SC-200 Manage a security operations environment Practice Test 37 — 15 Questions

Question 1

You are a Microsoft Security Operations Analyst. Your organization recently deployed Microsoft Defender for Cloud Apps. You need to ensure that alerts generated by Defender for Cloud Apps are automatically forwarded to Microsoft Sentinel. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

In Microsoft Sentinel, add the Microsoft Defender for Cloud Apps data connector.. The Microsoft Defender for Cloud Apps data connector in Microsoft Sentinel is the native integration that automatically forwards alerts and cloud discovery logs from Defender for Cloud Apps into Sentinel. This connector uses the Microsoft Graph Security API to ingest alerts without requiring additional configuration in Defender for Cloud Apps, enabling seamless correlation and investigation within Sentinel.

Answer

In Microsoft Sentinel, create an analytics rule with a query that pulls data from Defender for Cloud Apps API.

Answer

In Microsoft Defender for Cloud Apps, configure SIEM integration.

Answer

In Microsoft Sentinel, configure a playbook to retrieve alerts from Defender for Cloud Apps.

Question 2

Your organization uses Microsoft Defender for Identity. You need to monitor for potential lateral movement attacks using pass-the-hash techniques. Which entity type in Microsoft Defender for Identity should you focus on in the security alert timeline?

Accepted Answer

Account. In Microsoft Defender for Identity, lateral movement attacks using pass-the-hash (PtH) techniques are tracked at the account entity level because the attacker reuses a stolen NTLM hash to authenticate as a specific user account across multiple devices. The security alert timeline groups related activities by the compromised account, enabling analysts to trace the attacker's steps from the initial breach to subsequent resource access. Focusing on the account entity provides the clearest view of the authentication attempts and successful logons that indicate PtH behavior.

Answer

IP address

Answer

Device

Answer

Computer

Question 3

A company uses Microsoft Sentinel with the Microsoft 365 Defender connector. The security team notices that alerts from Microsoft Defender for Endpoint (MDE) are not appearing in Sentinel. The MDE data connector status shows 'Connected'. Which step should you take to troubleshoot this issue?

Accepted Answer

Check the Microsoft 365 Defender portal to ensure MDE alerts are being generated and forwarded to Microsoft 365 Defender.. The Microsoft 365 Defender connector in Microsoft Sentinel ingests alerts that have already been generated and forwarded by Microsoft Defender for Endpoint (MDE) to the Microsoft 365 Defender portal. Even if the connector status shows 'Connected', if MDE alerts are not being generated or forwarded to Microsoft 365 Defender (e.g., due to a licensing issue, misconfigured alert policy, or service health problem), they will never reach Sentinel. Therefore, the first troubleshooting step is to verify alert generation and forwarding at the source in the Microsoft 365 Defender portal.

Answer

Verify that the Microsoft 365 Defender connector is configured to ingest MDE alerts.

Answer

Check if the Microsoft Defender for Endpoint data connector is added.

Answer

Verify that the ingestion rules in Sentinel are not filtering out MDE alerts.

Question 4

Your organization is using Microsoft Sentinel and has deployed the Microsoft Entra ID (Azure AD) connector. You need to create an analytics rule that triggers an incident when a user from a specific IP address is assigned the Global Administrator role. The IP address is not in your trusted IP list. Which KQL query should you use as the rule logic?

Accepted Answer

AuditLogs | where ActivityDisplayName == 'Add member to role' and TargetResources[0].displayName == 'Global Administrator' and InitiatedBy.app.ipAddress !in (dynamic(['10.0.0.1', '10.0.0.2'])). It uses the `!in` operator to filter out specific IP addresses from the `InitiatedBy.app.ipAddress` field, ensuring that only events from IP addresses not in the trusted list trigger an incident. The query correctly targets `AuditLogs` with `ActivityDisplayName == 'Add member to role'` and checks that the role assigned is `Global Administrator` via `TargetResources[0].displayName`. This logic matches the requirement to alert when a user from a specific IP address (10.0.0.1) that is not in the trusted list is assigned the Global Administrator role.

