SC-200 Manage a security operations environment Practice Test 7 — 15 Questions

Question 1

Your organization uses Microsoft Sentinel and you have configured a fusion analytics rule for advanced multistage attack detection. You notice that the rule is generating a high number of false positives. What should you do to reduce the false positives without disabling the rule?

Accepted Answer

Add entity exclusions to the fusion rule configuration. Option C is correct because fusion rules support tuning by excluding specific entities or alert types. Option A is wrong because disabling the rule is not desired. Option B is wrong because reducing severity does not reduce false positives. Option D is wrong because the fusion rule is a built-in rule; it cannot be edited for conditions.

Answer

Disable the fusion rule and create custom analytics rules

Answer

Modify the fusion rule’s incident creation conditions

Answer

Reduce the severity threshold for the fusion rule

Question 2

Your organization uses Microsoft Defender XDR and you are configuring attack surface reduction (ASR) rules. You need to implement a rule that blocks executable files from running unless they meet a prevalence, age, or trusted list criterion. Which ASR rule should you enable?

Accepted Answer

Block executable files from running unless they meet a prevalence, age, or trusted list criterion. Option D is correct because the ASR rule 'Block executable files from running unless they meet a prevalence, age, or trusted list criterion' (GUID: 01443614-cd74-433a-b99e-2ecdc07bfc25) is specifically designed to prevent executable files (e.g., .exe, .dll, .scr) from running unless they have been seen in the organization (prevalence), are old enough (age), or are on a trusted list. This rule uses cloud-delivered protection and Microsoft's reputation-based intelligence to evaluate files before execution, directly matching the requirement described in the question.

Answer

Block untrusted and unsigned processes that run from USB

Answer

Block Office applications from creating executable content

Answer

Block credential stealing from the Windows local security authority subsystem (lsass.exe)

Question 3

Your organization uses Microsoft Sentinel and you need to ensure that incidents are automatically closed when a related playbook completes successfully. What should you configure?

Accepted Answer

Create an automation rule that triggers after the playbook runs and closes the incident. Option C is correct because automation rules can have conditions and actions, including closing an incident after a playbook runs. Option A is wrong because playbooks can close incidents but the automation rule triggers the playbook and can close the incident. Option B is wrong because analytics rules create incidents, not close them. Option D is wrong because workbooks are for visualization.

Answer

Add a 'Close incident' action in the playbook

Answer

Configure the analytics rule to close incidents automatically

Answer

Use a workbook to manually close incidents

Question 4

Your organization uses Microsoft Defender for Cloud and you need to ensure that security recommendations are automatically remediated for non-compliant resources. You have enabled 'Auto provisioning' for the Log Analytics agent. What additional step is required to enable automatic remediation?

Accepted Answer

Enable the 'DeployIfNotExists' policy for specific recommendations. Option C is correct because enabling 'Auto provisioning' for the Log Analytics agent only ensures the agent is installed on VMs, but does not automatically remediate security recommendations. To achieve automatic remediation, you must enable the 'DeployIfNotExists' effect on specific Azure Policy definitions (e.g., 'System updates should be installed on your machines'), which triggers remediation tasks when resources are non-compliant. This is a separate step in Defender for Cloud's 'Security policy' blade under 'Settings & monitoring'.

Answer

No additional step is required; auto provisioning automatically remediates

Answer

Configure manual remediation in Defender for Cloud

Answer

Create a custom Azure Policy initiative with audit effect

Question 5

Your organization uses Microsoft Purview Compliance Manager to manage compliance activities. You need to assign a specific improvement action to a colleague for implementation. What should you do?

Accepted Answer

In the 'Improvement actions' tab, select the action and click 'Assign'. In Microsoft Purview Compliance Manager, improvement actions are the specific tasks that need to be completed to meet compliance controls. Each improvement action can be directly assigned to a colleague by selecting the action in the 'Improvement actions' tab and clicking the 'Assign' button, which allows you to specify the assignee and due date. This is the intended workflow for delegating implementation responsibilities within Compliance Manager.

