SC-200 Manage a security operations environment Practice Test 5 — 15 Questions

Question 1

Your organization has Microsoft Defender for Cloud Apps enabled. You need to generate an alert when a user downloads more than 100 files from SharePoint in one hour. What should you create?

Accepted Answer

An anomaly detection policy in Microsoft Defender for Cloud Apps.. An anomaly detection policy in Microsoft Defender for Cloud Apps is designed to detect unusual user behavior, such as mass file downloads, by establishing a baseline and triggering alerts when activity deviates from the norm. This policy type specifically supports the scenario of detecting a user downloading more than 100 files from SharePoint in one hour, as it can be configured with custom thresholds for file download activity.

Answer

A data loss prevention (DLP) policy in Microsoft Purview.

Answer

A custom alert in Microsoft Sentinel using the CloudAppEvents table.

Answer

An app governance policy in Microsoft Defender for Cloud Apps.

Question 2

Your incident response team uses Microsoft Sentinel. You need to automatically assign incidents to the appropriate analyst based on the incident category. What should you configure?

Accepted Answer

Create an automation rule that runs a playbook to assign the incident.. Automation rules in Microsoft Sentinel can trigger a playbook when an incident is created or updated. By configuring an automation rule with a condition based on the incident category, you can invoke a playbook that uses the Microsoft Sentinel API or Logic Apps to set the incident's owner field, thereby assigning it to the appropriate analyst. This is the correct approach because automation rules are designed to run automated responses, including playbooks, on incidents.

Answer

Create an analytics rule that sets the owner field.

Answer

Create a custom incident label for each category.

Answer

Create a workbook that filters incidents by category.

Question 3

Your SOC uses Microsoft Sentinel and Microsoft Defender XDR. You need to ensure that all incidents from Defender XDR are automatically synchronized to Sentinel. You have enabled the Defender XDR connector. However, some incidents are not appearing. What should you check first?

Accepted Answer

Check the connector's data filter settings for severity or status.. The Defender XDR connector in Microsoft Sentinel allows filtering of incidents based on severity and status during configuration. If incidents are not appearing, the most common cause is that the connector's data filter settings are excluding them—for example, filtering out 'Informational' severity or 'Resolved' status incidents. This is the first thing to check because the connector is enabled and working, but the filter is preventing synchronization of certain incidents.

Answer

Confirm that the incident is displayed in a Sentinel workbook.

Answer

Ensure that alert grouping is enabled in Sentinel.

Answer

Verify that the Microsoft Defender XDR license is active.

Question 4

Your organization uses Microsoft Purview Data Loss Prevention (DLP). You need to receive an alert when a user attempts to share a credit card number via email. What should you configure?

Accepted Answer

Create a DLP policy in Microsoft Purview with the credit card number sensitive info type.. Option B is correct because Microsoft Purview DLP policies can be configured to detect sensitive information types, such as credit card numbers, and trigger alerts when users attempt to share that data via email. By creating a DLP policy with the credit card number sensitive info type and setting an action to send an alert, you meet the requirement to receive an alert on such sharing attempts.

Answer

Create a sensitivity label that blocks sharing.

Answer

Create a retention label that identifies credit card data.

Answer

Create a file policy in Microsoft Defender for Cloud Apps.

Question 5

Your SOC is investigating an incident in Microsoft Sentinel. You need to quickly identify all related alerts and entities across the timeline. What Microsoft Sentinel feature should you use?

Accepted Answer

Open the incident investigation graph.. The incident investigation graph in Microsoft Sentinel provides a visual, interactive map of all alerts, entities (such as users, IP addresses, hosts), and their relationships linked to a specific incident. This allows SOC analysts to quickly see the full scope of an incident across the timeline without manually correlating data, making it the correct tool for this scenario.

Answer

Run a hunting query.

Answer

Review the analytics rule that generated the incident.

Answer

Use the Incident workbook.

Question 6

Your organization has Microsoft Sentinel with UEBA enabled. An incident is generated for a user with high risk score. You need to identify if the user's recent behavior deviates from their baseline. Which Sentinel feature should you use?

Accepted Answer

The UEBA timeline in the entity page.. The UEBA timeline in the entity page is the correct feature because it provides a chronological view of a user's activities, including deviations from their established behavioral baseline. When UEBA is enabled, Sentinel profiles normal behavior for each user and flags anomalies; the timeline directly visualizes these deviations, such as unusual login times, locations, or resource access, which aligns with the need to identify if recent behavior deviates from the baseline.

Answer

A custom hunting query using the BehaviorAnalytics table.

Answer

The user's Azure AD sign-in logs.

Answer

The incident investigation graph.

Question 7

Which TWO actions should you take to optimize cost in Microsoft Sentinel while maintaining security coverage? (Choose two.)

Accepted Answer

Adjust the interactive retention period for tables that don't need long-term interactive access.. Option C is correct because reducing interactive retention for tables that do not require long-term, fast query access directly lowers storage costs. Microsoft Sentinel charges per GB for data stored in the interactive retention tier, while data moved to long-term retention (up to 12 years) is significantly cheaper. By tailoring retention periods to actual operational needs, you avoid paying premium rates for data that is rarely queried interactively.

Answer

Enable continuous export for all tables.

Answer

Purchase a Pay-as-you-go commitment tier.

Answer

Add more tables to ingest data.

Question 8

Which THREE components are required to automate incident response in Microsoft Sentinel using playbooks? (Choose three.)

Accepted Answer

An automation rule in Sentinel.. Option A is correct because playbooks are based on Azure Logic Apps. Option B is correct because automation rules trigger playbooks. Option C is correct because a trigger is required for the logic app. Option D is wrong because analytics rules create incidents, not playbooks. Option E is wrong because workbooks are visualization, not automation.

