SC-200 Manage a security operations environment Practice Test 6 — 15 Questions

Question 1

Your organization has Microsoft Defender for Endpoint deployed. You need to configure automatic attack disruption for ransomware attacks. What should you enable?

Accepted Answer

Automatic attack disruption in Microsoft 365 Defender.. Automatic attack disruption in Microsoft 365 Defender is the correct feature to enable because it uses advanced detection signals to automatically contain compromised assets during ransomware attacks, such as isolating devices or blocking accounts, without manual intervention. This capability is specifically designed to stop the spread of ransomware in real time by leveraging Microsoft's threat intelligence and behavioral analytics.

Answer

Attack surface reduction rules.

Answer

Live Response capabilities.

Answer

Device discovery settings.

Question 2

Your team uses Microsoft Sentinel to investigate incidents. You need to create a custom analytic rule that triggers an incident when a user signs in from an unfamiliar location. What is the most efficient way to achieve this?

Accepted Answer

Use a built-in Anomalous Sign-in Location rule template.. Option D is correct because Microsoft Sentinel provides a built-in 'Anomalous Sign-in Location' rule template that leverages Microsoft Entra ID Identity Protection data to detect sign-ins from unfamiliar locations. This template is pre-configured with the necessary KQL logic and alerting, making it the most efficient method without requiring custom development or additional data sources.

Answer

Create a playbook triggered by Microsoft Entra ID alerts.

Answer

Write a custom KQL query using SigninLogs.

Answer

Configure a Microsoft Purview insider risk policy.

Question 3

Your organization uses Microsoft Defender for Cloud Apps. You need to block downloads from unmanaged devices for a specific cloud app. What should you configure?

Accepted Answer

Create a session policy with device tag condition.. Option B is correct because session policies in Microsoft Defender for Cloud Apps allow you to control user activities in real time based on device tags. By configuring a session policy with a device tag condition (e.g., 'Device tag equals Unmanaged'), you can enforce actions like blocking downloads from unmanaged devices for a specific cloud app, leveraging reverse proxy architecture to inspect and control traffic.

Answer

Create a file policy with a governance action.

Answer

Create an app permissions policy.

Answer

Create an anomaly detection policy.

Question 4

Your Microsoft Sentinel workspace is ingesting data from multiple sources. You need to ensure that data from a specific source is retained for 2 years while other data remains at the default retention. What should you do?

Accepted Answer

Create a custom table for that source and set its retention to 2 years.. In Microsoft Sentinel, retention is set at the table level. By creating a custom table for the specific data source and configuring its retention period to 2 years, you can override the default workspace retention for that table only. This allows other tables to retain the default retention setting while the custom table retains data for the required duration.

Answer

Adjust the data ingestion settings for that source.

Answer

Set the workspace retention to 2 years.

Answer

Configure archiving for that source's data.

Question 5

Your organization uses Microsoft Defender for Identity. You receive an alert about a suspicious Kerberos ticket request. What is the most appropriate first step?

Accepted Answer

Investigate the alert in the Microsoft 365 Defender portal.. Option B is correct because the first step when receiving any security alert, including a suspicious Kerberos ticket request from Microsoft Defender for Identity, is to investigate the alert in the Microsoft 365 Defender portal. This portal provides the unified security operations console where you can view the full alert details, related entities, and the MITRE ATT&CK mapping to understand the scope and severity before taking any remediation actions. Prematurely disabling accounts or resetting passwords without investigation can destroy forensic evidence and potentially disrupt legitimate user activity.

Answer

Disable the user account.

Answer

Reset the user's password.

Answer

Reset the krbtgt account password.

Question 6

Your Microsoft Sentinel environment uses multiple workspaces. You need to centrally manage incidents from all workspaces in a single interface. What should you use?

Accepted Answer

Use cross-workspace queries in Sentinel incidents.. Cross-workspace queries in Microsoft Sentinel allow you to include multiple workspaces in a single query by using the `workspace()` expression. When you create an incident rule that uses such a query, Sentinel can centrally manage incidents generated from data across all specified workspaces, providing a unified incident queue in the Sentinel interface.

Answer

Create an Azure Monitor workbook.

Answer

Use the Microsoft 365 Defender portal.

Answer

Use Azure Logic Apps to aggregate incidents.

Question 7

Which TWO actions are valid methods to ingest non-Microsoft security logs into Microsoft Sentinel?

Accepted Answer

Configure Syslog forwarding to the Sentinel workspace.. Option B is correct because Syslog is a standard protocol for logging from network devices and other non-Microsoft sources. By configuring Syslog forwarding to a Log Analytics agent (or the new Azure Monitor Agent) running on a Linux machine, logs can be collected and ingested into the Microsoft Sentinel workspace. Option E is correct because the Log Analytics agent (or its successor, the Azure Monitor Agent) can be installed directly on a non-Microsoft device to collect custom logs, performance data, and event logs, which are then sent to the Sentinel workspace.

Answer

Use Azure Policy to automatically enable diagnostics settings.

Answer

Configure the Microsoft 365 Defender data connector.

Answer

Use Microsoft Intune to push a custom log collector.

Question 8

Which THREE components are part of Microsoft's unified security operations platform (Microsoft Defender XDR)?

