SC-200 Manage a security operations environment Practice Test 9 — 15 Questions

Question 1

Your team uses Microsoft Sentinel to monitor Azure subscriptions. You need to ensure that only users with the 'Microsoft Sentinel Contributor' role can create and edit analytics rules. You want to enforce this using Azure Policy. What should you do?

Accepted Answer

Create an Azure Policy that denies creation of analytics rules if the user doesn't have the 'Microsoft Sentinel Contributor' role.. The correct answer is C because Azure Policy can audit or deny role assignments that do not match the allowed roles. Option A is incorrect because RBAC is not enforced by Azure Policy. Option B is incorrect because Azure Policy does not directly manage RBAC. Option D is incorrect because Azure Blueprints are for deploying environments, not enforcing RBAC.

Answer

Use Azure Blueprints to assign the 'Microsoft Sentinel Contributor' role to a security group.

Answer

Assign the 'Microsoft Sentinel Contributor' role to all users at the subscription level.

Answer

Create a custom role that denies write access to analytics rules.

Question 2

You are setting up Microsoft Sentinel for the first time. You need to ingest Windows security events from on-premises servers using the Azure Monitor Agent. Which data connector should you enable in Microsoft Sentinel?

Accepted Answer

Windows Security Events via AMA. The Windows Security Events via AMA data connector is specifically designed to collect Windows security events (e.g., Event ID 4625, 4688) from on-premises servers using the Azure Monitor Agent (AMA). This connector leverages the AMA's Data Collection Rules (DCRs) to filter and ingest security-relevant logs directly into Microsoft Sentinel, making it the correct choice for this scenario.

Answer

Common Event Format (CEF) via AMA

Answer

Syslog via AMA

Answer

DNS via AMA

Question 3

Your organization has Microsoft Defender for Cloud Apps and Microsoft Sentinel integrated. You need to create an automated playbook that, when a Microsoft Sentinel incident is created from a Defender for Cloud Apps alert, automatically suspends the user in Microsoft Entra ID and sends a notification to the security team. Which two connectors should you use in the playbook?

Accepted Answer

Microsoft Entra ID and Microsoft Teams. The correct answer is A because Microsoft Entra ID is used to suspend the user, and Microsoft Teams is used to send notifications. Option B is incorrect because Outlook.com is not enterprise-grade and ServiceNow is not a Microsoft connector. Option C is incorrect because Power BI is for visualization, not suspension. Option D is incorrect because Azure Automation is for scripts, not direct user suspension.

Answer

Microsoft Power BI and Microsoft Teams

Answer

Azure Automation and Microsoft Sentinel

Answer

Microsoft Entra ID and Outlook.com

Question 4

Your security team uses Microsoft Defender XDR to investigate a potential malware outbreak. You need to collect a full memory dump from an affected Windows 10 device for forensic analysis. Which action should you take from the Microsoft Defender XDR portal?

Accepted Answer

Initiate a 'Collect investigation package' action.. To collect a full memory dump for forensic analysis from a Windows 10 device during a potential malware outbreak, you must initiate a 'Collect investigation package' action from the Microsoft Defender XDR portal. This action gathers a comprehensive set of forensic data, including a full memory dump, event logs, registry hives, and other artifacts, which is essential for deep analysis of malware behavior and persistence mechanisms.

Answer

Isolate the device from the network.

Answer

Run a full antivirus scan on the device.

Answer

Restrict app execution on the device.

Question 5

You are configuring Microsoft Sentinel to send email notifications to the security team when high-severity incidents are created. Which feature should you use?

Accepted Answer

Automation rule. Automation rules in Microsoft Sentinel allow you to define automated responses to incidents, including sending email notifications to specified recipients when incidents meet certain criteria, such as high severity. This feature directly supports the requirement to notify the security team when high-severity incidents are created, without requiring additional logic or manual steps.

Answer

Watchlist

Answer

Analytics rule

Answer

Workbook

Question 6

Your organization uses Microsoft Defender for Cloud Apps to monitor SaaS applications. You discover that a user is downloading a large number of files from SharePoint Online to an unmanaged device. You need to automatically block the download and require the user to acknowledge a policy violation. Which action should you configure in a session policy?

