SC-200 Manage a security operations environment Practice Test 6 — 15 Questions

Question 1

Which THREE components are part of Microsoft's unified security operations platform (Microsoft Defender XDR)?

Accepted Answer

Microsoft Defender for Endpoint.. Microsoft Defender XDR is Microsoft's unified security operations platform that integrates signals from across the Microsoft 365 ecosystem. Microsoft Defender for Endpoint is a core component, providing endpoint detection and response (EDR) capabilities, including behavioral-based detection, automated investigation, and threat hunting on Windows, macOS, Linux, Android, and iOS devices. It contributes telemetry such as process creation, network connections, and file events to the unified incident and alert correlation in the Defender XDR portal.

Answer

Microsoft Intune.

Answer

Microsoft Sentinel.

Question 2

Refer to the exhibit. You are reviewing a Microsoft Sentinel analytics rule created via ARM template. What is the effect of the grouping configuration?

Accepted Answer

Groups alerts into one incident if all entities match within a 5-hour lookback.. The grouping configuration in the exhibit sets the grouping condition to 'Group alerts into a single incident if all entities match' with a 5-hour lookback period. This means that alerts generated within 5 hours that share identical entities (e.g., same IP, host, or account) will be merged into one incident, reducing alert noise. Option D correctly describes this behavior, as it specifies both the entity matching requirement and the time window.

Answer

Groups alerts into one incident if any entity matches.

Answer

Creates a separate incident for each alert.

Answer

Suppresses alerts for 5 hours after the first alert.

Question 3

Refer to the exhibit. You run the PowerShell command against Microsoft Defender for Endpoint. What is the result?

Accepted Answer

An antivirus scan runs on the device.. The `Start-MpScan` cmdlet initiates a Microsoft Defender Antivirus scan on the device. The `-ScanType` parameter with value `QuickScan` specifies a quick scan of common malware locations, not a full scan. This is a direct antivirus action, not an investigation package collection, isolation, or Live Response session.

Answer

The investigation package is collected.

Answer

The device is isolated from the network.

Answer

A Live Response session is started.

Question 4

Refer to the exhibit. You run this KQL query in Microsoft Sentinel. What does it return?

Accepted Answer

Top 5 incident owners by number of high-severity incidents in the last 7 days.. The KQL query uses `summarize` with `count()` by `Owner`, then `top 5 by count_`, and filters with `where Severity == 'High'` and `TimeGenerated > ago(7d)`. This returns the top 5 incident owners ranked by the number of high-severity incidents they own in the last 7 days, making option C correct.

Answer

Number of high-severity incidents per status.

Answer

Total count of high-severity incidents in the last 7 days.

Answer

Top 5 users assigned to high-severity incidents.

Question 5

Your organization has a hybrid identity environment with Microsoft Entra ID and on-premises Active Directory. You are configuring Microsoft Defender for Identity to protect against lateral movement attacks. Which configuration should you prioritize to detect pass-the-hash attacks?

Accepted Answer

Enable 'Capture NTLM hashes' in the Microsoft Defender for Identity sensor configuration. Enabling 'Capture NTLM hashes' in the Microsoft Defender for Identity sensor configuration allows the sensor to extract NTLM hashes from network traffic. Pass-the-hash attacks rely on capturing and reusing NTLM hashes to authenticate laterally; by capturing these hashes, Defender for Identity can detect anomalies such as a hash being used from a different source or for suspicious logon attempts, directly identifying the attack.

Answer

Configure port mirroring for domain controllers

Answer

Enable 'SAM-R' (Remote SAM) in the Microsoft Defender for Identity sensor configuration

Answer

Configure Windows Event Forwarding (WEF) for domain controllers

Question 6

Your organization uses Microsoft Sentinel to manage security incidents. You need to ensure that critical incidents are automatically assigned to the senior security analyst on duty. What should you configure?