Answer

AuditLogs | where ActivityDisplayName == 'Add member to role' and TargetResources[0].displayName == 'Global Administrator' and InitiatedBy.app.ipAddress == '10.0.0.1'

Answer

AuditLogs | where ActivityDisplayName == 'Add member to role' and TargetResources[0].displayName == 'Global Administrator' and InitiatedBy.app.ipAddress !has '10.0.'

Answer

AuditLogs | where ActivityDisplayName == 'Add member to role' and TargetResources[0].displayName == 'Global Administrator' and InitiatedBy.app.ipAddress !in ('trusted IP list')

Question 5

Your organization uses Microsoft Defender for Office 365. You need to configure a policy that automatically moves emails detected as 'Bulk' to the user's Junk Email folder. However, users must be able to override this by adding the sender to their Safe Senders list. What should you configure?

Accepted Answer

Anti-spam policy with Bulk email threshold set to a value that triggers junk action. The Bulk email threshold setting in an anti-spam policy allows you to specify a Bulk Complaint Level (BCL) value that, when exceeded, triggers a specific action such as moving the email to the Junk Email folder. This action respects the user's Safe Senders list, meaning if the sender is added to that list, the email will bypass the junk folder and be delivered to the inbox. Other policy types like anti-phishing, malware filter, or connection filter do not provide this granular control over bulk email classification and user override behavior.

Answer

Anti-phishing policy

Answer

Malware filter policy

Answer

Connection filter policy

Question 6

A security operations center (SOC) uses Microsoft Sentinel. You need to ensure that when a high-severity incident is created, an automated email notification is sent to the on-call security engineer. Which automation option should you use?

Accepted Answer

Create a playbook that sends an email and associate it with an automation rule that triggers on high-severity incidents.. Microsoft Sentinel uses automation rules to trigger playbooks (Azure Logic Apps) based on incident creation or update conditions. By associating a playbook that sends an email with an automation rule set to trigger on high-severity incidents, the SOC achieves fully automated, event-driven notification without manual intervention.

Answer

Set an analytics rule to run a KQL query and send email.

Answer

Create a workbook that emails the on-call engineer daily.

Answer

Configure a logic app manually triggered by the analyst.

Question 7

Your organization uses Microsoft Defender XDR. You need to investigate a potential ransomware incident that has affected multiple devices. The security team wants to identify the initial access vector. Which advanced hunting table should you query to find the process that initiated the encryption?

Accepted Answer

DeviceProcessEvents. DeviceProcessEvents logs process creation events, including the command line and parent process details. To identify the initial access vector in a ransomware incident, you need to trace the process tree back to the executable that launched the encryption process, which is precisely what this table captures.

Answer

DeviceRegistryEvents

Answer

DeviceFileEvents

Answer

DeviceNetworkEvents

Question 8

Your organization uses Microsoft Sentinel with the Azure Activity connector. Which TWO actions should you take to ensure that all subscription-level activity logs are being ingested into Sentinel?

Accepted Answer

Assign the 'Reader' role to the Sentinel managed identity on each subscription.. The Azure Activity data connector uses a managed identity to read subscription-level activity logs. Assigning the 'Reader' role to that managed identity on each subscription grants it the necessary permissions to access and ingest the logs into Sentinel. Without this role assignment, the connector cannot retrieve the activity data, even if the connector is configured.

Answer

Install the Azure Activity solution from the content hub.

Answer

Enable diagnostic settings on each subscription to stream logs to the Sentinel Log Analytics workspace.

Answer

Use the Azure Policy initiative to deploy the connector.

Question 9

Your Microsoft Defender XDR environment has an advanced hunting query that returns devices potentially affected by a known vulnerability. You want to create a custom detection rule that triggers an alert when more than 10 devices are affected. Which THREE steps are required?

Accepted Answer

Set the rule frequency and threshold to trigger when the query returns more than 10 results.. Setting the rule frequency and threshold to trigger when the query returns more than 10 results directly implements the requirement to alert when more than 10 devices are affected. In Microsoft Defender XDR custom detection rules, the threshold condition is configured in the rule settings to evaluate the number of query results against a specified count, enabling precise alert triggering based on result volume.

Answer

Assign the rule to a severity level.

Answer

Create a Power Automate flow to send an email when the rule triggers.

Question 10

Your organization plans to use Microsoft Sentinel for incident management. Which TWO are native incident management features in Sentinel?