Answer

A workbook.

Answer

An analytics rule.

Question 9

Which TWO data connectors can be used to ingest Microsoft 365 audit logs into Microsoft Sentinel? (Choose two.)

Accepted Answer

Microsoft 365 Defender connector.. The Microsoft 365 Defender connector (Option B) ingests unified audit logs from Microsoft 365 Defender, which includes security-related events from Microsoft 365 services. The Office 365 connector (Option C) directly ingests audit logs from Exchange Online, SharePoint Online, and Microsoft Teams, which are part of the Microsoft 365 audit log. Both connectors are designed to bring Microsoft 365 audit log data into Microsoft Sentinel.

Answer

Microsoft Defender for Cloud Apps connector.

Answer

Azure Activity connector.

Answer

Azure AD connector (sign-in logs).

Question 10

Refer to the exhibit. You are creating a scheduled analytics rule in Microsoft Sentinel using the ARM template snippet. The rule runs every 5 minutes and queries the last 5 minutes of data. The rule is not generating alerts even though malware detections are occurring. What is the most likely issue?

Accepted Answer

The table DeviceEvents is not ingested into the Log Analytics workspace.. Option B is correct because the query uses DeviceEvents, which is a table in Microsoft Defender for Endpoint but not in Sentinel by default unless the connector is configured and data is mapped to that table. Option A is wrong because the query period and frequency are consistent. Option C is wrong because the threshold is 0, so any result should trigger. Option D is wrong because the ARM template is valid.

Answer

The queryPeriod and queryFrequency are the same, causing overlapping windows.

Answer

The triggerThreshold is set to 0, which should always trigger.

Answer

The ARM template is missing the required 'kind' property.

Question 11

Refer to the exhibit. You are troubleshooting an endpoint that is not receiving real-time protection from Microsoft Defender Antivirus. The output shows RealTimeProtectionEnabled is False. Which command should you run next to enable real-time protection?

Accepted Answer

Set-MpPreference -DisableRealtimeMonitoring $false. The Set-MpPreference cmdlet with the -DisableRealtimeMonitoring $false parameter is the correct command to enable real-time protection in Microsoft Defender Antivirus. The output shows RealTimeProtectionEnabled is False, which directly corresponds to the DisableRealtimeMonitoring setting; setting it to $false re-enables the feature. This cmdlet modifies the local policy for the Microsoft Defender Antivirus engine, immediately activating real-time scanning of file operations and process activity.

Answer

Add-MpPreference -ExclusionPath C:\Temp

Answer

Start-MpScan

Answer

Update-MpSignature

Question 12

Refer to the exhibit. Your SOC manager runs this KQL query in Microsoft Sentinel to see which analysts have the most active high-severity incidents in the past 7 days. The query returns no results. What is the most likely reason?

Accepted Answer

The SecurityIncident table is not available in the Logs workspace; it is only accessible through the Sentinel incidents blade.. Option D is correct because the SecurityIncident table is not available in the standard Log Analytics workspace; it is a Sentinel-specific table that is only accessible through the Microsoft Sentinel incidents blade or via the SecurityIncident table in the Sentinel Logs workspace when Sentinel is enabled. The query fails because the table does not exist in the workspace's schema, not because of syntax or data absence.

Answer

The query has a syntax error.

Answer

The table name is misspelled.

Answer

No high-severity incidents were created in the last 7 days.

Question 13

Your organization uses Microsoft Sentinel and Microsoft Defender for Cloud. You need to ensure that all cloud security alerts are automatically ingested into Sentinel. What should you configure?

Accepted Answer

Configure the Microsoft Defender for Cloud data connector (Legacy).. The Microsoft Defender for Cloud data connector (Legacy) is the correct choice because it specifically ingests security alerts from Microsoft Defender for Cloud into Microsoft Sentinel. This connector ensures that all alerts generated by Defender for Cloud's security policies and threat detection are automatically streamed into Sentinel for centralized monitoring and incident response.

Answer

Configure the Microsoft 365 Defender data connector.

Answer

Configure the Azure Activity data connector.

Answer

Create a custom log table and a PowerShell script to push alerts.

Question 14

Your security team uses Microsoft Sentinel UEBA to detect anomalous user behavior. You need to configure UEBA to baseline user activities and generate alerts for deviations. What must you do first?

Accepted Answer

Enable UEBA in the Sentinel Settings blade and select relevant data sources.. Option B is correct because Microsoft Sentinel UEBA requires explicit enablement in the Sentinel Settings blade under the 'Entity behavior analytics' section. Once enabled, you must select the relevant data sources (e.g., Azure Active Directory sign-in logs, Office 365 audit logs, Windows Security Events) so that Sentinel can baseline normal user behavior patterns and generate alerts for anomalous deviations. Without this initial configuration, UEBA cannot process any data or produce behavioral analytics.

Answer

Create an Azure Machine Learning workspace for anomaly detection.

Answer

Assign Microsoft 365 E5 licenses to all users.

Answer

Deploy a custom data connector for HR systems.

Question 15

Your company uses Microsoft Defender for Office 365. You want to automatically take action on malicious emails that bypass the filter. What should you configure?

Accepted Answer

Configure automated investigation and response (AIR) policies.. Automated investigation and response (AIR) policies in Microsoft Defender for Office 365 are specifically designed to automatically take action on malicious emails that bypass initial filters. AIR uses playbooks to investigate threats and automatically remediate, such as deleting or moving emails, without manual intervention. This directly addresses the requirement to automatically act on bypassed malicious emails.

Answer

Enable anti-phishing policy.

Answer

Enable Safe Attachments policy.

Answer

Create a transport rule in Exchange.