SC-200 Manage a security operations environment Practice Test 36 — 15 Questions

Question 1

You are a Microsoft Security Operations Analyst for a large enterprise with 50,000 users. Your organization uses Microsoft Defender XDR, Microsoft Sentinel, and Microsoft Defender for Cloud Apps. The security team has observed an increase in alerts related to SaaS applications (e.g., Box, Salesforce) accessed from unusual locations. You need to design a solution to automatically investigate and respond to these alerts. The solution should: (1) correlate user activity across multiple SaaS apps, (2) automatically isolate a user's account if the risk score exceeds 90, and (3) create an incident in Sentinel. Which approach should you use?

Accepted Answer

Configure Microsoft Defender for Cloud Apps to use session policies that require reauthentication or block access when risk is high, and stream alerts to Sentinel.. Option B is correct because Defender for Cloud Apps provides session policies that can block or isolate access based on risk, and it integrates with Sentinel. Option A is not cross-app; Option C is for endpoints; Option D is not automated.

Answer

Use Microsoft Sentinel UEBA to detect anomalies and manually trigger a playbook to block the user.

Answer

Deploy Microsoft Defender for Endpoint on all devices and use device risk as a factor for conditional access.

Answer

Create analytics rules in Sentinel for each SaaS app and a playbook to isolate accounts using Microsoft Entra ID conditional access.

Question 2

Your company has a hybrid identity environment with Microsoft Entra ID and on-premises Active Directory. You recently deployed Microsoft Defender for Identity (MDI) to monitor on-premises domain controllers. The SOC team needs to receive alerts from MDI in Microsoft Sentinel. You have already installed the MDI sensor on all domain controllers and confirmed that the MDI portal shows alerts. However, no MDI alerts appear in Sentinel. The Microsoft Defender for Identity data connector in Sentinel shows 'Connected'. What should you do next?

Accepted Answer

Enable the Microsoft 365 Defender connector in Sentinel, as MDI alerts are ingested through that connector.. Option B is correct because MDI alerts are ingested into Sentinel via the Microsoft 365 Defender connector, not the MDI connector directly. The MDI connector is for other data. Option A is not needed; Option C is for health; Option D is incorrect because the connector is already connected.

Answer

Update the MDI sensor to the latest version.

Answer

Reconfigure the MDI data connector to select all alert severities.

Answer

Check the MDI sensor health status on each domain controller.

Question 3

Your organization uses Microsoft Sentinel and has a requirement to retain log data for two years for compliance purposes. You have configured the Log Analytics workspace with a retention policy of 90 days. You need to extend the retention to two years while minimizing costs. The data must remain queryable. What should you do?

Accepted Answer

Configure an archive policy to move older data to Azure Storage hot tier and use Log Analytics workspace archive retention.. Option D is correct because long-term retention with queryability is best achieved by configuring archive to Azure Storage with hot access. Option A is costly; Option B is costly; Option C is for cold storage and not queryable.

Answer

Increase the workspace retention to 730 days.

Answer

Export logs to Azure Blob Storage with cool access tier.

Answer

Enable unlimited retention for the workspace.

Question 4

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. A new security policy requires that all incidents involving 'Credential Access' tactics be automatically assigned to the Tier 1 SOC team and have a severity of 'High'. You need to configure this automation. What should you do?

Accepted Answer

Create an automation rule in Microsoft Sentinel with conditions for tactic 'Credential Access' and actions to assign to Tier 1 SOC and set severity to High.. Option A is correct because automation rules in Microsoft Sentinel can be set to trigger when an incident is created, with conditions based on tactic (e.g., Credential Access) and actions to assign owner and set severity. Option B is wrong because playbooks require an automation rule to trigger them. Option C is wrong because analytics rules create incidents but cannot assign or change severity after creation. Option D is wrong because Microsoft Defender XDR doesn't manage Sentinel incident assignment.

Answer

Configure an automated investigation rule in Microsoft Defender XDR to assign incidents.

Answer

Create a playbook in Microsoft Sentinel that runs on incident creation and assigns the incident to Tier 1 SOC.

Answer

Modify the analytics rule that generates the incidents to include the assignment and severity settings.

Question 5

Your company has a hybrid environment with Microsoft Sentinel and Microsoft Defender for Cloud. You notice that the 'Priority' field in Sentinel incidents is not being populated correctly. You need to ensure that Sentinel incidents inherit the priority from Microsoft Defender for Cloud alerts. What should you configure?