Accepted Answer

Set the action to 'Block' and enable 'Notify user' with a customized message.. Option C is correct because a session policy in Microsoft Defender for Cloud Apps can enforce real-time controls on SaaS app traffic. Setting the action to 'Block' stops the download immediately, and enabling 'Notify user' with a customized message both blocks the action and requires the user to acknowledge the policy violation, satisfying the requirement to automatically block and obtain acknowledgment.

Answer

Set the action to 'Monitor only'.

Answer

Set the action to 'Redirect to Microsoft Entra ID conditional access'.

Answer

Set the action to 'Block' and enable 'Custom block message'.

Question 7

Which TWO actions are valid ways to integrate on-premises firewall logs into Microsoft Sentinel for analysis?

Accepted Answer

Configure the firewall to send Common Event Format (CEF) logs to a syslog server running Azure Monitor Agent.. Option B is correct because on-premises firewall logs can be forwarded in Common Event Format (CEF) over syslog to a server running the Azure Monitor Agent (AMA), which then ingests them into Microsoft Sentinel. CEF is a standard log format supported by many security appliances, and the AMA replaces the older Log Analytics Agent for this purpose. This setup allows Sentinel to parse and analyze the firewall events for security monitoring.

Answer

Enable the Office 365 connector.

Answer

Install the Windows DNS Server connector.

Answer

Connect the Azure Activity log connector.

Question 8

Which THREE components are required to implement a threat intelligence feed in Microsoft Sentinel using the Threat Intelligence - TAXII data connector?

Accepted Answer

Root collection ID. The root collection ID is a required component for the Threat Intelligence - TAXII data connector because it identifies the specific collection of threat indicators on the TAXII server. Without this ID, Microsoft Sentinel cannot determine which set of indicators to ingest, as a single TAXII server may host multiple collections. The connector uses the root collection ID to query the correct STIX/TAXII endpoint and retrieve the relevant threat intelligence feed.

Answer

A Log Analytics workspace with Microsoft Sentinel enabled

Answer

A watchlist named 'ThreatIntelligenceIndicators'

Question 9

Which TWO actions can a Microsoft Sentinel automation rule perform when an incident is created?

Accepted Answer

Run a playbook. Microsoft Sentinel automation rules can trigger actions when an incident is created, including running a playbook (Option C) and changing the incident severity (Option D). Playbooks are automated workflows based on Azure Logic Apps that can perform complex response actions, while severity changes allow dynamic triage based on incident properties.

Answer

Create a new analytics rule

Answer

Query Log Analytics workspaces

Answer

Ingest data from a new source

Question 10

Refer to the exhibit. You are reviewing a Microsoft Sentinel scheduled analytics rule defined in JSON. The rule is intended to trigger an incident when more than 5 sign-ins from anomalous locations occur within an hour. However, the rule is not triggering as expected. What is the most likely cause?

Accepted Answer

The query references a column that does not exist in the SigninLogs table.. Option B is correct because the query references a column that does not exist in the SigninLogs table. In Microsoft Sentinel, if a scheduled analytics rule's KQL query references a non-existent column, the query will fail silently or return no results, preventing the rule from triggering an incident. The rule logic depends on the query returning a result set that meets the trigger threshold, and a missing column causes the query to fail or return zero rows.

Answer

The severity is set to 'Medium', but it must be an integer.

Answer

The triggerThreshold is set to 5, but it should be a string like '5'.

Answer

The queryFrequency and queryPeriod are set to the same value, which is not allowed.

Question 11

Refer to the exhibit. You are analyzing a KQL query used in a custom detection rule in Microsoft Defender XDR. The rule is supposed to detect devices where a parent process launched more than 10 instances of PowerShell or cmd.exe in the last 7 days. However, the query returns no results even though you know such activity exists. What is the most likely reason?

