SC-200 Manage a security operations environment Practice Test 5 — 15 Questions

Question 1

Which THREE components are required to automate incident response in Microsoft Sentinel using playbooks? (Choose three.)

Accepted Answer

An automation rule in Sentinel.. Playbooks in Microsoft Sentinel are automated workflows that can be triggered by automation rules. The required components are: an automation rule (A) to define the trigger condition and invoke the playbook, a Logic Apps workflow (B) which is the playbook itself, and a trigger (E) such as 'when an incident is created' that starts the Logic App. Option C (workbook) is incorrect because workbooks are for visualization, not automation. Option D (analytics rule) is incorrect because analytics rules generate incidents, not playbooks.

Answer

A workbook.

Answer

An analytics rule.

Question 2

Which TWO data connectors can be used to ingest Microsoft 365 audit logs into Microsoft Sentinel? (Choose two.)

Accepted Answer

Microsoft 365 Defender connector.. The Microsoft 365 Defender connector (Option B) ingests unified audit logs from Microsoft 365 Defender, which includes security-related events from Microsoft 365 services. The Office 365 connector (Option C) directly ingests audit logs from Exchange Online, SharePoint Online, and Microsoft Teams, which are part of the Microsoft 365 audit log. Both connectors are designed to bring Microsoft 365 audit log data into Microsoft Sentinel.

Answer

Microsoft Defender for Cloud Apps connector.

Answer

Azure Activity connector.

Answer

Azure AD connector (sign-in logs).

Question 3

Refer to the exhibit. You are creating a scheduled analytics rule in Microsoft Sentinel using the ARM template snippet. The rule runs every 5 minutes and queries the last 5 minutes of data. The rule is not generating alerts even though malware detections are occurring. What is the most likely issue?

Accepted Answer

The table DeviceEvents is not ingested into the Log Analytics workspace.. DeviceEvents is a table from Microsoft Defender for Endpoint, but it is not automatically available in Microsoft Sentinel's Log Analytics workspace. The data connector for Microsoft Defender for Endpoint must be configured and the table must be mapped to Sentinel's workspace. Without this, the query runs against an empty table, returning no results, so the rule never triggers (even with triggerThreshold of 0). Option A is incorrect: having queryPeriod and queryFrequency both set to 5 minutes is standard for a rule that runs every 5 minutes looking at the last 5 minutes; it does not cause overlapping windows. Option B is incorrect: triggerThreshold of 0 means any result should trigger an alert, but if there are no results due to missing data, the rule won't fire. Option C is incorrect: the ARM template snippet would include the required 'kind' property for a scheduled rule; its absence is not the issue here.

Answer

The queryPeriod and queryFrequency are the same, causing overlapping windows.

Answer

The triggerThreshold is set to 0, which should always trigger.

Answer

The ARM template is missing the required 'kind' property.

Question 4

Refer to the exhibit. You are troubleshooting an endpoint that is not receiving real-time protection from Microsoft Defender Antivirus. The output shows RealTimeProtectionEnabled is False. Which command should you run next to enable real-time protection?

Accepted Answer

Set-MpPreference -DisableRealtimeMonitoring $false. The Set-MpPreference cmdlet with the -DisableRealtimeMonitoring $false parameter is the correct command to enable real-time protection in Microsoft Defender Antivirus. The output shows RealTimeProtectionEnabled is False, which directly corresponds to the DisableRealtimeMonitoring setting; setting it to $false re-enables the feature. This cmdlet modifies the local policy for the Microsoft Defender Antivirus engine, immediately activating real-time scanning of file operations and process activity.

Answer

Add-MpPreference -ExclusionPath C:\Temp

Answer

Start-MpScan

Answer

Update-MpSignature

Question 5

Refer to the exhibit. Your SOC manager runs this KQL query in Microsoft Sentinel to see which analysts have the most active high-severity incidents in the past 7 days. The query returns no results. What is the most likely reason?

