which ingests alerts as incidents for SOC review. File policies (A) focus on file-level actions like sharing or malware detection, not user access events, while session policies (D) control real-time access but do not generate alerts for historical or post-access monitoring.

Answer

Create a file policy in Defender for Cloud Apps.

Answer

Enable the Defender for Cloud Apps connector in Sentinel without additional configuration.

Answer

Create a session policy in Defender for Cloud Apps.

Question 6

Your organization is migrating to Microsoft Sentinel. You need to ensure that the workspace retains data for 2 years for compliance, but you want to reduce costs by using cheaper storage for data older than 90 days. What should you configure?

Accepted Answer

Set workspace retention to 90 days and configure long-term retention in Azure Data Explorer (ADX).. Microsoft Sentinel allows you to set the workspace retention to 90 days for interactive, hot-tier access, and then configure long-term retention in Azure Data Explorer (ADX) for data older than 90 days. This approach meets the 2-year compliance requirement while reducing costs, as ADX provides cheaper storage for older data that is queried less frequently.

Answer

Set the workspace retention to 730 days and enable a data cap.

Answer

Export data older than 90 days to a storage account and delete from workspace.

Answer

Configure the workspace retention to 90 days and use Azure Storage archiving.

Question 7

Which TWO actions can you perform using Microsoft Sentinel automation rules? (Select two.)

Accepted Answer

Create a task on an incident. Microsoft Sentinel automation rules can create tasks on incidents. This allows you to automatically assign investigation steps or remediation actions to specific personnel, ensuring consistent incident response workflows.

Answer

Create an incident automatically

Answer

Create a new automation rule

Answer

Send an email notification

Question 8

You are configuring a Microsoft Sentinel automation rule to automatically assign incidents to a specific owner based on a custom property. Which action type should you use?

Accepted Answer

Assign owner. The 'Assign owner' action type is specifically designed to change the owner of an incident in Microsoft Sentinel. When you need to automatically assign incidents to a specific owner based on a custom property (e.g., a tag or custom field), this action directly modifies the incident's 'Owner' property. Other action types serve different purposes: 'Run playbook' executes a logic app, 'Change status' updates the incident's status (e.g., New, Active, Closed), and 'Create ticket (preview)' creates an external ticket in a connected ticketing system.

Answer

Run playbook

Answer

Change status

Answer

Create ticket (preview)

Question 9

Your organization uses Microsoft Sentinel. You need to automatically classify incidents based on MITRE ATT&CK techniques. Which THREE methods can be used to accomplish this?

Accepted Answer

Enable the MITRE ATT&CK data connector.. The MITRE ATT&CK data connector in Microsoft Sentinel ingests threat intelligence feeds that include MITRE ATT&CK technique mappings, enabling automatic classification of incidents by technique. This connector pulls in indicators of compromise (IOCs) with associated technique IDs, which Sentinel then uses to tag and classify incidents during analysis.

Answer

Create a watchlist with MITRE techniques.

Answer

Use UEBA to detect techniques.

Question 10

Your organization uses Microsoft Sentinel with multiple workspaces. You need to create a unified incident queue across all workspaces. Which TWO solutions should you consider?

Accepted Answer

Consolidate all data into a single Log Analytics workspace.. Consolidating all data into a single Log Analytics workspace is the most straightforward and supported method to create a unified incident queue in Microsoft Sentinel. With a single workspace, all alerts and incidents are naturally aggregated, eliminating the need for cross-workspace synchronization. This approach simplifies management, ensures consistent analytics rules, and avoids the complexity of stitching incidents across multiple workspaces.

Answer

Use cross-workspace queries in workbooks.

Answer

Use Azure Policy to enforce workspace configuration.

Answer

Deploy multiple playbooks to synchronize incidents.

Question 11

Your company is deploying Microsoft Sentinel in a multi-tenant environment using Azure Lighthouse. You need to ensure that SOC analysts can triage incidents across all tenants from a single workspace. What is the minimum configuration required?

Accepted Answer

Onboard each tenant as a delegated resource under Azure Lighthouse, then route all logs to a single Sentinel workspace in the managing tenant.. Azure Lighthouse enables multi-tenant management by delegating subscriptions or resource groups from each tenant as delegated resources to the managing tenant. Once delegated, you can configure a single Microsoft Sentinel workspace in the managing tenant to ingest logs from all delegated tenants via diagnostic settings, allowing SOC analysts to triage incidents centrally without needing separate workspaces or cross-workspace queries.

Answer

Create a second Sentinel workspace in the managing tenant and configure cross-workspace queries.

Answer

Configure Azure AD B2B collaboration to grant external users access to each tenant's Sentinel workspace.

Answer

Use Azure Policy to enforce a standard analytics rule across all tenants.

Question 12

Your organization uses Microsoft Sentinel. You need to ensure that an incident is automatically assigned to the appropriate team based on the type of alert. What should you configure?

Accepted Answer

Automation rule. Automation rules in Microsoft Sentinel allow you to automatically assign incidents to specific teams based on conditions such as alert type or severity. This is the correct configuration because automation rules can trigger actions like incident assignment, tagging, or status changes without requiring a complex logic app or custom code.

Answer

Workbook

Answer

Playbook

Answer

Analytics rule

Question 13

Your organization uses Microsoft Sentinel. You need to automatically assign incidents to the appropriate SOC tier based on severity. What should you create?

Accepted Answer

An automation rule with an owner assignment action. Automation rules in Microsoft Sentinel allow you to automatically assign incidents to specific owners based on conditions like severity, using the 'Assign owner' action. This directly meets the requirement to route incidents to the appropriate SOC tier without manual intervention, leveraging Sentinel's native incident management capabilities.

Answer

A data connector to Microsoft Teams

Answer

A scheduled analytics rule

Answer

A playbook in Microsoft Power Automate

Question 14

Your SOC team uses Microsoft Defender XDR. You want to ensure that all incidents are automatically classified and determined by the built-in AI before any manual review. What should you configure?

Accepted Answer

Enable the incident summarization and classification feature in Microsoft Defender XDR.. Microsoft Defender XDR includes a built-in AI-driven incident summarization and classification feature that automatically assigns a classification (e.g., true positive, false positive) and determination (e.g., malicious, clean) to each incident before manual review. This feature leverages machine learning models trained on Microsoft's global threat intelligence to reduce alert fatigue and streamline SOC workflows.

Answer

Create a custom detection rule in Microsoft Defender XDR.

Answer

Enable automation rules in Microsoft Sentinel to classify incidents.

Answer

Configure a workbook in Microsoft Sentinel to analyze incidents.

Question 15

You need to configure Microsoft Sentinel to comply with a regulatory requirement that all security incidents must be retained for 7 years. Which TWO actions should you take?

Accepted Answer

Set the workspace retention policy to 2555 days (7 years).. Setting the workspace retention policy to 2555 days (7 years) ensures that all log data ingested into the Log Analytics workspace is retained for the required period. This is the foundational mechanism for meeting long-term retention requirements in Microsoft Sentinel, as Sentinel inherits the workspace's retention settings for incident-related data.

Answer

Configure table-level retention policies for each table to 7 years.

Answer

Use Basic Logs for all tables to reduce costs.

Answer

Use Azure Policy to enforce a minimum retention period of 7 years on all workspaces.