SC-200 Manage a security operations environment Practice Test 8 — 15 Questions

Question 1

Your organization uses Microsoft Defender for Cloud to monitor hybrid workloads. You need to ensure that security alerts from on-premises servers running Windows Server 2022 are forwarded to Microsoft Sentinel. The servers are not yet onboarded to Azure Arc. What should you do first?

Accepted Answer

Onboard the servers to Azure Arc and enable Defender for Cloud.. On-premises servers must first be onboarded to Azure Arc to establish a management identity and connectivity with Azure. Without Azure Arc, Defender for Cloud cannot apply its security policies or forward alerts to Microsoft Sentinel. Enabling Defender for Cloud on the servers after Arc onboarding allows security alerts to be collected and forwarded to Sentinel.

Answer

Install the Azure Monitor Agent on the servers.

Answer

Deploy Azure Policy to enable Defender for Cloud on the servers.

Answer

Install Microsoft Defender for Endpoint on the servers.

Question 2

You are managing a Microsoft Sentinel environment with multiple workspaces across different regions. You need to centralize incident management and allow security analysts to triage incidents from all workspaces in a single view. What should you configure?

Accepted Answer

Configure a central Microsoft Sentinel workspace with cross-workspace analytics rules.. Option A is correct because cross-workspace analytics rules in Microsoft Sentinel allow you to define a single analytics rule that queries multiple workspaces, enabling centralized incident creation and management. This configuration ensures that security analysts can view and triage incidents from all workspaces in a single Microsoft Sentinel instance, without needing to switch between different workspace blades.

Answer

Create a workbook that queries all workspaces.

Answer

Use the Microsoft Sentinel SIEM Migration experience.

Answer

Use Azure Lighthouse to manage all workspaces from a single pane of glass.

Question 3

Your Microsoft Sentinel workspace has a Microsoft 365 Defender connector configured. You notice that incidents are being created from Microsoft Defender for Office 365 alerts, but not from Microsoft Defender for Identity alerts. What should you check?

Accepted Answer

Enable the Microsoft Defender for Identity alert streaming in the connector configuration.. Option D is correct because Microsoft Defender for Identity alert streaming must be enabled in the Microsoft 365 Defender connector configuration. Option A is wrong because the connector is already configured; the issue is selective alert streaming. Option B is wrong because licensing for Identity is required but the question implies it's enabled. Option C is wrong because correlation rules in Defender XDR affect incident creation from alerts, but the connector separately streams alerts.

Answer

Verify that the Microsoft 365 Defender connector is connected.

Answer

Ensure you have licenses for Microsoft Defender for Identity.

Answer

Check the incident correlation rules in Microsoft Defender XDR.

Question 4

Your organization uses Microsoft Sentinel with Azure Monitor Agent (AMA) to collect Windows security events. You need to collect process creation events (Event ID 4688) and include command-line information. The current Data Collection Rule (DCR) collects only basic security events. What should you modify?

Accepted Answer

Enable the 'Include command line in process creation events' policy in Windows Group Policy.. Option B is correct because Event ID 4688 (process creation) can include command-line arguments, but this data is not captured by default. The 'Include command line in process creation events' Group Policy setting must be enabled on the Windows machines to populate the CommandLine field in the security event log. Without this policy, the AMA and DCR will collect the event but the command-line information will be empty.

Answer

Upgrade the AMA to the latest version.

Answer

Modify the DCR to include Event ID 4688 in the data source.

Answer

Switch to the Windows Security Events via Legacy Agent connector.

Question 5

You are configuring automated responses in Microsoft Sentinel. You have created an automation rule that runs a playbook when an incident is created. The playbook performs actions in Microsoft Entra ID and Microsoft Defender for Cloud. However, the playbook fails with a permissions error. What should you do?

Accepted Answer

Assign the managed identity of the playbook the required roles in Microsoft Entra ID and Defender for Cloud.. The playbook fails with a permissions error because it uses a managed identity to authenticate to Microsoft Entra ID and Microsoft Defender for Cloud, but that identity has not been granted the necessary Azure RBAC roles (e.g., Security Reader, Security Admin) on the target resources. Assigning the required roles to the managed identity directly resolves the authorization failure.