Answer

Create a new alert policy to notify the colleague

Answer

Modify the assessment to include the colleague as an owner

Answer

Use the 'Assessments' tab to delegate tasks

Question 6

Your organization uses Microsoft Sentinel and you have a playbook that sends an email notification when a high-severity incident is created. You want to ensure that the playbook only runs for incidents that are not already assigned to a user. What should you configure?

Accepted Answer

Configure the automation rule trigger to include a condition for 'Incident owner equals null'. Option C is correct because automation rules in Microsoft Sentinel can include conditions that filter which incidents trigger a playbook. By configuring the automation rule with a condition for 'Incident owner equals null', the playbook will only run for incidents that are unassigned, ensuring that already assigned incidents are not processed. This approach is efficient and avoids unnecessary execution of the playbook.

Answer

Set the playbook trigger to 'When an incident is created' and add a condition inside

Answer

Add a condition in the playbook to check if the incident is assigned

Answer

Modify the analytics rule to only generate unassigned incidents

Question 7

Which TWO actions should you take to ensure that Microsoft Sentinel can properly ingest logs from a Linux server running rsyslog? (Choose two.)

Accepted Answer

Install the Log Analytics agent (or Azure Monitor Agent) on the Linux server. Option C is correct because the Log Analytics agent (or Azure Monitor Agent) must be installed on the Linux server to receive and forward syslog data to Microsoft Sentinel. Without the agent, Sentinel has no direct mechanism to collect logs from the server. The agent listens for syslog messages forwarded by rsyslog and then sends them to the Log Analytics workspace.

Answer

Install and configure syslog-ng instead of rsyslog

Answer

Configure rsyslog to forward logs to the agent on TCP 514

Answer

Configure Windows Event Forwarding (WEF) to collect logs from the Linux server

Question 8

Which THREE features are available in Microsoft Defender XDR to help automate incident response? (Choose three.)

Accepted Answer

Automated investigation and response (AIR). Automated investigation and response (AIR) in Microsoft Defender XDR automatically runs playbooks on alerts to investigate and remediate threats without manual intervention. It leverages machine learning and security signals across endpoints, email, and identities to contain malicious activity, such as isolating a compromised device or blocking a malicious file, directly within the incident response workflow.

Answer

Microsoft Power Automate

Answer

Microsoft Sentinel fusion rule

Question 9

Which TWO are valid methods to connect a non-Azure Windows server to Microsoft Sentinel? (Choose two.)

Accepted Answer

Install the Azure Monitor Agent (AMA). Option A is correct because the Azure Monitor Agent (AMA) is the current, recommended agent for collecting data from non-Azure Windows servers and sending it to Microsoft Sentinel. It replaces the older Log Analytics agent and supports data collection via Data Collection Rules (DCRs), which allow granular control over which events and performance counters are ingested. Option D is correct because the Log Analytics agent (MMA) was the original method to connect Windows servers to Sentinel, and while it is being phased out in favor of AMA, it remains a valid supported method for existing deployments.

Answer

Install the Azure Security Center agent

Answer

Configure Windows Event Forwarding (WEF) and point it to Sentinel

Answer

Configure the server to forward syslog to Sentinel

Question 10

Refer to the exhibit. You are reviewing an Azure Security Center automation (now Microsoft Defender for Cloud) that should automatically trigger a Logic App when an alert is generated. However, the automation is not triggering. What is the most likely cause?

Accepted Answer

The automation is missing the 'triggers' property to filter on specific alert types. Option D is correct because Microsoft Defender for Cloud automation requires a 'triggers' property to define which alert types should invoke the Logic App. Without this property, the automation is created but never fires, as it has no conditions to match incoming alerts. The exhibit shows the automation resource is configured, but missing the triggers array means no alerts will trigger the Logic App.

Answer

The action type is incorrect; it should be 'EventHub'

Answer

The logicAppResourceId is missing

Answer

The apiVersion is invalid

Question 11

Refer to the exhibit. You are analyzing a KQL query in Microsoft Sentinel that returns accounts with more than 10 failed logins within 5 minutes. The query is not returning any results even though you know there have been multiple failed logins. What is the most likely reason?

