SC-200 Manage a security operations environment Practice Test 5 — 15 Questions

Question 1

Your SOC team uses Microsoft Sentinel. You receive a high volume of false positive incidents from a specific analytics rule. The rule uses a scheduled query that runs every 5 minutes. What is the most efficient way to reduce false positives without disabling the rule?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Modify the rule to use entity mapping and alert grouping. Entity mapping and alert grouping in a scheduled analytics rule let Sentinel correlate related alerts into a single incident and group by entities (accounts, hosts, IPs), which dramatically reduces duplicate/false-positive incident volume without disabling the rule. This is the most efficient, non-disruptive way to cut noise while preserving detection coverage.

Answer

Increase the query run frequency to every hour

Answer

Disable the rule and create a new one with a different query

Answer

Use a suppression rule to close incidents automatically for 24 hours

Question 2

You are configuring Microsoft Sentinel to use automation rules for incident response. You need to ensure that when an incident is created with a severity of High, a playbook is triggered to isolate the affected device. However, the playbook should not run if the incident is created by a specific analytics rule (RuleID: '12345'). What is the best way to implement this?

Accepted Answer

Create two automation rules: one for High severity from rule '12345' with no action, and one for High severity with condition 'Analytics rule name not equals 12345' that triggers the playbook. This approach uses two automation rules with different conditions and order of evaluation. The first rule handles incidents from rule ID '12345' with High severity but takes no action, effectively excluding them from further processing. The second rule applies to all other High severity incidents (where analytics rule name is not '12345') and triggers the playbook to isolate the device. Automation rules are evaluated in order, and the first matching rule's actions are executed, so incidents from rule '12345' will be caught by the first rule and will not trigger the playbook. Option A is incorrect because although a playbook could check the rule ID, the requirement is to prevent the playbook from running at all for those incidents; using a playbook to filter after triggering adds unnecessary complexity and latency. Option C is incorrect because automation rules cannot directly filter on analytics rule ID; they can filter on analytics rule name, but even then, a single condition group cannot combine 'High severity' and 'rule name not equals 12345' effectively because the condition logic is AND within a group, but you would need to exclude a specific rule which is not straightforward. Option D is incorrect because using OR would trigger the playbook for all High severity incidents as well as all incidents not from rule '12345', which is not the desired outcome.

Answer

Create an automation rule for all High severity incidents, then use a playbook to check the rule ID and skip if needed

Answer

Create one automation rule with condition: Severity equals High and Analytics rule ID not equals '12345'

Answer

Create one automation rule with conditions: Severity equals High OR Analytics rule name not equals '12345'

Question 3

Your organization uses Microsoft Sentinel and has a large number of incidents daily. You need to automatically assign incidents to the correct SOC tier based on severity: Low severity to Tier 1, Medium to Tier 2, High and Critical to Tier 3. Which approach should you use?

Accepted Answer

Create three separate automation rules, each with a condition on severity and a playbook that assigns to the appropriate group. Create three separate automation rules: one with condition 'Severity equals Low' that assigns to Tier 1, one with condition 'Severity equals Medium' that assigns to Tier 2, and one with condition 'Severity is High or Critical' (using the multi-select severity condition) that assigns to Tier 3. Automation rule conditions on a single property support selecting multiple values, so High and Critical can be combined in one rule's condition without needing a fourth rule, while each rule remains independently scoped and evaluated in order.

Answer

Configure custom details in the analytics rule to include severity, then use a playbook to assign

Answer

Create one automation rule with multiple conditions and trigger a playbook that uses a switch statement on severity

Answer

Use incident grouping to combine incidents by severity and assign the group

Question 4

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You need to ensure that all incidents generated by Microsoft Defender for Cloud are automatically assigned to the security operations team. What should you configure in Microsoft Sentinel?

