SC-200 Manage a security operations environment — Timed 10 Questions

Question 1

Your SOC team uses Microsoft Sentinel to manage incidents. You want to improve the efficiency of incident triage by automatically enriching incidents with threat intelligence data from Microsoft Threat Intelligence. What should you configure?

10 minute time limit — choose an answer to begin.

Accepted Answer

Create a playbook that queries the Threat Intelligence API and adds a comment to the incident.. Playbooks in Microsoft Sentinel can be triggered by automation rules and can query the Microsoft Threat Intelligence API to retrieve threat indicators, then add a comment or tag to the incident for enrichment. Watchlists are static and cannot be directly referenced in automation rules for dynamic matching; they require a playbook to look up data. The TAXII connector only ingests indicators, and UEBA is unrelated to threat intelligence enrichment.

Answer

Enable the Threat Intelligence - TAXII connector to ingest threat indicators.

Answer

Create a watchlist containing threat intelligence data and use it in an automation rule to add tags or comments.

Answer

Enable User and Entity Behavior Analytics (UEBA) to detect anomalies.

Question 2

You are reviewing an automation rule in Microsoft Sentinel with the configuration shown in the exhibit. The rule is intended to delete a custom analytics rule when an incident is created. What is the most likely issue with this configuration?

Accepted Answer

The playbook does not have permissions to delete analytics rules.. Automation rules in Microsoft Sentinel are designed to automate incident response actions, such as assigning ownership, changing status, or running playbooks. They cannot directly delete or modify analytics rules; that capability is not part of the automation rule schema or actions. The intended action in the exhibit (deleting a custom analytics rule) is outside the scope of what automation rules can perform.

Answer

The displayName should not contain spaces.

Answer

Automation rules cannot delete analytics rules; they are designed to automate incident response.

Answer

The incidentType should be set to 'AnalyticsRule' instead of 'Alert'.

Question 3

You run the PowerShell command shown in the exhibit to enable diagnostics on an Azure VM. The VM is running Windows Server 2022. You want to collect security events and send them to a Log Analytics workspace. What should you include in the diagnostics.json configuration file?

Accepted Answer

A WindowsEventLog element with ProviderName set to 'Security' and a query of '*'.. The Azure Diagnostics extension for Windows VMs uses a WindowsEventLog element in the diagnostics.json configuration to specify which Windows Event Log channels to collect. Setting ProviderName to 'Security' and query to '*' collects all security events from the Security log, which are then forwarded to the Log Analytics workspace.

Answer

An EtwProvider element with provider GUID for Microsoft-Windows-Security-Auditing.

Answer

A Syslog element with facility set to 'auth' and severity set to 'info'.

Answer

A PerformanceCounter element with a counter for security incidents.

Question 4

Your SOC team uses Microsoft Sentinel analytics rules. You need to ensure that a scheduled rule runs every hour, but only during business hours (8 AM to 6 PM). What configuration should you use?

Accepted Answer

Create two rules: one that runs every hour during business hours and another that runs but suppresses alerts outside business hours.. Microsoft Sentinel scheduled analytics rules do not natively support time-based scheduling restrictions like 'only during business hours'. The recommended workaround is to create two separate rules: one that runs every hour during business hours to generate alerts, and another that runs every hour outside business hours but is configured to suppress alerts (e.g., by setting a low severity or using a suppression query). This ensures detection logic runs continuously while avoiding alert fatigue outside the desired window.

Answer

Use a custom log with a logic app to only trigger the rule during business hours.

Answer

Configure the rule to run continuously with an alert threshold of 0.

Answer

Set the rule to run every hour and use a KQL query to filter events outside business hours.

Question 5

Which TWO of the following are valid methods to reduce the cost of Microsoft Sentinel data ingestion?

Accepted Answer

Configure Basic logs for high-volume, low-value data sources.. Option A is correct because Basic logs (Basic Logs plan) in a Log Analytics workspace cost significantly less for ingestion and retention than the Analytics logs plan, making it ideal for high-volume, low-value data such as verbose logs that are only needed for troubleshooting or occasional searches. Option C is correct because setting a daily ingestion cap on the Log Analytics workspace limits the maximum volume of data ingested per day, preventing unexpected ingestion charges once the cap is reached (though data above the cap is dropped). Option B is not a cost-reduction method for ingestion itself; efficient KQL queries and reduced false positives lower query/analytics costs and noise, not the per-GB ingestion charge. Option D is invalid because Microsoft Sentinel is enabled on a Log Analytics workspace, not on premium storage accounts, and storage tiers do not reduce Sentinel ingestion cost. Option E is incorrect because increasing retention to 90 days increases retention charges rather than reducing ingestion cost.