Accepted Answer

Modify the analytics rule to set the owner in the incident creation. Modifying the analytics rule to set the owner during incident creation ensures that critical incidents are automatically assigned to the designated analyst. In Microsoft Sentinel, analytics rules can be configured to specify the incident owner at creation time. Option A is incorrect because automation rules are triggered after incident creation and cannot set the initial owner. Option C is incorrect because playbooks are for automated response actions, not for initial assignment. Option D is incorrect because workbooks are for visualization, not assignment.

Answer

Configure an automation rule with an 'Assign incident' action

Answer

Create a playbook that assigns incidents

Answer

Use a workbook to filter incidents by severity and assign manually

Question 7

Your organization uses Microsoft Defender for Cloud Apps to discover shadow IT. You notice that a new cloud app is being used by multiple users but has a risk score of 8. What should you do first to manage the risk?

Accepted Answer

Investigate the app's risk factors and user activity. A risk score of 8 indicates the app is high-risk, but immediate blocking or unsanctioning could disrupt business operations if the app is legitimate or used for approved purposes. The first step is to investigate the app's risk factors (e.g., data residency, encryption standards, compliance certifications) and user activity (e.g., volume of data uploaded, types of files shared) to understand the actual threat. This aligns with Microsoft's recommended incident response process: assess before acting.

Answer

Block the app at the proxy

Answer

Immediately unsanction the app in Defender for Cloud Apps

Answer

Create a policy to alert on use of this app

Question 8

Your organization uses Microsoft Sentinel and you have configured a fusion analytics rule for advanced multistage attack detection. You notice that the rule is generating a high number of false positives. What should you do to reduce the false positives without disabling the rule?

Accepted Answer

Add entity exclusions to the fusion rule configuration. Fusion analytics rules in Microsoft Sentinel support entity exclusions to reduce false positives. By excluding specific entities (e.g., known benign IPs or users), the rule will not generate incidents for those entities, thus reducing false positives without disabling the rule. Option A is incorrect because disabling the rule is not desired. Option C is incorrect because fusion rules are built-in and do not allow modification of incident creation conditions; they only support exclusions. Option D is incorrect because fusion rules do not have a configurable severity threshold.

Answer

Disable the fusion rule and create custom analytics rules

Answer

Modify the fusion rule’s incident creation conditions

Answer

Reduce the severity threshold for the fusion rule

Question 9

Your organization uses Microsoft Defender XDR and you are configuring attack surface reduction (ASR) rules. You need to implement a rule that blocks executable files from running unless they meet a prevalence, age, or trusted list criterion. Which ASR rule should you enable?

Accepted Answer

Block executable files from running unless they meet a prevalence, age, or trusted list criterion. The ASR rule 'Block executable files from running unless they meet a prevalence, age, or trusted list criterion' (GUID: 01443614-cd74-433a-b99e-2ecdc07bfc25) is specifically designed to prevent executable files (e.g., .exe, .dll, .scr) from running unless they have been seen in the organization (prevalence), are old enough (age), or are on a trusted list. This rule uses cloud-delivered protection and Microsoft's reputation-based intelligence to evaluate files before execution, directly matching the requirement described in the question.

Answer

Block untrusted and unsigned processes that run from USB

Answer

Block Office applications from creating executable content

Answer

Block credential stealing from the Windows local security authority subsystem (lsass.exe)

Question 10

Your organization uses Microsoft Sentinel and you need to ensure that incidents are automatically closed when a related playbook completes successfully. What should you configure?

Accepted Answer

Create an automation rule that triggers after the playbook runs and closes the incident. Automation rules in Microsoft Sentinel can be configured to trigger after a playbook completes, and one of the available actions is to close an incident. This ensures that the incident is automatically closed only when the playbook has successfully finished, providing a reliable and automated closure mechanism without manual intervention.

