SC-200 Manage a security operations environment Practice Test 4 — 15 Questions

Question 1

Your security operations center uses Microsoft Sentinel and Microsoft Defender XDR. A new type of attack involves a user receiving a malicious email that triggers a macro, which then executes PowerShell to download a payload. You need to create a detection that correlates email, process creation, and network connection events from multiple Microsoft 365 Defender sources. What should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Advanced hunting in Microsoft 365 Defender. Advanced hunting in Microsoft 365 Defender is the correct choice because it allows you to write Kusto Query Language (KQL) queries that can join data across multiple tables from different Microsoft 365 Defender sources, such as EmailEvents, DeviceProcessEvents, and DeviceNetworkEvents. This enables correlation of the email receipt, macro-triggered PowerShell process creation, and subsequent network connection to a malicious IP or domain in a single query, which is exactly what the scenario requires.

Answer

Scheduled query rule in Microsoft Sentinel

Answer

Custom detection rule in Microsoft 365 Defender

Answer

Fusion rule in Microsoft Sentinel

Question 2

Which TWO actions should you take to improve the performance of Microsoft Sentinel analytics rules that are running slowly? (Choose two.)

Accepted Answer

Reduce the query time window. Reducing the query time window (Option B) directly limits the volume of data the analytics rule must process per execution, which reduces query latency and overall rule execution time. This is a common performance optimization because Sentinel analytics rules run KQL queries against the Log Analytics workspace, and smaller time ranges mean fewer log records to scan.

Answer

Assign a higher severity to the rule

Answer

Increase the rule run frequency

Answer

Add additional entity mapping

Question 3

Which THREE components are required to enable automation in Microsoft Sentinel? (Choose three.)

Accepted Answer

Playbooks based on Azure Logic Apps. Playbooks based on Azure Logic Apps are required because they provide the workflow automation engine that executes response actions in Microsoft Sentinel. Without a Logic Apps resource to define the steps (e.g., triggers, conditions, and actions), there is no executable automation to run when an incident or alert is generated.

Answer

Microsoft Power Automate license

Answer

Microsoft Entra ID P2 license

Question 4

Which TWO data sources are natively supported by Microsoft Sentinel for ingesting security events? (Choose two.)

Accepted Answer

Windows Security Events. Windows Security Events are natively supported by Microsoft Sentinel via the Windows Security Events via AMA connector or the legacy Log Analytics agent. This connector ingests security event logs (e.g., Event ID 4625 for failed logons) directly into Sentinel without requiring a third-party parser or custom data connector. Azure Activity Logs are also natively supported through the Azure Activity connector, which streams subscription-level operational events (e.g., resource creation, policy changes) into Sentinel at no additional cost.

Answer

Salesforce audit logs

Answer

GitHub audit logs

Answer

Google Cloud Platform (GCP) logs

Question 5

Refer to the exhibit. You are reviewing a Microsoft Sentinel scheduled analytics rule defined in ARM template format. The rule is enabled but no incidents are being created even though matching sign-in events exist. What is the most likely reason?

Accepted Answer

The rule does not have entity mapping configured. The most likely reason no incidents are being created despite matching sign-in events is that the rule lacks entity mapping. In Microsoft Sentinel, while entity mapping is optional for some rule types, it is required for scheduled analytics rules to generate incidents from query results. Without entity mapping, the rule may run successfully and find results but will not create an incident because Sentinel cannot associate the results with a recognized entity (e.g., Account, IP, Host). This is a common misconfiguration when importing rules via ARM templates.

Answer

The query uses a dynamic list incorrectly

Answer

The suppressionDuration is incorrectly configured

Answer

The queryFrequency is set too high, causing missed events

Question 6

Refer to the exhibit. You have a Microsoft Sentinel analytic rule configured to detect brute force attacks. The rule runs every 30 minutes and groups alerts into incidents based on Account and IP. You notice that multiple incidents are created for the same user and IP within a short time. What should you do to reduce the number of incidents?

Accepted Answer

Increase the lookback duration to 2 hours. Increasing the lookback duration to 2 hours allows the analytic rule to consider a longer window of historical data when grouping alerts into incidents. This means that alerts for the same Account and IP that occur within that extended timeframe will be merged into a single incident, directly reducing the number of duplicate incidents created for the same user and IP.

Answer

Decrease the query frequency to 1 hour

Answer

Increase the trigger threshold to 10

Answer

Disable alert grouping

Question 7

Your organization uses Microsoft Sentinel with a Log Analytics workspace in the East US region. You need to ensure that incident investigation data is retained for two years for compliance. What should you configure?

Accepted Answer

Adjust the Interactive retention period to 730 days in the Log Analytics workspace.. Log Analytics workspaces allow you to configure the Interactive retention period independently from the Total retention period. Setting Interactive retention to 730 days ensures that incident investigation data remains available for interactive queries for the full two-year compliance requirement, without needing to enable archive or change log types.

Answer

Configure a data retention policy in Microsoft Purview.

Answer

Set the Total retention period to 730 days and enable Archive.

Answer

Enable Basic Logs and set retention to 730 days.

Question 8

Your security team uses Microsoft Defender XDR to investigate incidents. You have a custom detection rule that runs a KQL query every hour. Recently, the rule stopped generating alerts. You verify that the query syntax is correct and that data is being ingested. What is the most likely cause?

Accepted Answer

The alert suppression threshold is configured too high.. The custom detection rule uses an alert suppression threshold, which prevents alerts from being generated unless the query results exceed a specified count. If this threshold is set too high, the rule may stop generating alerts even though the query returns valid results, because the number of matching events no longer meets the suppression limit. This is the most likely cause given that the query syntax is correct and data is being ingested.