Accepted Answer

Configure the Microsoft Defender for Cloud data connector to map severity and use an automation rule to set priority based on severity.. Option D is correct because the data connector for Microsoft Defender for Cloud maps the alert's severity to Sentinel's severity, and priority can be set via an automation rule. Option A is wrong because analytics rules don't inherit from external alerts. Option B is wrong because Sentinel doesn't sync priority from Microsoft Defender for Cloud directly. Option C is wrong because workbooks don't modify incident fields.

Answer

Enable the 'Sync incidents and alerts' setting in Microsoft Defender XDR.

Answer

Use a workbook to display priority and manually update incidents.

Answer

Create an analytics rule that queries Microsoft Defender for Cloud alerts and sets the priority in the incident creation.

Question 6

Your organization uses Microsoft Sentinel. You need to design a solution to automatically respond to a specific type of incident by sending an email to the SOC manager and creating a ticket in ServiceNow. What should you use?

Accepted Answer

Create a playbook in Microsoft Sentinel and trigger it with an automation rule.. Option C is correct because playbooks (based on Logic Apps) can perform multiple actions like sending email and creating tickets. Option A is wrong because automation rules cannot directly integrate with external systems like ServiceNow. Option B is wrong because workbooks are for reporting. Option D is wrong because analytics rules only generate incidents.

Answer

Create an analytics rule that directly sends an email.

Answer

Create a workbook that triggers a webhook.

Answer

Create an automation rule that sends an email and creates a ticket.

Question 7

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You need to ensure that all incidents are reviewed within 24 hours. Which TWO actions should you take?

Accepted Answer

Create an automation rule that runs 24 hours after incident creation and escalates if status is not 'In progress'.. Options A and D are correct. Automation rules can escalate if not reviewed, and workbooks can track SLA. Option B is wrong because analytics rules don't handle SLA. Option C is wrong because playbooks don't trigger on time. Option E is wrong because Microsoft Defender XDR doesn't manage Sentinel SLA.

Answer

Create a playbook that runs every hour and checks incident age.

Answer

Configure Microsoft Defender XDR to automatically reassign incidents after 24 hours.

Answer

Modify the analytics rule to automatically close incidents after 24 hours.

Question 8

Your security team uses Microsoft Sentinel and Microsoft Purview. You need to classify incidents that involve sensitive data according to Microsoft Purview's sensitivity labels. Which THREE components should you use?

Accepted Answer

Analytics rules that trigger on data sensitivity events from Microsoft Purview.. Options A, D, and E are correct. Automation rules can trigger on label conditions, playbooks can query Purview, and analytics rules can detect data sensitivity. Option B is wrong because Microsoft Intune manages devices. Option C is wrong because Microsoft Defender for Cloud doesn't integrate with Purview labels.

Answer

Microsoft Defender for Cloud to apply sensitivity labels.

Answer

Microsoft Intune compliance policies to label data.

Question 9

Your organization uses Microsoft Sentinel and Microsoft Defender for Cloud. You need to implement a solution that automatically suppresses low-severity incidents from specific IP addresses that are known internal scanners. Which THREE configurations should you make?

Accepted Answer

Add the IP addresses to a watchlist and reference it in analytics rules.. Options A, C, and D are correct. Analytics rules can be set to suppress, automation rules can close incidents, and watchlists can be used for known IPs. Option B is wrong because Microsoft Defender for Cloud doesn't suppress Sentinel incidents. Option E is wrong because playbooks cannot suppress incidents before creation.

Answer

Create a suppression rule in Microsoft Defender for Cloud.

Answer

Create a playbook that deletes incidents from those IP addresses.

Question 10

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You are responsible for managing the security operations environment. Recently, the SOC team reported that incidents from Microsoft Defender for Endpoint are not appearing in Microsoft Sentinel. You have already configured the data connector for Microsoft Defender XDR and verified that logs are flowing into the 'SecurityAlert' table. However, incidents are not being created in Sentinel. What should you do?

Accepted Answer

Enable 'Create incidents from Microsoft 365 Defender' in the Microsoft Defender XDR data connector.. Option A is correct because incident creation from Defender XDR requires enabling the 'Microsoft 365 Defender' incident creation in the data connector. Option B is wrong because analytics rules are not needed; incidents come from the connector. Option C is wrong because that connector is for alerts, not incidents. Option D is wrong because streaming is not the issue.