Accepted Answer

Create an automation rule that runs when an incident is created with provider: 'Microsoft Defender for Cloud' and sets the owner to a specific group.. Automation rules in Microsoft Sentinel can be configured to run when an incident is created, with a condition such as provider being 'Microsoft Defender for Cloud', and then set the owner to a specific group (e.g., the security operations team). This automates the assignment directly within Sentinel. Option A only sends a notification but does not assign ownership. Option B describes a setting in Microsoft Defender for Cloud, not Sentinel, and is not the proper method for automatic assignment in Sentinel. Option D is incorrect because analytics rules generate alerts, not incidents, and do not have a setting to assign incident owners.

Answer

Create a playbook that uses the Microsoft Teams connector to send a message to the security team.

Answer

Use the incident creation rule in Microsoft Defender for Cloud to assign incidents.

Answer

Configure analytics rules to set the incident owner in the rule settings.

Question 5

Your Microsoft Sentinel workspace ingests logs from multiple regions. You need to reduce data ingestion costs while ensuring that all security events are retained for at least one year for compliance. Which two actions should you take? (Choose two.)

Accepted Answer

Configure the table's plan to 'Analytics' for security events and set a retention policy of 90 days, then create an archive policy for up to 1 year.. Options A and B are correct. Option A reduces costs by archiving less frequently accessed data. Option B enables long-term retention beyond the default. Option C is incorrect because configuring the diagnostic setting to send security logs to a separate low-cost storage account does not reduce Sentinel ingestion costs and may limit queryability. Option D is incorrect because Basic Logs are not suitable for security events that require full analytics capabilities.

Answer

Set the retention policy on the SecurityEvent table to 365 days.

Answer

Configure the diagnostic setting to send security logs to a separate low-cost storage account.

Answer

Use Basic Logs for the SecurityEvent table to reduce costs.

Question 6

Refer to the exhibit. You are deploying this ARM template to create a saved search in Microsoft Sentinel. What is the purpose of this saved search?

Accepted Answer

Identify computers that are generating a high number of heartbeats, which may indicate a potential compromise.. The saved search uses the Heartbeat table and aggregates by Computer, filtering for computers with >100 heartbeats in the last 24 hours. Since a normal computer sends approximately 288 heartbeats per day (one every 5 minutes), the threshold of >100 includes almost all active computers and does not specifically identify a high number of heartbeats. The query would actually exclude computers with no or very few heartbeats, but it does not identify computers with no heartbeats in the last 24 hours; it identifies those with at least 101 heartbeats. The purpose described in option A ('Identify computers that have not sent heartbeats in the last 24 hours') is the opposite of what the query does, making it incorrect. Option C is also incorrect because >100 is not a high count; it is lower than normal. The correct interpretation is that the query is poorly designed and does not fulfill any of the listed purposes accurately. However, considering the options, option A is the closest if we mistakenly misread the greater-than sign as a less-than, which is a common error. Therefore, the intended correct answer is A, but with the understanding that the query actually does the opposite.

Answer

Identify computers that have not sent heartbeats in the last 24 hours.

Answer

Identify computers with low disk space.

Answer

Identify computers that have communicated with a malicious IP address.

Question 7

Your organization uses Microsoft Defender XDR. You need to ensure that incidents are automatically classified as 'True positive' when a specific indicator of compromise (IOC) is detected. What should you configure?

Accepted Answer

Create a custom detection rule in Microsoft 365 Defender that sets the classification to 'True positive' when the IOC is detected.. Custom detection rules in Microsoft 365 Defender allow you to define advanced hunting queries that, when triggered by a specific indicator of compromise (IOC), can automatically set the incident classification to 'True positive'. This is the only built-in mechanism that directly modifies the classification of an incident based on detection logic, rather than just suppressing or alerting on the IOC.

Answer

Configure a suppression rule in Microsoft Defender XDR.

Answer

Create a transport rule in Exchange Online.

Answer

Add the IOC to the Microsoft Defender for Endpoint indicator list.

Question 8

Your organization uses Microsoft Sentinel with a workspace in the East US region. You need to ingest security logs from Azure resources in the West Europe region. The solution must minimize data transfer costs. What should you configure?

