SC-200 Manage a security operations environment Practice Test 4 — 15 Questions

Question 1

Refer to the exhibit. You have an automation rule in Microsoft Sentinel configured as shown. The rule does not trigger as expected for newly created incidents with High severity. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The trigger type is misspelled; it should be 'Microsoft.SecurityInsights/Incident' instead of 'Microsoft.securityInsights/Incident'.. The automation rule's trigger type is misspelled as 'Microsoft.securityInsights/Incident' (with a lowercase 's' in 'SecurityInsights'), whereas the correct trigger type is 'Microsoft.SecurityInsights/Incident' (with an uppercase 'S'). This casing mismatch causes the rule to fail to trigger on new incidents, as Sentinel's automation rule engine is case-sensitive when matching trigger types.

Answer

The automation rule is disabled because 'state' is set to 'Enabled' but the rule is in a 'Disabled' state due to a missing property.

Answer

The playbookId references a Logic App in a resource group that does not exist.

Answer

The conditions use 'Equals' operator, but 'Severity' and 'Status' require 'Contains' operator.

Question 2

Refer to the exhibit. You are creating an automation rule in Microsoft Sentinel. The rule is enabled but does not assign incidents. What is the most likely issue?

Accepted Answer

The action 'AssignIncident' is not a supported automation rule action.. The 'AssignIncident' action is not a supported action type in Microsoft Sentinel automation rules. Automation rules support only 'Run Playbook' and 'Change Status' actions; incident assignment must be done via playbooks or manually, not directly within an automation rule.

Answer

The condition 'Owner' property does not support 'Equals' operator.

Answer

The trigger type 'Microsoft.SecurityInsights/Incident' is incorrect.

Answer

The 'assignedTo' value should be a user principal name instead of an email alias.

Question 3

Your organization uses Microsoft Sentinel with multiple workspaces. You need to ensure that incidents involving the same alert in different workspaces are automatically grouped into a single incident. What should you configure?

Accepted Answer

Create an analytics rule that runs across all workspaces.. You can create a scheduled analytics rule that queries across multiple workspaces (using the workspace() function or union operator) and if the same alert appears in multiple workspaces, the rule can generate a single incident. This allows automatic grouping of correlated alerts from different workspaces into one incident. Option D is incorrect because Microsoft Sentinel does not have a dedicated 'incident grouping rule' that groups alerts from multiple workspaces; that feature does not exist.

Answer

Enable UEBA to correlate alerts across workspaces.

Answer

Set up an automation rule to merge incidents.

Answer

Configure an incident grouping rule in Microsoft Sentinel.

Question 4

Your organization uses Microsoft Sentinel. You need to automatically classify incidents based on MITRE ATT&CK techniques. Which THREE methods can be used to accomplish this?

Accepted Answer

Enable the MITRE ATT&CK data connector.. Option A is correct because enabling the MITRE ATT&CK data connector in Microsoft Sentinel imports the full ATT&CK framework into the workspace, allowing incidents to be automatically classified and enriched with MITRE technique information. Option C is correct because analytics rules in Microsoft Sentinel include a built-in MITRE ATT&CK mapping section where you associate each rule with specific tactics and techniques, so any incident generated by that rule is automatically tagged with the corresponding MITRE techniques. Option E is correct because automation rules can run when incidents are created and apply actions such as adding tags, including MITRE technique tags, to automatically classify incidents. Option B is not correct because a watchlist is a custom lookup table of data (for example, IPs or users) used for enrichment or filtering, not a native mechanism for automatically classifying incidents by MITRE ATT&CK techniques. Option D is not correct because UEBA (User and Entity Behavior Analytics) identifies anomalous behavior and entities, but it does not by itself automatically classify incidents with MITRE ATT&CK techniques.

Answer

Create a watchlist with MITRE techniques.

Answer

Use UEBA to detect techniques.

Question 5

Your organization uses Microsoft Sentinel with multiple workspaces. You need to create a unified incident queue across all workspaces. Which TWO solutions should you consider?

Accepted Answer

Consolidate all data into a single Log Analytics workspace.. Option B is correct because consolidating all data into a single Log Analytics workspace eliminates the multi-workspace fragmentation entirely, so Microsoft Sentinel surfaces one unified incident queue with all analytics rules, incidents, and entities in one place. Option C is correct because Microsoft Sentinel's incident grouping rules (automation rules with the 'Group incidents' action) can merge related incidents across workspaces into a single grouped incident, giving a unified queue without migrating data. Option A is not correct because cross-workspace queries in workbooks only provide unified reporting/visualization, not a unified incident queue. Option D is not correct because Azure Policy enforces configuration compliance and does not aggregate or unify incidents. Option E is not correct because playbooks are automation workflows triggered on incidents; deploying multiple playbooks does not create a single unified incident queue.

Answer

Use cross-workspace queries in workbooks.

