SC-200 Manage a security operations environment Practice Test 7 — 15 Questions

Question 1

Which TWO are valid methods to connect a non-Azure Windows server to Microsoft Sentinel? (Choose two.)

Accepted Answer

Install the Azure Monitor Agent (AMA). The Azure Monitor Agent (AMA) is the current, recommended agent for collecting data from non-Azure Windows servers and sending it to Microsoft Sentinel. It replaces the older Log Analytics agent and supports data collection via Data Collection Rules (DCRs), which allow granular control over which events and performance counters are ingested. Option D is correct because the Log Analytics agent (MMA) was the original method to connect Windows servers to Sentinel, and while it is being phased out in favor of AMA, it remains a valid supported method for existing deployments.

Answer

Install the Azure Security Center agent

Answer

Configure Windows Event Forwarding (WEF) and point it to Sentinel

Answer

Configure the server to forward syslog to Sentinel

Question 2

Refer to the exhibit. You are reviewing an Azure Security Center automation (now Microsoft Defender for Cloud) that should automatically trigger a Logic App when an alert is generated. However, the automation is not triggering. What is the most likely cause?

Accepted Answer

The automation is missing the 'triggers' property to filter on specific alert types. Microsoft Defender for Cloud automation requires a 'triggers' property to define which alert types should invoke the Logic App. Without this property, the automation is created but never fires, as it has no conditions to match incoming alerts. The exhibit shows the automation resource is configured, but missing the triggers array means no alerts will trigger the Logic App.

Answer

The action type is incorrect; it should be 'EventHub'

Answer

The logicAppResourceId is missing

Answer

The apiVersion is invalid

Question 3

Refer to the exhibit. You are analyzing a KQL query in Microsoft Sentinel that returns accounts with more than 10 failed logins within 5 minutes. The query is not returning any results even though you know there have been multiple failed logins. What is the most likely reason?

Accepted Answer

The filter condition 'Account !startswith "ANONYMOUS LOGON"' is case-sensitive and may be excluding valid results. The `!startswith` operator in KQL is case-sensitive by default. If the actual account name in the SecurityEvent table is stored as 'ANONYMOUS LOGON' with a different case (e.g., 'Anonymous Logon' or 'anonymous logon'), the filter will exclude those rows, causing the query to return no results even though failed logins occurred. This is a common pitfall when using string comparison operators in KQL without considering case sensitivity.

Answer

The 'startswith' operator is not a valid KQL operator

Answer

The 'bin' function is used incorrectly

Answer

The query syntax requires a 'let' statement

Question 4

Refer to the exhibit. You are reviewing a custom Azure Policy definition that should block deployments from specific IP addresses. However, the policy does not seem to be evaluating any resources. What is the most likely issue?

Accepted Answer

The policy definition has not been assigned to any scope. The exhibit shows a custom Azure Policy definition that is syntactically correct, but the policy is not evaluating any resources. The most likely cause is that the policy definition has not been assigned to a scope (e.g., management group, subscription, or resource group). In Azure Policy, a definition alone does nothing; it must be assigned to a scope to take effect and begin evaluating resources.

Answer

The 'in' operator cannot be used with an array parameter

Answer

The policy mode should be 'Indexed' for network policies

Answer

The 'effect' should be 'audit' instead of 'deny'

Question 5

Your organization has a Microsoft Sentinel workspace that ingests logs from Azure resources, Microsoft 365, and third-party firewalls. You need to ensure that data retention for Azure Activity logs complies with a regulatory requirement of 3 years, while keeping costs low for other data types. What should you do?

Accepted Answer

Configure a data retention policy on the AzureActivity table to 3 years.. Azure Sentinel allows you to configure a custom retention policy on a specific table (e.g., AzureActivity) to retain data for up to 2 years (or longer with Archive tier) independently of the workspace's default retention. This meets the 3-year regulatory requirement for Azure Activity logs without increasing retention costs for other data types, as the workspace default can remain shorter.

