SC-200 Manage a security operations environment Practice Test 8 — 15 Questions

Question 1

Refer to the exhibit. You are analyzing a KQL query in Microsoft Sentinel. The query returns no results even though you know there are alerts with the name 'Malware detected'. What is the most likely issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The operator 'mv-expand' should be lowercase 'mv-expand'.. The `mv-expand` operator in KQL is case-sensitive and must be written in lowercase. Using uppercase `MV-Expand` or any other casing causes KQL to treat it as an unrecognized command, resulting in a syntax error or no results. Since the query returns no results despite alerts existing, the most likely issue is the incorrect casing of the operator.

Answer

The 'project' operator should be 'project-away'.

Answer

The 'Entities' column might be null for these alerts.

Answer

The function 'parse_json' should be 'parse_json()' with parentheses.

Question 2

Refer to the exhibit. You deploy this ARM template to your subscription. After deployment, you cannot find the saved search 'Test Search' in the Microsoft Sentinel workspace. What is the most likely reason?

Accepted Answer

The resource type should be for analytics rules, not saved searches.. The ARM template deploys a resource of type 'Microsoft.OperationsManagement/solutions' with a saved search, but Microsoft Sentinel does not use saved searches for analytics rules. In Sentinel, detection rules are created as 'Microsoft.SecurityInsights/alertRules', not as saved searches under a Log Analytics workspace. The template's resource type is mismatched for the intended functionality, so the saved search 'Test Search' will not appear as a Sentinel analytics rule.

Answer

The query 'Heartbeat | summarize Count() by Computer' is invalid.

Answer

The apiVersion is incorrect.

Answer

The name concatenation is missing a parameter.

Question 3

Your security team is investigating an incident in Microsoft Defender XDR where a user received multiple phishing emails. The team needs to create an automated response that blocks the sender's email address across all mailboxes in the organization. Which action should you configure in an automated investigation and response (AIR) playbook?

Accepted Answer

Add a 'Block sender' action in Microsoft Defender for Office 365.. Blocking a sender's email address across all mailboxes is a native capability of Microsoft Defender for Office 365. The 'Block sender' action in an AIR playbook directly adds the sender to the tenant's block list, which is enforced at the transport layer for all inbound email, effectively preventing any further delivery from that address.

Answer

Add a 'Block IP address' action in Microsoft Defender for Cloud Apps.

Answer

Create a custom detection rule in Microsoft Sentinel.

Answer

Deploy a configuration profile in Microsoft Intune.

Question 4

You are configuring a Microsoft Sentinel analytics rule to detect failed logons from multiple IP addresses. The rule should trigger an incident only when the same user account has failed logons from more than three distinct IP addresses within 5 minutes. Which rule setting should you configure?

Accepted Answer

Set the 'Alert threshold' to 'Custom' and define a condition on distinct IP count.. The requirement is to trigger an incident only when the same user account has failed logons from more than three distinct IP addresses within 5 minutes. In Microsoft Sentinel analytics rules, the 'Alert threshold' set to 'Custom' allows you to define a condition on the count of distinct values (e.g., distinct IP addresses) aggregated over the rule's query window, which directly matches the scenario.

Answer

Set the 'Group by' field to 'Account' and 'IP address'.

Answer

Set the 'Event grouping' to 'Group all events into a single alert'.

Answer

Set the 'Suppression' to '5 minutes' after an alert is generated.

Question 5

Your organization uses Microsoft Defender XDR and has a custom detection rule that queries DeviceProcessEvents for suspicious PowerShell commands. You notice that the rule is generating a high number of false positives. You need to reduce false positives while still detecting real threats. What should you do?

Accepted Answer

Add a condition to exclude processes signed by trusted certificates or from known IT admin accounts.. Adding a condition to exclude processes signed by trusted certificates or from known IT admin accounts directly reduces false positives by filtering out legitimate administrative activity. Custom detection rules in Microsoft Defender XDR allow you to refine queries with additional conditions, such as excluding specific signers or accounts, which preserves detection of malicious PowerShell commands while ignoring benign ones.