Answer

Enable 'Allow playbooks to use managed identity' in the Sentinel settings.

Answer

Configure the Microsoft Entra ID connector in Sentinel with delegated permissions.

Answer

Grant the security analyst's account Contributor permissions on the automation rule.

Question 6

You need to ensure that critical incidents in Microsoft Sentinel are automatically assigned to a senior security analyst. What should you configure?

Accepted Answer

Create an automation rule that assigns the incident to the analyst.. Automation rules in Microsoft Sentinel allow you to automatically assign incidents to specific users or groups based on conditions like severity or title. By creating an automation rule that triggers on incident creation and sets the owner to the senior security analyst, you ensure critical incidents are assigned without manual intervention.

Answer

Create an analytics rule with a custom schedule.

Answer

Configure a workbook to filter incidents by owner.

Answer

Add the analyst to a watchlist used in analytics rules.

Question 7

Which TWO actions should you take to reduce the cost of Microsoft Sentinel while maintaining security coverage?

Accepted Answer

Reduce the retention period of tables that do not require long-term storage.. Option B is correct because reducing the retention period for tables that do not require long-term storage directly lowers the data storage costs in Microsoft Sentinel. Sentinel charges per GB of data stored, and by shortening retention (e.g., from 90 days to 30 days) for non-critical tables, you reduce the volume of data retained without affecting security monitoring or incident investigation for the shortened period.

Answer

Remove data connectors for non-critical sources.

Answer

Disable analytics rules that generate low-severity incidents.

Answer

Switch the workspace pricing tier from Capacity Reservations to Pay-as-you-Go.

Question 8

Which THREE components are required to collect syslog messages from a network appliance into Microsoft Sentinel using the Azure Monitor Agent?

Accepted Answer

A syslog daemon (e.g., rsyslog) on the log collector server to receive messages.. Option A is correct because syslog messages are sent over UDP (or TCP) by network appliances, and a syslog daemon like rsyslog must be running on the log collector server to listen on port 514 (or a custom port) and receive those messages. Without this daemon, the Azure Monitor Agent cannot ingest the raw syslog data, as the agent relies on the local syslog daemon to capture and forward the logs to its event pipeline.

Answer

The Log Analytics agent (MMA) installed on the appliance.

Answer

The Syslog data connector in Microsoft Sentinel.

Question 9

Which TWO Azure services can be used to automate response actions in Microsoft Sentinel when an incident is created?

Accepted Answer

Azure Logic Apps. Azure Logic Apps (B) is correct because it provides a native connector for Microsoft Sentinel that enables automated incident response workflows, such as triggering playbooks when an incident is created. Azure Functions (C) is correct because it allows custom code execution in response to Sentinel incidents via HTTP triggers or integration with Azure Automation, enabling complex automation beyond Logic Apps' capabilities.

Answer

Azure Automation

Answer

Azure Event Grid

Answer

Power Automate

Question 10

Refer to the exhibit. You have an automation rule defined as shown. The rule is enabled but never triggers. What is the most likely reason?

Accepted Answer

The condition requires incident status 'Active', but incidents start as 'New'.. The automation rule triggers on incident creation, but the condition requires the incident status to be 'Active'. In Microsoft Sentinel, incidents are created with a status of 'New', not 'Active'. Therefore, the condition is never met, and the rule never triggers. To fix this, the condition should either be removed or changed to include 'New' status.

Answer

The playbook resource ID is incomplete.

Answer

The trigger type should be 'AlertCreated' instead of 'IncidentCreated'.

Answer

The rule order is set to 1, which is too low.

Question 11

Refer to the exhibit. You are analyzing a KQL query in Microsoft Sentinel. The query returns no results even though you know there are alerts with the name 'Malware detected'. What is the most likely issue?