Answer

Use the Archive tier for Azure Activity logs and set the total retention period to 3 years.

Answer

Set the workspace retention to 3 years.

Answer

Enable Basic Logs plan on the AzureActivity table.

Question 6

You are configuring Microsoft Sentinel to ingest syslog data from a network appliance. After configuring the data connector, you notice that no data is appearing in the CommonSecurityLog table. The syslog server is sending data to the Azure Monitor Agent (AMA) on the log collector. What should you verify first?

Accepted Answer

Verify that a Data Collection Rule is defined to collect the syslog facilities.. The Azure Monitor Agent (AMA) requires a Data Collection Rule (DCR) to specify which syslog facilities and severity levels to collect. Without a DCR, the AMA will not forward syslog data to the CommonSecurityLog table, even if the syslog server is sending data to the collector. This is the most common missing configuration step after setting up the data connector.

Answer

Check the Heartbeat table for the log collector.

Answer

Ensure the syslog appliance can reach the collector on UDP port 514.

Answer

Check the data connector health status in Sentinel.

Question 7

You are managing a Microsoft Sentinel environment with multiple workspaces across different regions. You need to centralize incident management and allow security analysts to triage incidents from all workspaces in a single view. What should you configure?

Accepted Answer

Configure a central Microsoft Sentinel workspace with cross-workspace analytics rules.. Cross-workspace analytics rules in Microsoft Sentinel allow you to define a single analytics rule that queries multiple workspaces, enabling centralized incident creation and management. This configuration ensures that security analysts can view and triage incidents from all workspaces in a single Microsoft Sentinel instance, without needing to switch between different workspace blades.

Answer

Create a workbook that queries all workspaces.

Answer

Use the Microsoft Sentinel SIEM Migration experience.

Answer

Use Azure Lighthouse to manage all workspaces from a single pane of glass.

Question 8

Your Microsoft Sentinel workspace has a Microsoft 365 Defender connector configured. You notice that incidents are being created from Microsoft Defender for Office 365 alerts, but not from Microsoft Defender for Identity alerts. What should you check?

Accepted Answer

Enable the Microsoft Defender for Identity alert streaming in the connector configuration.. The Microsoft 365 Defender connector in Microsoft Sentinel requires explicit enablement of alert streaming for each Microsoft Defender service. By default, the connector may stream alerts from Defender for Office 365 but not from Defender for Identity unless the corresponding toggle is turned on in the connector configuration. Option A directly addresses this by instructing you to enable the Defender for Identity alert streaming, which resolves the missing incident creation.

Answer

Verify that the Microsoft 365 Defender connector is connected.

Answer

Ensure you have licenses for Microsoft Defender for Identity.

Answer

Check the incident correlation rules in Microsoft Defender XDR.

Question 9

Your organization uses Microsoft Sentinel with Azure Monitor Agent (AMA) to collect Windows security events. You need to collect process creation events (Event ID 4688) and include command-line information. The current Data Collection Rule (DCR) collects only basic security events. What should you modify?

Accepted Answer

Enable the 'Include command line in process creation events' policy in Windows Group Policy.. Event ID 4688 (process creation) can include command-line arguments, but this data is not captured by default. The 'Include command line in process creation events' Group Policy setting must be enabled on the Windows machines to populate the CommandLine field in the security event log. Without this policy, the AMA and DCR will collect the event but the command-line information will be empty.

Answer

Upgrade the AMA to the latest version.

Answer

Modify the DCR to include Event ID 4688 in the data source.

Answer

Switch to the Windows Security Events via Legacy Agent connector.

Question 10

You are configuring automated responses in Microsoft Sentinel. You have created an automation rule that runs a playbook when an incident is created. The playbook performs actions in Microsoft Entra ID and Microsoft Defender for Cloud. However, the playbook fails with a permissions error. What should you do?

