SC-200 Manage a security operations environment Practice Test 9 — 15 Questions

Question 1

Refer to the exhibit. You are reviewing an Azure Policy definition intended to block malicious IPs by denying the creation of network security group rules that allow traffic from a list of blocked IPs. However, the policy is not working as expected. What is the most likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The policy rule does not evaluate the source IP address; it denies all security rules.. The policy rule in the exhibit uses the 'sourceAddressPrefix' condition with the parameter 'listOfBlockedIPs', but it does not include a condition to evaluate the 'sourcePortRange' or 'destinationAddressPrefix'. More critically, the rule denies all security rules regardless of the source IP because the condition logic is flawed: it denies if the source IP is in the blocked list, but it does not also check that the rule is allowing traffic (e.g., direction 'Inbound' and access 'Allow'). Without these additional conditions, the policy incorrectly denies all NSG rules, including those that are not allowing traffic from blocked IPs.

Answer

The policy mode is incorrect; it should be 'All' instead of 'Microsoft.Network/virtualNetworks'.

Answer

The parameter 'listOfBlockedIPs' is not used in the policy rule.

Answer

The effect 'deny' is not supported for this resource type.

Question 2

A SOC analyst receives a high-severity alert for a user who downloaded a malicious file from a phishing email. The analyst needs to quickly assess the scope of the incident across endpoints, email, and identities. Which Microsoft Defender XDR feature should the analyst use to get a unified view of the incident?

Accepted Answer

Microsoft Defender XDR incident queue. The Microsoft Defender XDR incident queue is the correct choice because it aggregates alerts from Microsoft Defender for Endpoint, Office 365, and Identity into a single incident view, enabling the analyst to correlate the malicious file download across endpoints, email, and user identities without switching consoles. This unified incident management is a core feature of Microsoft Defender XDR, designed specifically for rapid triage and scope assessment in multi-domain threats.

Answer

Microsoft Purview compliance portal

Answer

Microsoft Intune device compliance dashboard

Answer

Microsoft Sentinel incidents blade

Question 3

A SOC manager wants to implement a new workflow where high-severity Microsoft Defender for Cloud Apps alerts are automatically sent to a Teams channel for immediate action. The solution must not require custom code. What should the manager configure?

Accepted Answer

Create an automation rule in Microsoft Sentinel with a playbook that posts to Teams. Microsoft Sentinel's automation rules can trigger a playbook (built on Azure Logic Apps) when a high-severity alert is generated, and the playbook can post a message to a Teams channel without requiring custom code. This directly meets the requirement of automatically sending high-severity Microsoft Defender for Cloud Apps alerts to Teams for immediate action, leveraging built-in connectors.

Answer

Use Microsoft Power Automate to monitor the alerts and send a Teams message

Answer

Configure a rule in Microsoft Defender XDR to send email notifications

Answer

Configure Microsoft Entra ID to send the alerts to Teams

Question 4

Your company uses Microsoft Defender for Endpoint (MDE) and Microsoft Sentinel. You need to ensure that when a device is determined to be compromised, the device is automatically isolated from the network and a Sentinel incident is updated with the isolation status. What is the most efficient way to achieve this?

Accepted Answer

Create a Microsoft Sentinel automation rule with a playbook that isolates the device and updates the incident. It leverages Microsoft Sentinel's automation capabilities to respond to security incidents without manual intervention. By creating an automation rule that triggers a playbook (an Azure Logic Apps workflow), you can automatically isolate a compromised device via Microsoft Defender for Endpoint APIs and simultaneously update the Sentinel incident with the isolation status. This provides the most efficient, end-to-end automated response directly within the security operations workflow.

Answer

Have the SOC analyst manually isolate the device from the MDE console and update the incident in Sentinel

Answer

Configure Microsoft Intune to automatically isolate the device when a compliance policy is violated

Answer

Use Microsoft Defender XDR conditional access to block the device

Question 5

A junior SOC analyst receives multiple low-severity alerts from Microsoft Sentinel. The alerts are related to failed logon attempts from a single IP address over a short period. The analyst wants to group these alerts into a single incident to reduce noise. What should the analyst do?

Accepted Answer

Configure the analytics rule to group alerts into incidents by the IP address. Incident grouping in analytics rules allows merging of alerts into a single incident based on criteria like IP address. Option A is wrong because manually grouping is not scalable. Option C is wrong because the incident queue does not have a built-in grouping feature. Option D is wrong because automation rules do not group alerts; they act on incidents.

Answer

Use the Microsoft Defender XDR incident queue to group the alerts

Answer

Create an automation rule to close duplicate alerts

Answer

Manually merge the alerts into one incident in the Sentinel incidents blade

Question 6

Your organization has deployed Microsoft Sentinel and Microsoft Defender XDR. You need to ensure that all Defender XDR incidents are automatically synchronized into Microsoft Sentinel for a single pane of glass. What should you configure?

Accepted Answer

Enable the Microsoft Sentinel data connector for Microsoft Defender XDR. The Microsoft Sentinel data connector for Microsoft Defender XDR is the native integration that automatically synchronizes all Defender XDR incidents into Sentinel. This connector ingests incidents, alerts, and evidence from Defender XDR into the Sentinel workspace, enabling a single pane of glass without requiring custom scripting or manual workflows.

Answer

Use Microsoft Graph API to sync incidents daily

Answer

Create an automation rule in Microsoft Sentinel to create incidents from Defender XDR alerts

Answer

Configure Microsoft Defender XDR to forward incidents to Sentinel using a webhook

Question 7

A security operations center (SOC) uses Microsoft Sentinel for log management. The SOC manager wants to reduce storage costs by automatically archiving logs that are older than 90 days to long-term retention, but retains the ability to search them if needed. What should the manager configure?