Accepted Answer

Configure diagnostic settings on the West Europe resources to send logs to a Log Analytics workspace in West Europe, and then use a cross-workspace query from the East US workspace.. It minimizes data transfer costs by keeping logs within the same Azure region (West Europe) for ingestion into a local Log Analytics workspace, and then using cross-workspace queries from the East US workspace to access the data. This avoids egress charges that would apply if logs were sent directly across regions, as Azure data transfer between regions incurs costs. Diagnostic settings can only send logs to a workspace in the same region as the resource, so sending directly to East US is not possible without additional egress costs.

Answer

Configure diagnostic settings to send logs directly to the East US workspace.

Answer

Use Azure Monitor Agent to collect logs and send them to the East US workspace.

Answer

Export logs to a storage account in West Europe and then import them to the East US workspace using Azure Data Factory.

Question 9

You need to configure Microsoft Sentinel to comply with a regulatory requirement that all security incidents must be retained for 7 years. Which TWO actions should you take?

Accepted Answer

Set the workspace retention policy to 2555 days (7 years).. Option A is correct because the Log Analytics workspace retention policy can be set up to 2555 days (7 years), which directly satisfies the requirement to retain security incident data for that period within Microsoft Sentinel's underlying workspace. Option B is correct because configuring a data export rule to send data to an Azure Storage account with immutable storage for 7 years provides a durable, tamper-proof long-term archive that meets regulatory retention requirements, since workspace retention alone may not be sufficient for compliance. Option C is incorrect because table-level retention policies in Log Analytics are limited to a maximum of 2555 days only for the interactive retention tier, but the total retention including long-term is capped differently and table-level settings alone do not guarantee 7-year retention for all incident data. Option D is incorrect because Basic Logs are designed for high-volume, low-touch data and have a maximum retention of 30 days, which cannot meet a 7-year requirement. Option E is incorrect because Azure Policy can enforce configuration settings but cannot by itself extend retention beyond the service limits or guarantee the actual retention of incident data for 7 years.

Answer

Configure table-level retention policies for each table to 7 years.

Answer

Use Basic Logs for all tables to reduce costs.

Answer

Use Azure Policy to enforce a minimum retention period of 7 years on all workspaces.

Question 10

Refer to the exhibit. You run this PowerShell script. What is the effect on the SecurityEvent table in the SOC-Workspace Log Analytics workspace?

Accepted Answer

The table will retain data interactively for 365 days, and data will be archived for an additional 365 days, total 730 days.. The script sets $table.RetentionInDays = 365 and $table.TotalRetentionInDays = 730. Because TotalRetentionInDays (730) is greater than RetentionInDays (365), the table keeps 365 days of interactive (hot) retention, and the remaining 365 days (730-365) are archived. Interactive queries can search the hot 365 days directly; the archived 365 days require a search job or table restore to query.

Answer

The table will retain data interactively for 90 days and archived for 275 days.

Answer

The table will be converted to Basic Logs.

Answer

The table will retain data for 730 days interactively.

Question 11

Your organization uses Microsoft Sentinel with multiple workspaces across different regions. You need to centrally manage all security incidents from a single pane of glass. The solution must allow analysts to investigate incidents across workspaces without switching contexts. What should you configure?

Accepted Answer

Use Azure Lighthouse to manage multiple workspaces and enable cross-workspace incident view in Microsoft Sentinel.. Azure Lighthouse enables cross-workspace incident management in Microsoft Sentinel by granting delegated access across multiple Azure tenants or regions. This allows analysts to view and investigate incidents from all connected workspaces in a single pane of glass without switching contexts, fulfilling the requirement for centralized incident management.

Answer

Deploy Microsoft Sentinel in a single region and use Azure Arc to connect other workspaces.

Answer

Create a union query across workspaces using the workspace() expression.

Answer

Configure a single workspace and use diagnostic settings to send all logs to it.

Question 12

A junior security analyst reports that they cannot create a new analytics rule in Microsoft Sentinel. They have the 'Microsoft Sentinel Contributor' role on the workspace. What could be the issue?