Answer

Disable the rule and create a new rule with a different MITRE technique.

Answer

Increase the lookback period from 7 to 30 days.

Answer

Modify the rule to set the severity to 'Informational'.

Question 6

Your team uses Microsoft Sentinel to monitor Azure subscriptions. You need to ensure that only users with the 'Microsoft Sentinel Contributor' role can create and edit analytics rules. You want to enforce this using Azure Policy. What should you do?

Accepted Answer

Create an Azure Policy that denies creation of analytics rules if the user doesn't have the 'Microsoft Sentinel Contributor' role.. Azure Policy can enforce guardrails by denying resource creation or modification based on conditions, such as the user's role. By creating a policy that denies the creation or editing of analytics rules unless the user has the 'Microsoft Sentinel Contributor' role, you directly enforce the requirement. This approach uses Azure Policy's 'deny' effect to prevent unauthorized actions at the Azure Resource Manager level, regardless of other permissions.

Answer

Use Azure Blueprints to assign the 'Microsoft Sentinel Contributor' role to a security group.

Answer

Assign the 'Microsoft Sentinel Contributor' role to all users at the subscription level.

Answer

Create a custom role that denies write access to analytics rules.

Question 7

You are setting up Microsoft Sentinel for the first time. You need to ingest Windows security events from on-premises servers using the Azure Monitor Agent. Which data connector should you enable in Microsoft Sentinel?

Accepted Answer

Windows Security Events via AMA. The Windows Security Events via AMA data connector is specifically designed to collect Windows security events (e.g., Event ID 4625, 4688) from on-premises servers using the Azure Monitor Agent (AMA). This connector leverages the AMA's Data Collection Rules (DCRs) to filter and ingest security-relevant logs directly into Microsoft Sentinel, making it the correct choice for this scenario.

Answer

Common Event Format (CEF) via AMA

Answer

Syslog via AMA

Answer

DNS via AMA

Question 8

Your security team uses Microsoft Defender XDR to investigate a potential malware outbreak. You need to collect a full memory dump from an affected Windows 10 device for forensic analysis. Which action should you take from the Microsoft Defender XDR portal?

Accepted Answer

Initiate a 'Collect investigation package' action.. To collect a full memory dump for forensic analysis from a Windows 10 device during a potential malware outbreak, you must initiate a 'Collect investigation package' action from the Microsoft Defender XDR portal. This action gathers a comprehensive set of forensic data, including a full memory dump, event logs, registry hives, and other artifacts, which is essential for deep analysis of malware behavior and persistence mechanisms.

Answer

Isolate the device from the network.

Answer

Run a full antivirus scan on the device.

Answer

Restrict app execution on the device.

Question 9

You are configuring Microsoft Sentinel to send email notifications to the security team when high-severity incidents are created. Which feature should you use?

Accepted Answer

Automation rule. Automation rules in Microsoft Sentinel allow you to define automated responses to incidents, including sending email notifications to specified recipients when incidents meet certain criteria, such as high severity. This feature directly supports the requirement to notify the security team when high-severity incidents are created, without requiring additional logic or manual steps.

Answer

Watchlist

Answer

Analytics rule

Answer

Workbook

Question 10

Your organization uses Microsoft Defender for Cloud Apps to monitor SaaS applications. You discover that a user is downloading a large number of files from SharePoint Online to an unmanaged device. You need to automatically block the download and require the user to acknowledge a policy violation. Which action should you configure in a session policy?

Accepted Answer

Set the action to 'Block' and enable 'Notify user' with a customized message.. A session policy in Microsoft Defender for Cloud Apps can enforce real-time controls on SaaS app traffic. Setting the action to 'Block' stops the download immediately, and enabling 'Notify user' with a customized message both blocks the action and requires the user to acknowledge the policy violation, satisfying the requirement to automatically block and obtain acknowledgment.