Accepted Answer

Configure a data archiving policy in the Log Analytics workspace to archive logs after 90 days. Configuring a data archiving policy in the Log Analytics workspace automatically moves logs older than 90 days to long-term, low-cost storage while keeping them searchable via the search job or restore feature. This directly meets the SOC manager's requirement to reduce costs without losing the ability to query archived data.

Answer

Change the table plan to Basic Logs for logs older than 90 days

Answer

Create a retention policy that deletes logs older than 90 days

Answer

Export logs older than 90 days to an Azure Storage account

Question 8

Your SOC team uses Microsoft Sentinel incident investigation. An analyst needs to quickly see all related entities (users, IPs, machines) for an incident. Which feature should the analyst use?

Accepted Answer

Incident investigation graph. The Incident investigation graph in Microsoft Sentinel provides a visual, interactive map of all entities (users, IPs, machines) linked to an incident, allowing analysts to quickly see relationships and pivot between entities. This is the dedicated feature for entity-centric incident exploration, unlike other options that serve different purposes.

Answer

Incident timeline

Answer

Hunting blade

Answer

Entity behavior analytics page

Question 9

A SOC analyst suspects a user account is compromised based on anomalous sign-in activity detected by Microsoft Entra ID Protection. The analyst needs to confirm and contain the threat. What is the first action the analyst should take?

Accepted Answer

Review the user's risk level and sign-in logs in Microsoft Entra ID Protection. The first step when investigating a potential account compromise is to review the user's risk level and sign-in logs in Microsoft Entra ID Protection. This allows the analyst to confirm the threat by examining risk detections, sign-in patterns, and contextual details before taking any containment actions. Prematurely resetting passwords or disabling accounts could disrupt legitimate user activity or alert the attacker without a full understanding of the scope.

Answer

Reset the user's password immediately

Answer

Disable the user account in Microsoft Entra ID

Answer

Block the user's sign-in from all locations

Question 10

Which TWO actions can be performed using Microsoft Sentinel automation rules? (Select TWO.)

Accepted Answer

Assign an incident to a specific SOC analyst. Automation rules in Microsoft Sentinel allow you to automate incident management tasks, such as assigning incidents to specific SOC analysts based on criteria like severity or type. This is a core capability of automation rules, which can set the owner of an incident to a specific user or group, enabling efficient triage and accountability.

Answer

Modify a data connector's configuration

Answer

Create a new analytics rule

Answer

Create a new watchlist

Question 11

Which THREE capabilities are provided by Microsoft Sentinel's UEBA (User and Entity Behavior Analytics)? (Select THREE.)

Accepted Answer

Identify users whose behavior deviates from their peers. Microsoft Sentinel's UEBA uses machine learning models to establish a baseline of normal behavior for each user and then compares individual user activity against peer group behavior. When a user's actions deviate significantly from their peers, such as accessing unusual resources or performing atypical data transfers, an anomaly is generated, enabling security analysts to investigate potential insider threats or compromised accounts.

Answer

Automatically run playbooks when anomalies are detected

Answer

Create watchlists for high-value users

Question 12

Which TWO actions can be taken directly from the Microsoft Defender XDR incident queue? (Select TWO.)

Accepted Answer

Isolate a device involved in the incident. The Microsoft Defender XDR incident queue provides direct actions, including device isolation, to contain threats without navigating to separate device management consoles. This capability is built into the incident investigation pane, allowing security analysts to quickly isolate a device involved in an incident from the unified queue.

Answer

Modify a data connector's log collection

Answer

Create a new analytics rule

Answer

Create an automation rule

Question 13

Refer to the exhibit. You are reviewing an automation rule configuration in Microsoft Sentinel. Based on the JSON snippet, what will happen when a high-severity incident is created?

Accepted Answer

The rule will run a playbook when a high-severity incident is created. The automation rule's trigger condition is set to 'When incident is created' and the condition filters for incidents with a severity of 'High'. When a high-severity incident is created, the rule will execute the associated playbook, which is a common use case for automated response in Microsoft Sentinel.

Answer

The rule will change the severity of the incident to Medium

Answer

The rule will assign the incident to the SOC manager

Answer

The rule will run the playbook when a new alert is created

Question 14

Refer to the exhibit. You are investigating a user entity in Microsoft Sentinel. The entity details show a riskLevel of 'high' and riskState 'atRisk'. What does this indicate?

Accepted Answer

The user account has been flagged by Microsoft Entra ID Protection as at risk. The riskLevel of 'high' and riskState of 'atRisk' are specific properties populated by Microsoft Entra ID Protection (formerly Azure AD Identity Protection). These values indicate that the user account has been flagged as risky based on real-time risk detections (e.g., leaked credentials, anonymous IP address, atypical travel). This is not a direct result of a Sentinel analytics rule, nor does it mean the account is disabled or confirmed compromised—it means the identity protection service has detected suspicious activity and assigned a risk level.

Answer

The user account has been disabled

Answer

The user account triggered a Sentinel analytics rule

Answer

The user account has been confirmed compromised

Question 15

Refer to the exhibit. A SOC analyst runs this KQL query in Microsoft Sentinel. What is the purpose of this query?

Accepted Answer

Find users with more than 5 failed sign-ins from an IP address in the last hour. The KQL query filters for events where the result type is 'Failure' (failed sign-ins), then groups by account and IP address, counting occurrences. The `where count_ > 5` clause ensures only accounts with more than 5 failed sign-ins from a single IP are returned, which is a classic indicator of a brute force attack. This directly matches option D.

Answer

Detect brute force attempts by finding users with many failed sign-ins from a single IP

Answer

List all successful sign-ins in the last hour

Answer

Identify users who successfully signed in from multiple IPs