Accepted Answer

The SecurityIncident table is not available in the Logs workspace; it is only accessible through the Sentinel incidents blade.. The SecurityIncident table is not available in the standard Log Analytics workspace; it is a Sentinel-specific table that is only accessible through the Microsoft Sentinel incidents blade or via the SecurityIncident table in the Sentinel Logs workspace when Sentinel is enabled. The query fails because the table does not exist in the workspace's schema, not because of syntax or data absence.

Answer

The query has a syntax error.

Answer

The table name is misspelled.

Answer

No high-severity incidents were created in the last 7 days.

Question 6

Your organization uses Microsoft Sentinel and Microsoft Defender for Cloud. You need to ensure that all cloud security alerts are automatically ingested into Sentinel. What should you configure?

Accepted Answer

Configure the Microsoft Defender for Cloud data connector (Legacy).. The Microsoft Defender for Cloud data connector (Legacy) is the correct choice because it specifically ingests security alerts from Microsoft Defender for Cloud into Microsoft Sentinel. This connector ensures that all alerts generated by Defender for Cloud's security policies and threat detection are automatically streamed into Sentinel for centralized monitoring and incident response.

Answer

Configure the Microsoft 365 Defender data connector.

Answer

Configure the Azure Activity data connector.

Answer

Create a custom log table and a PowerShell script to push alerts.

Question 7

Your security team uses Microsoft Sentinel UEBA to detect anomalous user behavior. You need to configure UEBA to baseline user activities and generate alerts for deviations. What must you do first?

Accepted Answer

Enable UEBA in the Sentinel Settings blade and select relevant data sources.. Microsoft Sentinel UEBA requires explicit enablement in the Sentinel Settings blade under the 'Entity behavior analytics' section. Once enabled, you must select the relevant data sources (e.g., Azure Active Directory sign-in logs, Office 365 audit logs, Windows Security Events) so that Sentinel can baseline normal user behavior patterns and generate alerts for anomalous deviations. Without this initial configuration, UEBA cannot process any data or produce behavioral analytics.

Answer

Create an Azure Machine Learning workspace for anomaly detection.

Answer

Assign Microsoft 365 E5 licenses to all users.

Answer

Deploy a custom data connector for HR systems.

Question 8

Your company uses Microsoft Defender for Office 365. You want to automatically take action on malicious emails that bypass the filter. What should you configure?

Accepted Answer

Configure automated investigation and response (AIR) policies.. Automated investigation and response (AIR) policies in Microsoft Defender for Office 365 are specifically designed to automatically take action on malicious emails that bypass initial filters. AIR uses playbooks to investigate threats and automatically remediate, such as deleting or moving emails, without manual intervention. This directly addresses the requirement to automatically act on bypassed malicious emails.

Answer

Enable anti-phishing policy.

Answer

Enable Safe Attachments policy.

Answer

Create a transport rule in Exchange.

Question 9

Your organization has Microsoft Defender for Endpoint deployed. You need to configure automatic attack disruption for ransomware attacks. What should you enable?

Accepted Answer

Automatic attack disruption in Microsoft 365 Defender.. Automatic attack disruption in Microsoft 365 Defender is the correct feature to enable because it uses advanced detection signals to automatically contain compromised assets during ransomware attacks, such as isolating devices or blocking accounts, without manual intervention. This capability is specifically designed to stop the spread of ransomware in real time by leveraging Microsoft's threat intelligence and behavioral analytics.

Answer

Attack surface reduction rules.

Answer

Live Response capabilities.

Answer

Device discovery settings.

Question 10

Your team uses Microsoft Sentinel to investigate incidents. You need to create a custom analytic rule that triggers an incident when a user signs in from an unfamiliar location. What is the most efficient way to achieve this?

Accepted Answer

Use a built-in Anomalous Sign-in Location rule template.. Microsoft Sentinel provides a built-in 'Anomalous Sign-in Location' rule template that leverages Microsoft Entra ID Identity Protection data to detect sign-ins from unfamiliar locations. This template is pre-configured with the necessary KQL logic and alerting, making it the most efficient method without requiring custom development or additional data sources.

