SC-200 Manage a security operations environment Practice Test 38 — 15 Questions

Question 1

Your organization uses Microsoft Sentinel. You need to design a solution to automatically respond to a specific type of incident by sending an email to the SOC manager and creating a ticket in ServiceNow. What should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a playbook in Microsoft Sentinel and trigger it with an automation rule.. Microsoft Sentinel uses Azure Logic Apps-based playbooks to execute complex, multi-step automated responses, such as sending an email and creating a ServiceNow ticket. An automation rule is required to trigger the playbook when an incident meets specific criteria, as analytics rules alone cannot directly invoke external systems like ServiceNow.

Answer

Create an analytics rule that directly sends an email.

Answer

Create a workbook that triggers a webhook.

Answer

Create an automation rule that sends an email and creates a ticket.

Question 2

Your security team uses Microsoft Sentinel and Microsoft Purview. You need to classify incidents that involve sensitive data according to Microsoft Purview's sensitivity labels. Which THREE components should you use?

Accepted Answer

Analytics rules that trigger on data sensitivity events from Microsoft Purview.. Microsoft Purview's data sensitivity events, such as when a file is labeled with a specific sensitivity label, can be ingested into Microsoft Sentinel via the Purview Data Connector. Analytics rules can then be configured to trigger on these events, allowing the security team to automatically generate incidents when sensitive data is detected or mishandled, directly integrating Purview's classification into Sentinel's incident pipeline.

Answer

Microsoft Defender for Cloud to apply sensitivity labels.

Answer

Microsoft Intune compliance policies to label data.

Question 3

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You are responsible for managing the security operations environment. Recently, the SOC team reported that incidents from Microsoft Defender for Endpoint are not appearing in Microsoft Sentinel. You have already configured the data connector for Microsoft Defender XDR and verified that logs are flowing into the 'SecurityAlert' table. However, incidents are not being created in Sentinel. What should you do?

Accepted Answer

Enable 'Create incidents from Microsoft 365 Defender' in the Microsoft Defender XDR data connector.. Enabling 'Create incidents from Microsoft 365 Defender' in the Microsoft Defender XDR data connector (A) is the correct action. This setting allows Microsoft Sentinel to automatically create incidents from alerts generated by Microsoft Defender XDR, including those from Defender for Endpoint. Even though alerts are flowing into the SecurityAlert table, incident creation requires this specific toggle to be enabled.

Answer

Create an analytics rule that queries the SecurityAlert table and generates incidents.

Answer

Verify the Azure Sentinel solution is installed and enable the streaming of incidents.

Answer

Configure the Microsoft Defender for Endpoint data connector.

Question 4

Your organization uses Microsoft Sentinel. You need to design a solution to automatically respond to a specific type of incident by sending an email to the SOC manager and creating a ticket in ServiceNow. What should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an automation rule that runs when an incident is created with severity High and triggers the playbook.. To automatically trigger a playbook when a high-severity incident is created in Microsoft Sentinel, you should create an automation rule. Automation rules in Microsoft Sentinel allow you to define conditions (such as incident severity) and actions (such as running a playbook). This is the native, no-code way to trigger playbooks based on incident creation.

Answer

Configure the playbook to run on a schedule and query incidents.

Answer

Create a workbook that triggers the playbook when a high-severity incident appears.

Answer

Configure the playbook as a response action in the analytics rule that generates the incident.

Question 5

Your organization uses Microsoft Sentinel. The SOC manager wants to track the average time to triage incidents. You need to create a report that shows this metric. What should you use?

Accepted Answer

Create a workbook that uses KQL to query incident data and display the average time.. Microsoft Sentinel workbooks can be built using Kusto Query Language (KQL) to query the SecurityIncident table and compute the average time to triage, allowing the SOC manager to track this metric. Option B is incorrect because playbooks are designed for automation and response, not for creating reports. Option C is incorrect because automation rules are for automated incident handling, not for reporting or logging custom metrics. Option D is incorrect because analytics rules are used to generate alerts based on queries, not to produce reports.

Answer

Create a playbook that sends a report via email.

Answer

Create an automation rule that logs the triage time to a custom table.

Answer

Create an analytics rule that calculates the time to triage.

Question 6

Your SOC team needs to ensure that all incidents in Microsoft Sentinel are assigned to an analyst within 30 minutes of creation. Which TWO configurations should you implement?

Accepted Answer

Create a playbook that uses the Update Incident action to set the owner field.. A playbook (an Azure Logic Apps workflow) can use the 'Update Incident' action to programmatically set the owner field on an incident. This allows you to implement custom assignment logic, such as round-robin or based on analyst skill set, triggered by an automation rule or manually. Option C is correct because an automation rule can directly set the owner field when an incident is created, without needing a playbook, by using the 'Update incident' action within the rule itself. Both configurations ensure incidents are assigned within the required 30-minute window.

Answer

Set up a playbook that sends an email to the SOC manager when an incident is created.

Answer

Configure a Microsoft Teams connector to post incidents to a channel.

Answer

Modify the analytics rule to include a custom details field for analyst name.