Accepted Answer

Assign the managed identity of the playbook the required roles in Microsoft Entra ID and Defender for Cloud.. The playbook fails with a permissions error because it uses a managed identity to authenticate to Microsoft Entra ID and Microsoft Defender for Cloud, but that identity has not been granted the necessary Azure RBAC roles (e.g., Security Reader, Security Admin) on the target resources. Assigning the required roles to the managed identity directly resolves the authorization failure.

Answer

Enable 'Allow playbooks to use managed identity' in the Sentinel settings.

Answer

Configure the Microsoft Entra ID connector in Sentinel with delegated permissions.

Answer

Grant the security analyst's account Contributor permissions on the automation rule.

Question 11

You need to ensure that critical incidents in Microsoft Sentinel are automatically assigned to a senior security analyst. What should you configure?

Accepted Answer

Create an automation rule that assigns the incident to the analyst.. Automation rules in Microsoft Sentinel allow you to automatically assign incidents to specific users or groups based on conditions like severity or title. By creating an automation rule that triggers on incident creation and sets the owner to the senior security analyst, you ensure critical incidents are assigned without manual intervention.

Answer

Create an analytics rule with a custom schedule.

Answer

Configure a workbook to filter incidents by owner.

Answer

Add the analyst to a watchlist used in analytics rules.

Question 12

Which TWO actions should you take to reduce the cost of Microsoft Sentinel while maintaining security coverage?

Accepted Answer

Reduce the retention period of tables that do not require long-term storage.. Reducing the retention period for tables that do not require long-term storage directly lowers the data storage costs in Microsoft Sentinel. Sentinel charges per GB of data stored, and by shortening retention (e.g., from 90 days to 30 days) for non-critical tables, you reduce the volume of data retained without affecting security monitoring or incident investigation for the shortened period.

Answer

Remove data connectors for non-critical sources.

Answer

Disable analytics rules that generate low-severity incidents.

Answer

Switch the workspace pricing tier from Capacity Reservations to Pay-as-you-Go.

Question 13

Which THREE components are required to collect syslog messages from a network appliance into Microsoft Sentinel using the Azure Monitor Agent?

Accepted Answer

A syslog daemon (e.g., rsyslog) on the log collector server to receive messages.. Syslog messages are sent over UDP (or TCP) by network appliances, and a syslog daemon like rsyslog must be running on the log collector server to listen on port 514 (or a custom port) and receive those messages. Without this daemon, the Azure Monitor Agent cannot ingest the raw syslog data, as the agent relies on the local syslog daemon to capture and forward the logs to its event pipeline.

Answer

The Log Analytics agent (MMA) installed on the appliance.

Answer

The Syslog data connector in Microsoft Sentinel.

Question 14

Which TWO Azure services can be used to automate response actions in Microsoft Sentinel when an incident is created?

Accepted Answer

Azure Logic Apps. Azure Logic Apps (B) is correct because it provides a native connector for Microsoft Sentinel that enables automated incident response workflows, such as triggering playbooks when an incident is created. Azure Functions (C) is correct because it allows custom code execution in response to Sentinel incidents via HTTP triggers or integration with Azure Automation, enabling complex automation beyond Logic Apps' capabilities.

Answer

Azure Automation

Answer

Azure Event Grid

Answer

Power Automate

Question 15

Refer to the exhibit. You have an automation rule defined as shown. The rule is enabled but never triggers. What is the most likely reason?

Accepted Answer

The condition requires incident status 'Active', but incidents start as 'New'.. The automation rule triggers on incident creation, but the condition requires the incident status to be 'Active'. In Microsoft Sentinel, incidents are created with a status of 'New', not 'Active'. Therefore, the condition is never met, and the rule never triggers. To fix this, the condition should either be removed or changed to include 'New' status.

Answer

The playbook resource ID is incomplete.

Answer

The trigger type should be 'AlertCreated' instead of 'IncidentCreated'.

Answer

The rule order is set to 1, which is too low.