Answer

The Microsoft Defender XDR license has expired.

Answer

An automation rule is deleting the alerts.

Answer

The query is not returning any results.

Question 9

Your company deploys Microsoft Sentinel in a multi-workspace environment. You need to centralize incident management across workspaces while maintaining data residency. You configure Sentinel workspaces in each region. What additional configuration is required to view all incidents from a single pane?

Accepted Answer

Use an incident manager with a cross-workspace view.. Microsoft Sentinel supports cross-workspace incident management through the incident manager, which can be configured to display incidents from multiple workspaces in a single view. This is achieved by using the 'cross-workspace view' feature, which leverages Azure Resource Graph to query incidents across workspaces without moving data, thus maintaining data residency requirements.

Answer

Deploy the Microsoft Sentinel solution across workspaces.

Answer

Assign the same Azure RBAC roles to all users in each workspace.

Answer

Merge the workspaces into a single workspace.

Question 10

Your organization has Microsoft Defender for Cloud Apps enabled. You need to generate an alert when a user downloads more than 100 files from SharePoint in one hour. What should you create?

Accepted Answer

An anomaly detection policy in Microsoft Defender for Cloud Apps.. An anomaly detection policy in Microsoft Defender for Cloud Apps is designed to detect unusual user behavior, such as mass file downloads, by establishing a baseline and triggering alerts when activity deviates from the norm. This policy type specifically supports the scenario of detecting a user downloading more than 100 files from SharePoint in one hour, as it can be configured with custom thresholds for file download activity.

Answer

A data loss prevention (DLP) policy in Microsoft Purview.

Answer

A custom alert in Microsoft Sentinel using the CloudAppEvents table.

Answer

An app governance policy in Microsoft Defender for Cloud Apps.

Question 11

Your incident response team uses Microsoft Sentinel. You need to automatically assign incidents to the appropriate analyst based on the incident category. What should you configure?

Accepted Answer

Create an automation rule that runs a playbook to assign the incident.. Automation rules in Microsoft Sentinel can trigger a playbook when an incident is created or updated. By configuring an automation rule with a condition based on the incident category, you can invoke a playbook that uses the Microsoft Sentinel API or Logic Apps to set the incident's owner field, thereby assigning it to the appropriate analyst. This is the correct approach because automation rules are designed to run automated responses, including playbooks, on incidents.

Answer

Create an analytics rule that sets the owner field.

Answer

Create a custom incident label for each category.

Answer

Create a workbook that filters incidents by category.

Question 12

Your SOC uses Microsoft Sentinel and Microsoft Defender XDR. You need to ensure that all incidents from Defender XDR are automatically synchronized to Sentinel. You have enabled the Defender XDR connector. However, some incidents are not appearing. What should you check first?

Accepted Answer

Check the connector's data filter settings for severity or status.. The Defender XDR connector in Microsoft Sentinel allows filtering of incidents based on severity and status during configuration. If incidents are not appearing, the most common cause is that the connector's data filter settings are excluding them—for example, filtering out 'Informational' severity or 'Resolved' status incidents. This is the first thing to check because the connector is enabled and working, but the filter is preventing synchronization of certain incidents.

Answer

Confirm that the incident is displayed in a Sentinel workbook.

Answer

Ensure that alert grouping is enabled in Sentinel.

Answer

Verify that the Microsoft Defender XDR license is active.

Question 13

Your organization uses Microsoft Purview Data Loss Prevention (DLP). You need to receive an alert when a user attempts to share a credit card number via email. What should you configure?

Accepted Answer

Create a DLP policy in Microsoft Purview with the credit card number sensitive info type.. Microsoft Purview DLP policies can be configured to detect sensitive information types, such as credit card numbers, and trigger alerts when users attempt to share that data via email. By creating a DLP policy with the credit card number sensitive info type and setting an action to send an alert, you meet the requirement to receive an alert on such sharing attempts.

Answer

Create a sensitivity label that blocks sharing.

Answer

Create a retention label that identifies credit card data.

Answer

Create a file policy in Microsoft Defender for Cloud Apps.

Question 14

Your organization has Microsoft Sentinel with UEBA enabled. An incident is generated for a user with high risk score. You need to identify if the user's recent behavior deviates from their baseline. Which Sentinel feature should you use?

Accepted Answer

The UEBA timeline in the entity page.. The UEBA timeline in the entity page is the correct feature because it provides a chronological view of a user's activities, including deviations from their established behavioral baseline. When UEBA is enabled, Sentinel profiles normal behavior for each user and flags anomalies; the timeline directly visualizes these deviations, such as unusual login times, locations, or resource access, which aligns with the need to identify if recent behavior deviates from the baseline.

Answer

A custom hunting query using the BehaviorAnalytics table.

Answer

The user's Azure AD sign-in logs.

Answer

The incident investigation graph.

Question 15

Which TWO actions should you take to optimize cost in Microsoft Sentinel while maintaining security coverage? (Choose two.)

Accepted Answer

Adjust the interactive retention period for tables that don't need long-term interactive access.. Reducing interactive retention for tables that do not require long-term, fast query access directly lowers storage costs. Microsoft Sentinel charges per GB for data stored in the interactive retention tier, while data moved to long-term retention (up to 12 years) is significantly cheaper. By tailoring retention periods to actual operational needs, you avoid paying premium rates for data that is rarely queried interactively.

Answer

Enable continuous export for all tables.

Answer

Purchase a Pay-as-you-go commitment tier.

Answer

Add more tables to ingest data.