Accepted Answer

The workspace is in a locked resource group preventing modifications.. The 'Microsoft Sentinel Contributor' role allows users to create and manage analytics rules, so the lack of permissions is not the issue. A resource group lock (e.g., CanNotDelete or ReadOnly) can prevent modifications to resources within that group, including the Log Analytics workspace that Sentinel uses. If the workspace is in a locked resource group, even users with Contributor rights cannot create or modify analytics rules.

Answer

They need the 'Owner' role to create analytics rules.

Answer

They do not have the 'Microsoft Sentinel Responder' role.

Answer

They are assigned the role at the subscription level but not at the workspace level.

Question 13

Your organization uses Microsoft Sentinel as the primary SIEM. The SOC team reports that many low-severity incidents are overwhelming the queue. You need to reduce noise while ensuring that high-severity incidents are not missed. Which two actions should you take? (Choose two.)

Accepted Answer

Adjust the analytics rule settings to only create incidents for alerts with a severity of Medium or higher.. Option B is correct because Microsoft Sentinel analytics rules include an incident creation setting that can be scoped to specific severities, so configuring rules to create incidents only for Medium, High, or Informational alerts suppresses low-severity incident creation at the source while still surfacing high-severity incidents. Option E is correct because automation rules in Sentinel can trigger on incident creation and apply conditions such as alert type or severity, allowing low-severity incidents to be automatically closed (or otherwise triaged) without manual SOC effort, which directly reduces queue noise. Option A is incorrect because extending retention for low-severity alerts only keeps data longer and does nothing to reduce the number of incidents in the queue. Option C is incorrect because manually reviewing every low-severity incident with playbooks increases analyst workload rather than reducing noise. Option D is incorrect because adding analytics rules to differentiate true from false positives may improve detection quality but does not by itself reduce the volume of low-severity incidents overwhelming the queue.

Answer

Increase the data retention period for low-severity alerts.

Answer

Use playbooks to manually review each low-severity incident.

Answer

Create additional analytics rules to better differentiate between true and false positives.

Question 14

The exhibit shows a KQL query used in a Microsoft 365 Defender custom detection rule. The query is intended to detect encoded PowerShell commands executed in the last hour. However, the detection rule is not generating any alerts even though the SOC knows that encoded PowerShell commands are being executed. Which modification would most likely fix the detection rule?

Accepted Answer

Add a condition to also look for `-EncodedCommand` in the command line.. The query uses `contains '-e'` which is too broad and matches many non-encoded commands. Adding a condition to explicitly check for `-EncodedCommand` in the command line narrows the detection to actual encoded PowerShell commands, which is the most likely fix for false negatives. Options A, C, and D either address performance issues or irrelevant filtering that would not specifically fix the detection of encoded commands.

Answer

Change `contains` to `has` for better performance and accuracy.

Answer

Modify the query to use `project-away` instead of `project`.

Answer

Replace `FileName == "powershell.exe"` with `InitiatingProcessFileName == "powershell.exe"`.

Question 15

Your organization uses Microsoft Sentinel with a workspace in the East US region. You have a playbook that escalates incidents to ServiceNow. Due to compliance requirements, all data must remain in the West Europe region. You need to ensure that the playbook execution and any data it processes stays within West Europe. What should you do?

Accepted Answer

Create the playbook as a Logic App in the West Europe region and ensure it uses a managed identity for authentication.. Playbooks in Microsoft Sentinel run as Azure Logic Apps, and the region of the Logic App resource determines where its execution and processed data reside. To keep playbook execution and data in West Europe, you must create the Logic App in the West Europe region and use a managed identity so authentication doesn't route credentials or data through other regions. This satisfies the compliance requirement without moving the entire Sentinel workspace.

Answer

Use a different Sentinel workspace in West Europe for the incidents.

Answer

Move the Sentinel workspace to West Europe.

Answer

Configure the ServiceNow connector to use a West Europe endpoint.