Accepted Answer

Incident comments and collaboration. Microsoft Sentinel provides native incident comments and collaboration features that allow analysts to add notes, tag team members, and maintain a running audit trail directly within the incident record. This is a built-in capability, not requiring any external integration or additional licensing.

Answer

Automated email notifications on incident creation

Answer

Integration with ServiceNow via out-of-the-box connector

Answer

Integration with Microsoft Teams for incident chat

Question 11

You are configuring Microsoft Defender for Cloud Apps with Cloud Discovery. You need to ensure that logs from your network proxies are processed correctly. Which THREE steps are required?

Accepted Answer

Upload the log files manually or configure automatic log upload using the log collector.. Microsoft Defender for Cloud Apps Cloud Discovery requires log data from network proxies to be ingested either by manually uploading log files or by configuring automatic log upload via the log collector. The log collector is a Docker-based container that parses and normalizes proxy logs before forwarding them to Defender for Cloud Apps, enabling shadow IT discovery without manual intervention.

Answer

Install the Microsoft Defender for Cloud Apps connector in Sentinel.

Answer

Enable Azure Information Protection for labeling.

Question 12

Your organization uses Microsoft Sentinel and wants to reduce alert fatigue. Which TWO actions should you take to improve the quality of incidents?

Accepted Answer

Configure alert grouping in analytics rules to combine related alerts into one incident.. Configuring alert grouping in analytics rules consolidates multiple related alerts into a single incident, reducing noise and helping analysts focus on the root cause rather than triaging individual alerts. This directly improves incident quality by providing a richer context and reducing alert fatigue.

Answer

Create separate incidents for each alert.

Answer

Create automation rules to close all low-severity incidents automatically.

Answer

Increase the severity of all low-severity alerts to high.

Question 13

You are investigating a phishing incident in Microsoft Defender for Office 365. Which THREE pieces of information are available in the Threat Explorer?

Accepted Answer

Sender IP address. Sender IP address is available in Threat Explorer because it is a core property of email message trace data in Microsoft Defender for Office 365. Threat Explorer captures the originating IP address from the SMTP session header, which is essential for identifying the source of a phishing attack and correlating with threat intelligence feeds.

Answer

Email body content

Answer

User's mailbox audit log

Question 14

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. A new security policy requires that all incidents involving 'Credential Access' tactics be automatically assigned to the Tier 1 SOC team and have a severity of 'High'. You need to configure this automation. What should you do?

Accepted Answer

Create an automation rule in Microsoft Sentinel with conditions for tactic 'Credential Access' and actions to assign to Tier 1 SOC and set severity to High.. Automation rules in Microsoft Sentinel allow you to define conditions based on incident properties, such as tactic, and then trigger actions like assigning the incident to a specific owner (Tier 1 SOC) and setting the severity. This directly meets the policy requirement without requiring external playbooks or modifying analytics rules.

Answer

Configure an automated investigation rule in Microsoft Defender XDR to assign incidents.

Answer

Create a playbook in Microsoft Sentinel that runs on incident creation and assigns the incident to Tier 1 SOC.

Answer

Modify the analytics rule that generates the incidents to include the assignment and severity settings.

Question 15

Your company has a hybrid environment with Microsoft Sentinel and Microsoft Defender for Cloud. You notice that the 'Priority' field in Sentinel incidents is not being populated correctly. You need to ensure that Sentinel incidents inherit the priority from Microsoft Defender for Cloud alerts. What should you configure?

Accepted Answer

Configure the Microsoft Defender for Cloud data connector to map severity and use an automation rule to set priority based on severity.. Microsoft Defender for Cloud alerts include a severity field, and the Microsoft Defender for Cloud data connector in Sentinel can ingest this severity. By mapping the severity in the connector configuration, you can then use an automation rule to set the Sentinel incident's 'Priority' field based on the mapped severity, ensuring inheritance from Defender for Cloud alerts.

Answer

Enable the 'Sync incidents and alerts' setting in Microsoft Defender XDR.

Answer

Use a workbook to display priority and manually update incidents.

Answer

Create an analytics rule that queries Microsoft Defender for Cloud alerts and sets the priority in the incident creation.