Question 7

Your SOC is implementing a Microsoft Sentinel workspace with multiple content hub solutions. You need to ensure that only approved analytics rules are enabled and that any custom rules are reviewed before activation. Which THREE actions should you take?

Accepted Answer

Use Microsoft Sentinel Repositories (CI/CD) to manage analytics rules via Azure DevOps or GitHub.. Option C is correct because Microsoft Sentinel Repositories enable CI/CD-based deployment of analytics rules from Azure DevOps or GitHub, so every rule change goes through a pull request and review before activation, enforcing the approval workflow. Option D is correct because installing only Content hub solutions that contain approved analytics rules ensures that only vetted, Microsoft-published or approved rule templates are deployed into the workspace, preventing unapproved content from being enabled. Option E is correct because an automation rule triggered on analytics rule creation can immediately disable any rule not present in the approved list, providing a runtime guardrail that catches rules created outside the governed pipeline. Option A is not correct because the Threat Intelligence - TAXII connector imports threat indicators, not analytics rules, so it does not govern rule enablement. Option B is not correct because hunting queries are separate from analytics rules and do not satisfy the requirement to control which analytics rules are enabled or reviewed.

Answer

Configure Threat Intelligence - Taxii connector to import rules from an external feed.

Answer

Use the Hunting blade to create custom hunting queries instead of analytics rules.

Question 8

You are managing a Microsoft Sentinel environment that ingests data from multiple sources: Microsoft 365, Azure Activity, and custom logs via AMA. The SOC manager has requested that all security events from Windows servers be collected and stored for 90 days for compliance purposes. You have configured the Windows Security Events via AMA data connector to collect all events (Event ID 4624, 4625, etc.) and set the workspace retention to 90 days. After a week, you notice that the daily ingested volume is higher than expected, exceeding the budget. You analyze the data and find that many low-severity informational events are being ingested, such as Event ID 5156 (Windows Filtering Platform allowed connection). The manager confirms that only security-relevant events are needed. What should you do to reduce ingestion volume while still meeting compliance requirements?

Accepted Answer

Modify the data collection rule (DCR) for the Windows Security Events connector to use a custom XPath query that excludes informational events (e.g., exclude Event ID 5156).. The AMA connector uses data collection rules (DCRs) that allow you to filter events based on custom XPath queries. By creating a custom XPath query that excludes informational events like Event ID 5156, you can reduce ingestion volume while still collecting security-relevant events (e.g., 4624, 4625) for the required 90-day retention. Option A is incorrect because reducing the workspace retention to 30 days would violate the compliance requirement for 90 days. Option B is incorrect because the Azure Activity data connector collects Azure resource logs, not Windows security events. Option D is incorrect because the legacy MMA connector is deprecated and does not provide the same filtering capabilities; AMA is the recommended solution.

Answer

Reduce the workspace retention period to 30 days to lower storage costs.

Answer

Configure the Azure Activity data connector to filter out low-severity events.

Answer

Disable the AMA-based connector and use the legacy MMA-based connector instead.

Question 9

Your organization has a Microsoft Sentinel workspace that ingests data from Microsoft 365 Defender (Defender for Endpoint, Office 365, Identity, Cloud Apps). You have configured a scheduled analytics rule to detect possible privilege escalation based on user activity. The rule runs every 5 minutes and looks at the last 5 minutes of data. Recently, the rule has been generating a high number of false positives. You analyze the alerts and find that they are triggered by legitimate administrative actions. You need to reduce false positives without completely disabling the rule. The rule uses a KQL query that joins the IdentityLogonEvents and CloudAppEvents tables. What should you do?

Accepted Answer

Modify the KQL query to exclude events from a list of known administrative user accounts or IP addresses.. The false positives come from legitimate administrative actions triggering a privilege-escalation detection. The most targeted fix is to refine the KQL query to exclude known administrative user accounts or IP addresses, which preserves the rule's ability to detect real privilege escalation while filtering out the noisy legitimate activity. This is the standard Sentinel tuning approach for high-fidelity detections.

Answer

Increase the rule's run frequency to every 30 minutes.

Answer

Reduce the query's lookback period to 1 minute.

Answer

Add an incident suppression rule that closes incidents from known admin accounts.

Question 10

You are a security operations analyst for a company that uses Microsoft Sentinel. The SOC manager wants to ensure that only incidents with a severity of High or Critical are automatically assigned to the on-call analyst, while all other incidents remain unassigned. You need to create an automation rule that meets this requirement. What should you do first?

Accepted Answer

Create a new automation rule and set the trigger to "When incident is created". Add a condition that checks if the incident severity is High or Critical. Then add an action to assign the incident to the on-call analyst.. Automation rules in Microsoft Sentinel are designed to automate incident handling tasks such as assignment, tagging, and status changes. They can be triggered when an incident is created and include conditions based on incident properties. This makes them the ideal solution for conditionally assigning incidents based on severity without custom development.

Answer

Create a playbook that runs on incident creation, parses the incident severity, and if High or Critical, assigns the incident using the Microsoft Sentinel API.