Accepted Answer

The operator 'mv-expand' should be lowercase 'mv-expand'.. The `mv-expand` operator in KQL is case-sensitive and must be written in lowercase. Using uppercase `MV-Expand` or any other casing causes KQL to treat it as an unrecognized command, resulting in a syntax error or no results. Since the query returns no results despite alerts existing, the most likely issue is the incorrect casing of the operator.

Answer

The 'project' operator should be 'project-away'.

Answer

The 'Entities' column might be null for these alerts.

Answer

The function 'parse_json' should be 'parse_json()' with parentheses.

Question 12

Refer to the exhibit. You deploy this ARM template to your subscription. After deployment, you cannot find the saved search 'Test Search' in the Microsoft Sentinel workspace. What is the most likely reason?

Accepted Answer

The resource type should be for analytics rules, not saved searches.. Option A is correct because the ARM template deploys a resource of type 'Microsoft.OperationsManagement/solutions' with a saved search, but Microsoft Sentinel does not use saved searches for analytics rules. In Sentinel, detection rules are created as 'Microsoft.SecurityInsights/alertRules', not as saved searches under a Log Analytics workspace. The template's resource type is mismatched for the intended functionality, so the saved search 'Test Search' will not appear as a Sentinel analytics rule.

Answer

The query 'Heartbeat | summarize Count() by Computer' is invalid.

Answer

The apiVersion is incorrect.

Answer

The name concatenation is missing a parameter.

Question 13

Your security team is investigating an incident in Microsoft Defender XDR where a user received multiple phishing emails. The team needs to create an automated response that blocks the sender's email address across all mailboxes in the organization. Which action should you configure in an automated investigation and response (AIR) playbook?

Accepted Answer

Add a 'Block sender' action in Microsoft Defender for Office 365.. Option C is correct because blocking a sender's email address across all mailboxes is a native capability of Microsoft Defender for Office 365. The 'Block sender' action in an AIR playbook directly adds the sender to the tenant's block list, which is enforced at the transport layer for all inbound email, effectively preventing any further delivery from that address.

Answer

Add a 'Block IP address' action in Microsoft Defender for Cloud Apps.

Answer

Create a custom detection rule in Microsoft Sentinel.

Answer

Deploy a configuration profile in Microsoft Intune.

Question 14

You are configuring a Microsoft Sentinel analytics rule to detect failed logons from multiple IP addresses. The rule should trigger an incident only when the same user account has failed logons from more than three distinct IP addresses within 5 minutes. Which rule setting should you configure?

Accepted Answer

Set the 'Alert threshold' to 'Custom' and define a condition on distinct IP count.. Option A is correct because the requirement is to trigger an incident only when the same user account has failed logons from more than three distinct IP addresses within 5 minutes. In Microsoft Sentinel analytics rules, the 'Alert threshold' set to 'Custom' allows you to define a condition on the count of distinct values (e.g., distinct IP addresses) aggregated over the rule's query window, which directly matches the scenario.

Answer

Set the 'Group by' field to 'Account' and 'IP address'.

Answer

Set the 'Event grouping' to 'Group all events into a single alert'.

Answer

Set the 'Suppression' to '5 minutes' after an alert is generated.

Question 15

Your organization uses Microsoft Defender XDR and has a custom detection rule that queries DeviceProcessEvents for suspicious PowerShell commands. You notice that the rule is generating a high number of false positives. You need to reduce false positives while still detecting real threats. What should you do?

Accepted Answer

Add a condition to exclude processes signed by trusted certificates or from known IT admin accounts.. Option A is correct because adding a condition to exclude processes signed by trusted certificates or from known IT admin accounts directly reduces false positives by filtering out legitimate administrative activity. Custom detection rules in Microsoft Defender XDR allow you to refine queries with additional conditions, such as excluding specific signers or accounts, which preserves detection of malicious PowerShell commands while ignoring benign ones.

Answer

Disable the rule and create a new rule with a different MITRE technique.

Answer

Increase the lookback period from 7 to 30 days.

Answer

Modify the rule to set the severity to 'Informational'.