Answer

Set the action to 'Monitor only'.

Answer

Set the action to 'Redirect to Microsoft Entra ID conditional access'.

Answer

Set the action to 'Block' and enable 'Custom block message'.

Question 11

Which TWO actions are valid ways to integrate on-premises firewall logs into Microsoft Sentinel for analysis?

Accepted Answer

Configure the firewall to send Common Event Format (CEF) logs to a syslog server running Azure Monitor Agent.. On-premises firewall logs can be forwarded in Common Event Format (CEF) over syslog to a server running the Azure Monitor Agent (AMA), which then ingests them into Microsoft Sentinel. CEF is a standard log format supported by many security appliances, and the AMA replaces the older Log Analytics Agent for this purpose. This setup allows Sentinel to parse and analyze the firewall events for security monitoring.

Answer

Enable the Office 365 connector.

Answer

Install the Windows DNS Server connector.

Answer

Connect the Azure Activity log connector.

Question 12

Which THREE components are required to implement a threat intelligence feed in Microsoft Sentinel using the Threat Intelligence - TAXII data connector?

Accepted Answer

Root collection ID. The root collection ID is a required component for the Threat Intelligence - TAXII data connector because it identifies the specific collection of threat indicators on the TAXII server. Without this ID, Microsoft Sentinel cannot determine which set of indicators to ingest, as a single TAXII server may host multiple collections. The connector uses the root collection ID to query the correct STIX/TAXII endpoint and retrieve the relevant threat intelligence feed.

Answer

A Log Analytics workspace with Microsoft Sentinel enabled

Answer

A watchlist named 'ThreatIntelligenceIndicators'

Question 13

Which TWO actions can a Microsoft Sentinel automation rule perform when an incident is created?

Accepted Answer

Run a playbook. Microsoft Sentinel automation rules can trigger actions when an incident is created, including running a playbook (Option C) and changing the incident severity (Option D). Playbooks are automated workflows based on Azure Logic Apps that can perform complex response actions, while severity changes allow dynamic triage based on incident properties.

Answer

Create a new analytics rule

Answer

Query Log Analytics workspaces

Answer

Ingest data from a new source

Question 14

Refer to the exhibit. You are reviewing a Microsoft Sentinel scheduled analytics rule defined in JSON. The rule is intended to trigger an incident when more than 5 sign-ins from anomalous locations occur within an hour. However, the rule is not triggering as expected. What is the most likely cause?

Accepted Answer

The query references a column that does not exist in the SigninLogs table.. The query references a column that does not exist in the SigninLogs table. In Microsoft Sentinel, if a scheduled analytics rule's KQL query references a non-existent column, the query will fail silently or return no results, preventing the rule from triggering an incident. The rule logic depends on the query returning a result set that meets the trigger threshold, and a missing column causes the query to fail or return zero rows.

Answer

The severity is set to 'Medium', but it must be an integer.

Answer

The triggerThreshold is set to 5, but it should be a string like '5'.

Answer

The queryFrequency and queryPeriod are set to the same value, which is not allowed.

Question 15

Refer to the exhibit. You are analyzing a KQL query in Microsoft Sentinel. The query returns no results even though you know there are alerts with the name 'Malware detected'. What is the most likely issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The 'extend' line uses a column that does not exist in the DeviceProcessEvents schema.. The 'extend' line references a column named 'ParentProcessFileName' that does not exist in the DeviceProcessEvents schema. The actual column is 'InitiatingProcessFileName' (or 'ParentProcessName' in some schemas). Since the column doesn't exist, the 'extend' operation fails silently or produces null values, causing the subsequent 'summarize' to group by null and return no results.

Answer

The 'extend' line creates a new column that is not used in the subsequent summarize, causing the query to not group by parent process as intended.

Answer

The 'summarize' operator cannot be used with 'count()' in this context.

Answer

The 'where' clause filters out all events because the FileName list is incorrect.