Answer

Use Azure Policy to enforce workspace configuration.

Answer

Deploy multiple playbooks to synchronize incidents.

Question 6

Your SOC team uses Microsoft Sentinel and Microsoft Defender XDR. A junior analyst creates a custom analytics rule in Sentinel that generates an excessive number of incidents. The rule appears to be running but not producing any results. What is the most likely cause?

Accepted Answer

The rule's query syntax is invalid.. The most likely cause is an invalid query syntax (Option C). When a custom analytics rule in Microsoft Sentinel has a KQL syntax error, the rule will appear as 'running' in the UI but will fail to execute properly, producing zero results and therefore no incidents. The mention of 'excessive number of incidents' in the scenario is a misdirection; the analyst may have observed high incident volumes from other rules, but this particular rule is not functioning due to the syntax error. Thus, the rule is not creating any incidents despite appearing active.

Answer

The analyst does not have permissions to create incidents.

Answer

The rule is set to a low severity.

Answer

The rule is disabled.

Question 7

Your organization uses Microsoft Sentinel. You need to ensure that only users with the appropriate permissions can run playbooks from within the incident investigation interface. What role should you assign to the security operations team?

Accepted Answer

Microsoft Sentinel Contributor. The Microsoft Sentinel Contributor role includes the ability to create and edit playbooks, as well as run them from the incident investigation interface. This role grants the necessary permissions to manage automation rules and execute playbooks, which is required for the security operations team to respond to incidents effectively.

Answer

Microsoft Sentinel Reader

Answer

Microsoft Sentinel Responder

Answer

Global Administrator in Microsoft Entra ID

Question 8

You are reviewing a KQL query used in a Microsoft Sentinel analytics rule. The query is intended to alert when there are more than 5 alerts of the same name for the same entity type within the last hour. However, the rule is not triggering as expected. What is the most likely issue?

Accepted Answer

The parsing of Entities array may fail if the first entity does not have a 'Type' field.. The most likely issue is that the KQL query parses the 'Entities' array, which is a dynamic JSON field in Microsoft Sentinel alerts. If the first entity in the array does not have a 'Type' field, the parsing logic (e.g., using 'mv-expand' or accessing array indices) will fail or return null, causing the query to produce no results. This prevents the rule from triggering even when conditions are otherwise met.

Answer

The 'summarize' operator does not support 'AlertCount' as a column name.

Answer

The query uses 'tostring' incorrectly.

Answer

The 'where TimeGenerated > ago(1h)' is outside the allowed range.

Question 9

Which THREE of the following are valid ways to ingest logs into Microsoft Sentinel?

Accepted Answer

Syslog. Option A (Syslog) is correct because Microsoft Sentinel ingests Syslog data through the Log Analytics agent (MMA/AMA) or via the Syslog/CEF connector on a Linux forwarder, which is a documented data-ingestion method. Option C (AWS CloudTrail) is correct because Sentinel provides a built-in AWS CloudTrail connector that pulls CloudTrail management events from an S3 bucket into the workspace via the Amazon Web Services S3 data connector. Option D (Azure Activity Log) is correct because the Azure Activity Log connector streams subscription-level control-plane events directly into Microsoft Sentinel. Option B (Windows Event Logs) is not a standalone ingestion method in this context—Windows Security Events are collected via the Windows Security Events via AMA or the legacy Security Events connector, not a generic 'Windows Event Logs' connector. Option E (Custom logs via direct API) is not a valid Sentinel ingestion path; custom logs are ingested using the Logs Ingestion API (DCR-based) or the HTTP Data Collector API, not a generic 'direct API' option.

Answer

Windows Event Logs

Answer

Custom logs via direct API

Question 10

You are the security operations analyst for a large enterprise that uses Microsoft Sentinel and Microsoft Defender XDR. The environment includes:

- 10,000 Windows 11 devices managed by Microsoft Intune
- 5,000 macOS devices managed by Jamf Pro
- 2,000 Linux servers running Ubuntu 22.04
- Microsoft 365 E5 licenses for all users
- Microsoft Sentinel in the East US region
- Microsoft Defender for Cloud Apps enabled
- Microsoft Defender for Identity deployed
- Microsoft Defender for Office 365 configured

You need to design a solution to meet the following requirements:

1. Ingest security events from all devices (Windows, macOS, Linux) into Microsoft Sentinel.
2. Ensure that all alerts from Microsoft Defender XDR components (including Defender for Endpoint, Defender for Identity, Defender for Office 365, and Defender for Cloud Apps) are automatically correlated into incidents in Microsoft Sentinel.
3. Minimize latency between alert generation in Defender XDR and incident creation in Sentinel.
4. Use the least amount of administrative overhead.

What should you implement?