Answer

Use analytics rules with efficient KQL queries to reduce false positives.

Answer

Enable Sentinel on premium storage accounts.

Answer

Increase the data retention period to 90 days.

Question 6

Refer to the exhibit. You are reviewing a Microsoft Sentinel scheduled analytics rule defined in ARM template format. The rule is enabled but no incidents are being created even though matching sign-in events exist. What is the most likely reason?

Accepted Answer

The rule does not have entity mapping configured. The most likely reason no incidents are being created despite matching sign-in events is that the rule lacks entity mapping. In Microsoft Sentinel, while entity mapping is optional for some rule types, it is required for scheduled analytics rules to generate incidents from query results. Without entity mapping, the rule may run successfully and find results but will not create an incident because Sentinel cannot associate the results with a recognized entity (e.g., Account, IP, Host). This is a common misconfiguration when importing rules via ARM templates.

Answer

The query uses a dynamic list incorrectly

Answer

The suppressionDuration is incorrectly configured

Answer

The queryFrequency is set too high, causing missed events

Question 7

Refer to the exhibit. You are analyzing a KQL query for a Microsoft Sentinel scheduled rule. The query is intended to detect devices that have both a high number of process executions and network connections to a single IP within an hour. However, the query returns no results even though there are devices meeting the criteria. What is the most likely cause?

Accepted Answer

The join condition does not include a time window, causing mismatches. The join between DeviceProcessEvents and DeviceNetworkEvents lacks a time window constraint (e.g., 'on $left.Timestamp between ($right.Timestamp - 1h) and ($right.Timestamp + 1h)'). Without this, the join matches events across arbitrary time ranges, causing mismatches where a device's process executions and network connections to a single IP occur at different times, even if both happen within the same hour. This results in no rows being returned when the intended detection requires temporal proximity.

Answer

The threshold variable is not used correctly

Answer

The DeviceProcessEvents and DeviceNetworkEvents tables are from different data sources

Answer

The summarize function cannot count process executions

Question 8

Refer to the exhibit. You have a Microsoft Sentinel analytic rule configured to detect brute force attacks. The rule runs every 30 minutes and groups alerts into incidents based on Account and IP. You notice that multiple incidents are created for the same user and IP within a short time. What should you do to reduce the number of incidents?

Accepted Answer

Increase the lookback duration to 2 hours. Increasing the lookback duration to 2 hours allows the analytic rule to consider a longer window of historical data when grouping alerts into incidents. This means that alerts for the same Account and IP that occur within that extended timeframe will be merged into a single incident, directly reducing the number of duplicate incidents created for the same user and IP.

Answer

Decrease the query frequency to 1 hour

Answer

Increase the trigger threshold to 10

Answer

Disable alert grouping

Question 9

Your security team uses Microsoft Defender XDR to investigate incidents. You have a custom detection rule that runs a KQL query every hour. Recently, the rule stopped generating alerts. You verify that the query syntax is correct and that data is being ingested. What is the most likely cause?

Accepted Answer

The alert suppression threshold is configured too high.. The custom detection rule uses an alert suppression threshold, which prevents alerts from being generated unless the query results exceed a specified count. If this threshold is set too high, the rule may stop generating alerts even though the query returns valid results, because the number of matching events no longer meets the suppression limit. This is the most likely cause given that the query syntax is correct and data is being ingested.

Answer

The Microsoft Defender XDR license has expired.

Answer

An automation rule is deleting the alerts.

Answer

The query is not returning any results.

Question 10

Which THREE components are required to automate incident response in Microsoft Sentinel using playbooks? (Choose three.)

Accepted Answer

An automation rule in Sentinel.. Option A is correct because an automation rule in Microsoft Sentinel is the mechanism that binds a trigger condition (such as incident creation) to a playbook, enabling automatic execution of the response workflow. Option B is correct because playbooks in Microsoft Sentinel are built on Azure Logic Apps workflows, which contain the actual response actions (e.g., sending emails, blocking IPs, posting to Teams) that perform the automation. Option E is correct because a trigger, such as 'When an incident is created' or 'When an alert is created', is the required starting event that fires the Logic Apps workflow; without a trigger, the playbook cannot run automatically. Option C is not correct because a workbook is only a visualization and reporting tool in Sentinel and does not execute or automate response actions. Option D is not correct because an analytics rule detects threats and generates alerts/incidents, but it does not itself automate the response; it may be referenced by an automation rule, yet it is not a required component for the playbook automation itself.

Answer

A workbook.

Answer

An analytics rule.