Answer

Create an analytics rule that queries the SecurityAlert table and generates incidents.

Answer

Verify the Azure Sentinel solution is installed and enable the streaming of incidents.

Answer

Configure the Microsoft Defender for Endpoint data connector.

Question 11

Your organization uses Microsoft Sentinel and Microsoft Entra ID. You need to implement a solution that automatically disables a user account in Microsoft Entra ID when a high-severity incident involving that user is created in Sentinel. The solution must also send a notification to the security team. You have a playbook that disables the user and sends an email. What should you configure to trigger the playbook?

Accepted Answer

Create an automation rule that runs when an incident is created with severity High and triggers the playbook.. Option B is correct because automation rules can trigger playbooks on incident creation with conditions. Option A is wrong because analytics rules trigger playbooks but on alert creation, not incident creation. Option C is wrong because playbooks must be triggered by automation rules or analytics rules. Option D is wrong because workbooks cannot trigger playbooks.

Answer

Configure the playbook to run on a schedule and query incidents.

Answer

Create a workbook that triggers the playbook when a high-severity incident appears.

Answer

Configure the playbook as a response action in the analytics rule that generates the incident.

Question 12

Your organization uses Microsoft Sentinel and Microsoft Defender for Cloud. You need to ensure that all security alerts from Microsoft Defender for Cloud are ingested into Sentinel and that incidents are automatically created for alerts with severity 'High' or higher. You have already connected Microsoft Defender for Cloud to Sentinel using the data connector. However, no incidents are being created. What should you do?

Accepted Answer

Create an analytics rule that uses the SecurityAlert table and generates incidents for high severity.. Option D is correct because the data connector for Defender for Cloud only brings alerts; to create incidents, you need an analytics rule. Option A is wrong because incident creation is not automatic from that connector. Option B is wrong because automation rules don't create incidents. Option C is wrong because the connector does not have an incident creation toggle.

Answer

Configure a streaming policy to forward Defender for Cloud incidents.

Answer

Enable 'Create incidents' in the Microsoft Defender for Cloud data connector.

Answer

Create an automation rule that runs on alert ingestion and creates incidents.

Question 13

Your organization uses Microsoft Sentinel. The SOC manager wants to track the average time to triage incidents. You need to create a report that shows this metric. What should you use?

Accepted Answer

Create a workbook that uses KQL to query incident data and display the average time.. Option C is correct because workbooks can query the SecurityIncident table and compute average time. Option A is wrong because analytics rules generate alerts, not reports. Option B is wrong because automation rules don't create reports. Option D is wrong because playbooks are for automation, not reporting.

Answer

Create a playbook that sends a report via email.

Answer

Create an automation rule that logs the triage time to a custom table.

Answer

Create an analytics rule that calculates the time to triage.

Question 14

Your organization uses Microsoft Sentinel. You have a custom analytics rule that generates incidents based on a KQL query. The rule is configured to run every 5 minutes. You notice that the rule is generating duplicate incidents for the same event. What should you do to prevent duplicates?

Accepted Answer

Enable entity mapping in the analytics rule and set appropriate entities.. Option A is correct because enabling entity mapping allows Sentinel to group alerts into incidents based on entities. Option B is wrong because grouping by time is not sufficient. Option C is wrong because suppression logic in automation rules is for actions, not incident creation. Option D is wrong because playbooks cannot prevent duplicates.

Answer

Create an automation rule that deletes duplicate incidents.

Answer

Set the rule to group alerts into a single incident if they occur within 5 minutes.

Answer

Create a playbook that checks for duplicates before incident creation.

Question 15

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You need to configure a solution that automatically escalates incidents that have been in 'New' status for more than 4 hours. The escalation should change the status to 'Active' and assign the incident to a senior analyst. What should you do?

Accepted Answer

Create an automation rule that triggers when an incident is created, with a condition 'Time since created > 4 hours' and actions to set status and owner.. Option C is correct because automation rules can be created with a condition 'Incident created time older than 4 hours' and actions to change status and owner. Option A is wrong because playbooks need to be triggered by an automation rule. Option B is wrong because analytics rules don't run on existing incidents. Option D is wrong because Microsoft Defender XDR doesn't manage Sentinel incidents.

Answer

Modify the analytics rule to update the incident after 4 hours.

Answer

Configure Microsoft Defender XDR to escalate incidents older than 4 hours.

Answer

Create a playbook that runs every hour and updates incidents.