Accepted Answer

Microsoft Defender for Endpoint.. Microsoft Defender XDR is Microsoft's unified security operations platform that integrates signals from across the Microsoft 365 ecosystem. Microsoft Defender for Endpoint is a core component, providing endpoint detection and response (EDR) capabilities, including behavioral-based detection, automated investigation, and threat hunting on Windows, macOS, Linux, Android, and iOS devices. It contributes telemetry such as process creation, network connections, and file events to the unified incident and alert correlation in the Defender XDR portal.

Answer

Microsoft Intune.

Answer

Microsoft Sentinel.

Question 9

Which TWO features are available in Microsoft Sentinel to automate incident response?

Accepted Answer

Playbooks based on Azure Logic Apps.. Playbooks based on Azure Logic Apps are correct because they provide a native, low-code automation framework within Microsoft Sentinel. They allow security analysts to define and execute complex, multi-step response actions—such as isolating a compromised VM, blocking an IP address, or opening a ticket—triggered by alerts or incidents. This directly automates incident response workflows without manual intervention.

Answer

Workbooks.

Answer

Kusto Query Language (KQL) queries.

Answer

UEBA.

Question 10

Refer to the exhibit. You are reviewing a Microsoft Sentinel analytics rule created via ARM template. What is the effect of the grouping configuration?

Accepted Answer

Groups alerts into one incident if all entities match within a 5-hour lookback.. The grouping configuration in the exhibit sets the grouping condition to 'Group alerts into a single incident if all entities match' with a 5-hour lookback period. This means that alerts generated within 5 hours that share identical entities (e.g., same IP, host, or account) will be merged into one incident, reducing alert noise. Option D correctly describes this behavior, as it specifies both the entity matching requirement and the time window.

Answer

Groups alerts into one incident if any entity matches.

Answer

Creates a separate incident for each alert.

Answer

Suppresses alerts for 5 hours after the first alert.

Question 11

Refer to the exhibit. You run the PowerShell command against Microsoft Defender for Endpoint. What is the result?

Accepted Answer

An antivirus scan runs on the device.. The `Start-MpScan` cmdlet initiates a Microsoft Defender Antivirus scan on the device. The `-ScanType` parameter with value `QuickScan` specifies a quick scan of common malware locations, not a full scan. This is a direct antivirus action, not an investigation package collection, isolation, or Live Response session.

Answer

The investigation package is collected.

Answer

The device is isolated from the network.

Answer

A Live Response session is started.

Question 12

Refer to the exhibit. You run this KQL query in Microsoft Sentinel. What does it return?

Accepted Answer

Top 5 incident owners by number of high-severity incidents in the last 7 days.. The KQL query uses `summarize` with `count()` by `Owner`, then `top 5 by count_`, and filters with `where Severity == 'High'` and `TimeGenerated > ago(7d)`. This returns the top 5 incident owners ranked by the number of high-severity incidents they own in the last 7 days, making option C correct.

Answer

Number of high-severity incidents per status.

Answer

Total count of high-severity incidents in the last 7 days.

Answer

Top 5 users assigned to high-severity incidents.

Question 13

Your organization has a hybrid identity environment with Microsoft Entra ID and on-premises Active Directory. You are configuring Microsoft Defender for Identity to protect against lateral movement attacks. Which configuration should you prioritize to detect pass-the-hash attacks?

Accepted Answer

Enable 'Capture NTLM hashes' in the Microsoft Defender for Identity sensor configuration. Option D is correct because enabling 'Capture NTLM hashes' in the Microsoft Defender for Identity sensor configuration allows the sensor to extract NTLM hashes from network traffic. Pass-the-hash attacks rely on capturing and reusing NTLM hashes to authenticate laterally; by capturing these hashes, Defender for Identity can detect anomalies such as a hash being used from a different source or for suspicious logon attempts, directly identifying the attack.

Answer

Configure port mirroring for domain controllers

Answer

Enable 'SAM-R' (Remote SAM) in the Microsoft Defender for Identity sensor configuration

Answer

Configure Windows Event Forwarding (WEF) for domain controllers

Question 14

Your organization uses Microsoft Sentinel to manage security incidents. You need to ensure that critical incidents are automatically assigned to the senior security analyst on duty. What should you configure?

Accepted Answer

Configure an automation rule with an 'Assign incident' action. Option B is correct because automation rules in Microsoft Sentinel can assign incidents to specific users or groups based on conditions. Option A is wrong because playbooks are for automated response actions, not assignment. Option C is wrong because analytics rules generate incidents, not assign them. Option D is wrong because workbooks are for visualization, not assignment.

Answer

Modify the analytics rule to set the owner in the incident creation

Answer

Create a playbook that assigns incidents

Answer

Use a workbook to filter incidents by severity and assign manually

Question 15

Your organization uses Microsoft Defender for Cloud Apps to discover shadow IT. You notice that a new cloud app is being used by multiple users but has a risk score of 8. What should you do first to manage the risk?

Accepted Answer

Investigate the app's risk factors and user activity. A risk score of 8 indicates the app is high-risk, but immediate blocking or unsanctioning could disrupt business operations if the app is legitimate or used for approved purposes. The first step is to investigate the app's risk factors (e.g., data residency, encryption standards, compliance certifications) and user activity (e.g., volume of data uploaded, types of files shared) to understand the actual threat. This aligns with Microsoft's recommended incident response process: assess before acting.

Answer

Block the app at the proxy

Answer

Immediately unsanction the app in Defender for Cloud Apps

Answer

Create a policy to alert on use of this app