Answer

Create a scheduled query rule that detects High and Critical incidents and then triggers a Logic App to assign them.

Answer

Modify the incident settings in Microsoft Sentinel to automatically assign all High and Critical incidents to the on-call analyst by default.

Question 11

You are a Microsoft Sentinel administrator for a company that ingests Microsoft Defender XDR incidents into Microsoft Sentinel. You create an automation rule to automatically assign incidents to a specific analyst. The rule uses the condition 'Analytics rule name contains 'Suspicious'' and the action 'Assign owner'. After deployment, you notice that incidents from Microsoft Defender XDR are not being assigned. What is the most likely cause?

Accepted Answer

The condition 'Analytics rule name' is not populated for incidents that originate from Microsoft Defender XDR, so the rule condition never matches.. The automation rule failed because incidents from Microsoft Defender XDR do not have an 'Analytics rule name' property. That property is only set for incidents created by Sentinel analytics rules. To assign these incidents, the condition should be based on a property that exists, such as 'Product name' or 'Title'. This is a common pitfall when mixing incidents from different sources.

Answer

Automation rules in Microsoft Sentinel can only be triggered by incidents created by analytics rules, not by incidents ingested from Microsoft Defender XDR.

Answer

The automation rule must be enabled for each Microsoft Defender XDR connector separately.

Answer

Automation rules require a playbook to be attached to perform the assignment action.

Question 12

You are a security operations analyst for a company that uses Microsoft Sentinel. The SOC manager wants to reduce alert fatigue by automatically closing incidents that are created by a specific analytics rule and contain only low-severity alerts. You need to configure this behavior with the least administrative effort. What should you do?

Accepted Answer

Create an automation rule that runs when an incident is created, with a condition on the analytics rule name and severity, and an action to change the incident status to Closed.. Microsoft Sentinel automation rules are designed for lightweight incident handling and can trigger when an incident is created. By scoping conditions to the analytics rule name and severity, the rule targets only the intended low-severity incidents and uses the built-in status change action to close them. This avoids custom code, reduces manual triage, and meets the least-effort requirement.

Answer

Configure a workbook that filters incidents by severity and analytics rule, and instruct analysts to manually close matching incidents during each shift.

Answer

Create a playbook that queries the Microsoft Sentinel incidents table with a KQL query for low-severity incidents and then calls the Microsoft Sentinel API to close them on a schedule.

Answer

Modify the analytics rule to set the incident creation setting to Disabled so that no incident is created for low-severity alerts.

Question 13

Your organization uses Microsoft Sentinel. You need to design a solution to automatically respond to a specific type of incident by sending an email to the SOC manager and creating a ticket in ServiceNow. What should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Active Directory (Azure AD) audit logs. To enable UEBA in Microsoft Sentinel, you must ingest Microsoft Entra ID sign-in logs and Microsoft Entra ID audit logs. These provide the necessary user authentication and activity data for behavioral baselining. Other logs can be added later to enrich UEBA but are not mandatory for the initial enablement.

Answer

Azure Activity logs

Answer

Microsoft Defender for Identity logs

Answer

Microsoft 365 audit logs

Question 14

You are a security operations analyst for a company that uses Microsoft Defender XDR. You need to ensure that when a high-severity alert is generated in Microsoft Defender for Endpoint, an incident is automatically created in Microsoft Defender XDR and appears in the incident queue. What should you do?

Accepted Answer

Verify that the alert is not suppressed and that incident creation is enabled in the Microsoft Defender XDR settings.. Microsoft Defender XDR automatically creates incidents from alerts generated by its component services, including Defender for Endpoint, when incident creation is enabled and alerts are not suppressed. Checking these settings ensures that high-severity alerts result in incidents. The other options involve unnecessary customizations or misconfigured features that do not directly control incident creation in Defender XDR.

Answer

Enable the Microsoft Defender for Endpoint integration in Microsoft Defender XDR and set the alert severity threshold to High.

Answer

Create a custom detection rule in Microsoft Defender for Endpoint that triggers on high-severity alerts.

Answer

Configure a Microsoft Sentinel analytics rule to ingest high-severity alerts from Defender for Endpoint and create incidents.

Question 15

You are a security operations analyst for a company that uses Microsoft Defender XDR. You need to configure alert notifications so that the security team receives an email whenever a high-severity alert is generated. What should you do?

Accepted Answer

In the Microsoft 365 Defender portal, go to Settings > Microsoft 365 Defender > Alert notifications, and create a new notification rule with severity set to High.. Microsoft Defender XDR provides built-in alert notification settings that allow you to define rules based on severity, alert category, and other criteria. Configuring a notification rule with severity High ensures that the security team receives email alerts for high-severity incidents across all Defender workloads.

Answer

In Microsoft Sentinel, create an automation rule that triggers on high-severity incidents and sends an email using a playbook.

Answer

In Microsoft Defender for Endpoint, configure alert notifications for high-severity alerts.

Answer

In Azure Monitor, create an action group that sends emails for high-severity alerts from Microsoft Defender XDR.