Answer

Create a playbook triggered by Microsoft Entra ID alerts.

Answer

Write a custom KQL query using SigninLogs.

Answer

Configure a Microsoft Purview insider risk policy.

Question 11

Your organization uses Microsoft Defender for Cloud Apps. You need to block downloads from unmanaged devices for a specific cloud app. What should you configure?

Accepted Answer

Create a session policy with device tag condition.. Session policies in Microsoft Defender for Cloud Apps allow you to control user activities in real time based on device tags. By configuring a session policy with a device tag condition (e.g., 'Device tag equals Unmanaged'), you can enforce actions like blocking downloads from unmanaged devices for a specific cloud app, leveraging reverse proxy architecture to inspect and control traffic.

Answer

Create a file policy with a governance action.

Answer

Create an app permissions policy.

Answer

Create an anomaly detection policy.

Question 12

Your Microsoft Sentinel workspace is ingesting data from multiple sources. You need to ensure that data from a specific source is retained for 2 years while other data remains at the default retention. What should you do?

Accepted Answer

Create a custom table for that source and set its retention to 2 years.. In Microsoft Sentinel, retention is set at the table level. By creating a custom table for the specific data source and configuring its retention period to 2 years, you can override the default workspace retention for that table only. This allows other tables to retain the default retention setting while the custom table retains data for the required duration.

Answer

Adjust the data ingestion settings for that source.

Answer

Set the workspace retention to 2 years.

Answer

Configure archiving for that source's data.

Question 13

Your organization uses Microsoft Defender for Identity. You receive an alert about a suspicious Kerberos ticket request. What is the most appropriate first step?

Accepted Answer

Investigate the alert in the Microsoft 365 Defender portal.. The first step when receiving any security alert, including a suspicious Kerberos ticket request from Microsoft Defender for Identity, is to investigate the alert in the Microsoft 365 Defender portal. This portal provides the unified security operations console where you can view the full alert details, related entities, and the MITRE ATT&CK mapping to understand the scope and severity before taking any remediation actions. Prematurely disabling accounts or resetting passwords without investigation can destroy forensic evidence and potentially disrupt legitimate user activity.

Answer

Disable the user account.

Answer

Reset the user's password.

Answer

Reset the krbtgt account password.

Question 14

Your Microsoft Sentinel environment uses multiple workspaces. You need to centrally manage incidents from all workspaces in a single interface. What should you use?

Accepted Answer

Use cross-workspace queries in Sentinel incidents.. Cross-workspace queries in Microsoft Sentinel allow you to include multiple workspaces in a single query by using the `workspace()` expression. When you create an incident rule that uses such a query, Sentinel can centrally manage incidents generated from data across all specified workspaces, providing a unified incident queue in the Sentinel interface.

Answer

Create an Azure Monitor workbook.

Answer

Use the Microsoft 365 Defender portal.

Answer

Use Azure Logic Apps to aggregate incidents.

Question 15

Which TWO actions are valid methods to ingest non-Microsoft security logs into Microsoft Sentinel?

Accepted Answer

Configure Syslog forwarding to the Sentinel workspace.. Syslog is a standard protocol for logging from network devices and other non-Microsoft sources. By configuring Syslog forwarding to a Log Analytics agent (or the new Azure Monitor Agent) running on a Linux machine, logs can be collected and ingested into the Microsoft Sentinel workspace. Option E is correct because the Log Analytics agent (or its successor, the Azure Monitor Agent) can be installed directly on a non-Microsoft device to collect custom logs, performance data, and event logs, which are then sent to the Sentinel workspace.

Answer

Use Azure Policy to automatically enable diagnostics settings.

Answer

Configure the Microsoft 365 Defender data connector.

Answer

Use Microsoft Intune to push a custom log collector.