Answer

Add a 'Close incident' action in the playbook

Answer

Configure the analytics rule to close incidents automatically

Answer

Use a workbook to manually close incidents

Question 11

Your organization uses Microsoft Defender for Cloud and you need to ensure that security recommendations are automatically remediated for non-compliant resources. You have enabled 'Auto provisioning' for the Log Analytics agent. What additional step is required to enable automatic remediation?

Accepted Answer

Enable the 'DeployIfNotExists' policy for specific recommendations. Enabling 'Auto provisioning' for the Log Analytics agent only ensures the agent is installed on VMs, but does not automatically remediate security recommendations. To achieve automatic remediation, you must enable the 'DeployIfNotExists' effect on specific Azure Policy definitions (e.g., 'System updates should be installed on your machines'), which triggers remediation tasks when resources are non-compliant. This is a separate step in Defender for Cloud's 'Security policy' blade under 'Settings & monitoring'.

Answer

No additional step is required; auto provisioning automatically remediates

Answer

Configure manual remediation in Defender for Cloud

Answer

Create a custom Azure Policy initiative with audit effect

Question 12

Your organization uses Microsoft Purview Compliance Manager to manage compliance activities. You need to assign a specific improvement action to a colleague for implementation. What should you do?

Accepted Answer

In the 'Improvement actions' tab, select the action and click 'Assign'. In Microsoft Purview Compliance Manager, improvement actions are the specific tasks that need to be completed to meet compliance controls. Each improvement action can be directly assigned to a colleague by selecting the action in the 'Improvement actions' tab and clicking the 'Assign' button, which allows you to specify the assignee and due date. This is the intended workflow for delegating implementation responsibilities within Compliance Manager.

Answer

Create a new alert policy to notify the colleague

Answer

Modify the assessment to include the colleague as an owner

Answer

Use the 'Assessments' tab to delegate tasks

Question 13

Your organization uses Microsoft Sentinel and you have a playbook that sends an email notification when a high-severity incident is created. You want to ensure that the playbook only runs for incidents that are not already assigned to a user. What should you configure?

Accepted Answer

Configure the automation rule trigger to include a condition for 'Incident owner equals null'. Automation rules in Microsoft Sentinel can include conditions that filter which incidents trigger a playbook. By configuring the automation rule with a condition for 'Incident owner equals null', the playbook will only run for incidents that are unassigned, ensuring that already assigned incidents are not processed. This approach is efficient and avoids unnecessary execution of the playbook.

Answer

Set the playbook trigger to 'When an incident is created' and add a condition inside

Answer

Add a condition in the playbook to check if the incident is assigned

Answer

Modify the analytics rule to only generate unassigned incidents

Question 14

Which TWO actions should you take to ensure that Microsoft Sentinel can properly ingest logs from a Linux server running rsyslog? (Choose two.)

Accepted Answer

Install the Log Analytics agent (or Azure Monitor Agent) on the Linux server. The Log Analytics agent (or Azure Monitor Agent) must be installed on the Linux server to receive and forward syslog data to Microsoft Sentinel. Without the agent, Sentinel has no direct mechanism to collect logs from the server. The agent listens for syslog messages forwarded by rsyslog and then sends them to the Log Analytics workspace.

Answer

Install and configure syslog-ng instead of rsyslog

Answer

Configure rsyslog to forward logs to the agent on TCP 514

Answer

Configure Windows Event Forwarding (WEF) to collect logs from the Linux server

Question 15

Which THREE features are available in Microsoft Defender XDR to help automate incident response? (Choose three.)

Accepted Answer

Automated investigation and response (AIR). Automated investigation and response (AIR) in Microsoft Defender XDR automatically runs playbooks on alerts to investigate and remediate threats without manual intervention. It leverages machine learning and security signals across endpoints, email, and identities to contain malicious activity, such as isolating a compromised device or blocking a malicious file, directly within the incident response workflow.

Answer

Microsoft Power Automate

Answer

Microsoft Sentinel fusion rule