Accepted Answer

The 'extend' line uses a column that does not exist in the DeviceProcessEvents schema.. Option D is correct because the 'extend' line references a column named 'ParentProcessFileName' that does not exist in the DeviceProcessEvents schema. The actual column is 'InitiatingProcessFileName' (or 'ParentProcessName' in some schemas). Since the column doesn't exist, the 'extend' operation fails silently or produces null values, causing the subsequent 'summarize' to group by null and return no results.

Answer

The 'extend' line creates a new column that is not used in the subsequent summarize, causing the query to not group by parent process as intended.

Answer

The 'summarize' operator cannot be used with 'count()' in this context.

Answer

The 'where' clause filters out all events because the FileName list is incorrect.

Question 12

Refer to the exhibit. You are reviewing an Azure Policy definition intended to block malicious IPs by denying the creation of network security group rules that allow traffic from a list of blocked IPs. However, the policy is not working as expected. What is the most likely reason?

Accepted Answer

The policy rule does not evaluate the source IP address; it denies all security rules.. Option D is correct because the policy rule in the exhibit uses the 'sourceAddressPrefix' condition with the parameter 'listOfBlockedIPs', but it does not include a condition to evaluate the 'sourcePortRange' or 'destinationAddressPrefix'. More critically, the rule denies all security rules regardless of the source IP because the condition logic is flawed: it denies if the source IP is in the blocked list, but it does not also check that the rule is allowing traffic (e.g., direction 'Inbound' and access 'Allow'). Without these additional conditions, the policy incorrectly denies all NSG rules, including those that are not allowing traffic from blocked IPs.

Answer

The policy mode is incorrect; it should be 'All' instead of 'Microsoft.Network/virtualNetworks'.

Answer

The parameter 'listOfBlockedIPs' is not used in the policy rule.

Answer

The effect 'deny' is not supported for this resource type.

Question 13

A SOC analyst receives a high-severity alert for a user who downloaded a malicious file from a phishing email. The analyst needs to quickly assess the scope of the incident across endpoints, email, and identities. Which Microsoft Defender XDR feature should the analyst use to get a unified view of the incident?

Accepted Answer

Microsoft Defender XDR incident queue. The Microsoft Defender XDR incident queue is the correct choice because it aggregates alerts from Microsoft Defender for Endpoint, Office 365, and Identity into a single incident view, enabling the analyst to correlate the malicious file download across endpoints, email, and user identities without switching consoles. This unified incident management is a core feature of Microsoft Defender XDR, designed specifically for rapid triage and scope assessment in multi-domain threats.

Answer

Microsoft Purview compliance portal

Answer

Microsoft Intune device compliance dashboard

Answer

Microsoft Sentinel incidents blade

Question 14

Your organization uses Microsoft Sentinel for security operations. You need to ensure that critical alerts are automatically assigned to the appropriate SOC tier for investigation. What should you configure in Microsoft Sentinel?

Accepted Answer

Create an automation rule that sets the incident owner. Automation rules in Microsoft Sentinel allow you to automatically assign incidents to specific owners based on conditions like severity or alert type. This ensures critical alerts are routed to the appropriate SOC tier without manual intervention, directly meeting the requirement.

Answer

Create a playbook that assigns the incident to a user

Answer

Use a watchlist to map alert types to owners

Answer

Configure an analytics rule to set the owner

Question 15

A SOC manager wants to implement a new workflow where high-severity Microsoft Defender for Cloud Apps alerts are automatically sent to a Teams channel for immediate action. The solution must not require custom code. What should the manager configure?

Accepted Answer

Create an automation rule in Microsoft Sentinel with a playbook that posts to Teams. Option C is correct because Microsoft Sentinel's automation rules can trigger a playbook (built on Azure Logic Apps) when a high-severity alert is generated, and the playbook can post a message to a Teams channel without requiring custom code. This directly meets the requirement of automatically sending high-severity Microsoft Defender for Cloud Apps alerts to Teams for immediate action, leveraging built-in connectors.

Answer

Use Microsoft Power Automate to monitor the alerts and send a Teams message

Answer

Configure a rule in Microsoft Defender XDR to send email notifications

Answer

Configure Microsoft Entra ID to send the alerts to Teams