Accepted Answer

Enable the Microsoft Defender XDR connector for incident correlation. For Windows devices, use the Windows Security Events via AMA connector. For Linux and macOS, use the Syslog via AMA connector.. The Microsoft Defender XDR connector streams incidents from all Defender products into Sentinel with low latency and minimal overhead, meeting requirement 2 and 3. For device logs (requirement 1), the Windows Security Events via AMA connector ingests Windows events, and Syslog via AMA ingests Linux and macOS logs (since Jamf Pro can forward logs via Syslog). Option B is correct because it uses the native AMA connectors, which are the current standard and not deprecated. Option A uses the Log Analytics agent, which is deprecated and not recommended. Option C uses a Logic App, which adds latency and administrative overhead. Option D using direct Graph API ingestion is complex and not scalable.

Answer

Enable the Microsoft Defender XDR connector for incident correlation. Deploy the Log Analytics agent on all devices to collect events.

Answer

Use a Logic App to fetch incidents from Microsoft Defender XDR and create incidents in Sentinel. Install the Azure Monitor Agent on all devices.

Answer

Enable the Microsoft Defender XDR connector and use the Microsoft Graph API to ingest logs from all devices directly into Sentinel.

Question 11

Your organization uses Microsoft Sentinel. You need to ensure that an Azure function app can send custom logs to a Log Analytics workspace. What should you configure?

Accepted Answer

Data collection rule (DCR) with Azure Monitor Agent. To send custom logs from an Azure function app to a Log Analytics workspace, you need a Data Collection Rule (DCR) configured with the Azure Monitor Agent (AMA). The DCR defines how the custom log data is ingested, transformed, and routed to the workspace, while the AMA collects the logs from the function app. This is the standard method for custom log ingestion in Microsoft Sentinel, as it supports the Log Analytics Ingestion API and allows for schema customization.

Answer

Threat intelligence data connector

Answer

Diagnostic settings on the function app

Answer

Microsoft Sentinel automation rule

Question 12

Your organization uses Microsoft Sentinel with multiple watchlists. You need to create a KQL query that joins log data with a watchlist to enrich alerts. Which KQL operator should you use?

Accepted Answer

_GetWatchlist. The `_GetWatchlist` function is specifically designed to retrieve a watchlist by name in Microsoft Sentinel KQL queries, enabling enrichment of log data with the watchlist's fields. Unlike `lookup` or `join`, it directly accesses the watchlist artifact without requiring explicit key matching, making it the correct operator for this enrichment scenario.

Answer

lookup

Answer

union

Answer

join

Question 13

Refer to the exhibit. You run a PowerShell command to retrieve incidents from Microsoft Sentinel. How many active incidents are there?

Accepted Answer

3. The exhibit lists 4 incidents: 1001 (Active), 1002 (Closed), 1003 (Active), 1004 (New). In Microsoft Sentinel, both 'New' and 'Active' are non-closed, open incident states — only 'Closed' incidents are excluded from active monitoring. So the count of active (open) incidents is 3: 1001, 1003, and 1004. Duplicate/near-duplicate answer options ('2' appearing twice) should also be corrected to remove the redundant choice.

Answer

2

Answer

2

Answer

1

Question 14

Your organization uses Microsoft Sentinel. You need to ensure that only specific IP addresses from your corporate network can access the Sentinel workspace via the Azure portal. What should you configure?

Accepted Answer

Enable Azure Private Link for the workspace.. To restrict access to a Microsoft Sentinel workspace to specific IP addresses, you must control access to the Log Analytics workspace backend endpoint. Azure Private Link creates a private endpoint in a virtual network, allowing only traffic from that network (or specific subnets with NSGs) to reach the workspace. This effectively restricts IP-based access. Conditional Access policies control user access to the Azure portal but do not directly restrict network access to the workspace endpoint. NSGs on the subnet hosting the Log Analytics workspace are ineffective because the workspace is a PaaS service and not a resource within that subnet. Azure Firewall controls outbound traffic and does not restrict inbound access to the workspace.

Answer

Configure network security groups (NSGs) on the subnet hosting the Log Analytics workspace.

Answer

Configure a conditional access policy in Microsoft Entra ID.

Answer

Use Azure Firewall to restrict outbound traffic from the workspace.

Question 15

Refer to the exhibit. You are using this KQL query in a Microsoft Sentinel scheduled analytics rule to detect brute-force attacks. The rule has been running for a week but has never triggered an alert. What is the most likely reason?

Accepted Answer

The SecurityEvent table is not being populated because Windows event collection is not configured.. The most likely reason the scheduled analytics rule never triggered is that the SecurityEvent table is not being populated because Windows event collection is not configured. Without data in the table, the query returns no results, and no alerts are generated.

Answer

The query uses a 24-hour lookback and the rule runs every 5 minutes, so it misses data.

Answer

The query syntax is incorrect.

Answer

The query uses 'summarize' which is not allowed in analytics rules.