Accepted Answer

The filter condition 'Account !startswith "ANONYMOUS LOGON"' is case-sensitive and may be excluding valid results. Option D is correct because the `!startswith` operator in KQL is case-sensitive by default. If the actual account name in the SecurityEvent table is stored as 'ANONYMOUS LOGON' with a different case (e.g., 'Anonymous Logon' or 'anonymous logon'), the filter will exclude those rows, causing the query to return no results even though failed logins occurred. This is a common pitfall when using string comparison operators in KQL without considering case sensitivity.

Answer

The 'startswith' operator is not a valid KQL operator

Answer

The 'bin' function is used incorrectly

Answer

The query syntax requires a 'let' statement

Question 12

Refer to the exhibit. You are reviewing a custom Azure Policy definition that should block deployments from specific IP addresses. However, the policy does not seem to be evaluating any resources. What is the most likely issue?

Accepted Answer

The policy definition has not been assigned to any scope. The exhibit shows a custom Azure Policy definition that is syntactically correct, but the policy is not evaluating any resources. The most likely cause is that the policy definition has not been assigned to a scope (e.g., management group, subscription, or resource group). In Azure Policy, a definition alone does nothing; it must be assigned to a scope to take effect and begin evaluating resources.

Answer

The 'in' operator cannot be used with an array parameter

Answer

The policy mode should be 'Indexed' for network policies

Answer

The 'effect' should be 'audit' instead of 'deny'

Question 13

Your organization has a Microsoft Sentinel workspace that ingests logs from Azure resources, Microsoft 365, and third-party firewalls. You need to ensure that data retention for Azure Activity logs complies with a regulatory requirement of 3 years, while keeping costs low for other data types. What should you do?

Accepted Answer

Configure a data retention policy on the AzureActivity table to 3 years.. Option C is correct because Azure Sentinel allows you to configure a custom retention policy on a specific table (e.g., AzureActivity) to retain data for up to 2 years (or longer with Archive tier) independently of the workspace's default retention. This meets the 3-year regulatory requirement for Azure Activity logs without increasing retention costs for other data types, as the workspace default can remain shorter.

Answer

Use the Archive tier for Azure Activity logs and set the total retention period to 3 years.

Answer

Set the workspace retention to 3 years.

Answer

Enable Basic Logs plan on the AzureActivity table.

Question 14

Your security team uses Microsoft Defender XDR (formerly Microsoft 365 Defender) to investigate incidents. You notice that some alerts from Microsoft Defender for Endpoint are not being automatically correlated into incidents as expected. You have confirmed that the relevant alert sources are enabled in the Microsoft Defender XDR portal. What is the most likely cause?

Accepted Answer

Incident correlation rules are not enabled for the relevant alert sources.. Microsoft Defender XDR uses built-in correlation logic to automatically group related alerts from different sources (e.g., Defender for Endpoint, Defender for Office 365) into incidents. If alerts from a specific source, such as Defender for Endpoint, are not being correlated, the most likely cause is that the incident correlation rules for that source are not enabled in the Microsoft Defender XDR portal. Enabling the alert source alone is insufficient; the correlation engine must be explicitly activated for each source to aggregate alerts into incidents.

Answer

Alert tuning rules are causing the alerts to be excluded.

Answer

Automation rules in Microsoft Sentinel are deleting the alerts.

Answer

Alert suppression rules are blocking the alerts.

Question 15

You are configuring Microsoft Sentinel to ingest syslog data from a network appliance. After configuring the data connector, you notice that no data is appearing in the CommonSecurityLog table. The syslog server is sending data to the Azure Monitor Agent (AMA) on the log collector. What should you verify first?

Accepted Answer

Verify that a Data Collection Rule is defined to collect the syslog facilities.. The Azure Monitor Agent (AMA) requires a Data Collection Rule (DCR) to specify which syslog facilities and severity levels to collect. Without a DCR, the AMA will not forward syslog data to the CommonSecurityLog table, even if the syslog server is sending data to the collector. This is the most common missing configuration step after setting up the data connector.

Answer

Check the Heartbeat table for the log collector.

Answer

Ensure the syslog appliance can reach the collector on UDP port 514.

Answer

Check the data connector health status in Sentinel.