SC-200 Mitigate threats using Microsoft Sentinel Practice Test 4 — 15 Questions

Question 1

An SOC analyst wants to quickly enable detection for when a user account is added to the Global Administrator role in Microsoft Entra ID using a built-in analytics rule template in Microsoft Sentinel. Which type of analytics rule template should the analyst use?

Accepted Answer

Scheduled. The analyst should use a Scheduled analytics rule template because the detection for when a user account is added to the Global Administrator role in Microsoft Entra ID requires querying the AuditLogs table at a regular interval. Scheduled rules allow you to define a KQL query that runs on a schedule (e.g., every 5 minutes) and generates alerts based on the results. This is the only built-in rule type that supports custom log queries for specific activities like role assignments.

Answer

Microsoft Security

Answer

Fusion

Answer

Machine Learning (ML)

Question 2

A SOC analyst wants to leverage Microsoft Sentinel's User and Entity Behavior Analytics (UEBA) to detect anomalous sign-in attempts where a user signs in from a country outside their typical pattern. The analyst needs to create an analytics rule that queries the necessary UEBA data. Which Sentinel table should the rule's KQL query primarily reference to evaluate geographic anomalies?

Accepted Answer

BehaviorAnalytics. The BehaviorAnalytics table in Microsoft Sentinel is specifically designed to store UEBA output, including normalized user behavior data such as historical geo-location patterns and anomaly scores. By querying this table, the analyst can directly access pre-computed anomalies for sign-in location deviations without needing to perform complex baseline calculations on raw SigninLogs.

Answer

SigninLogs

Answer

IdentityInfo

Answer

AADUserRiskEvents

Question 3

A SOC analyst is configuring a scheduled analytics rule in Microsoft Sentinel that detects sign-ins from IP addresses contained in a custom threat intelligence watchlist. The analyst wants to avoid creating multiple incidents for the same user and source IP address combination within a 6-hour window. Which configuration in the 'Incident creation' settings should the analyst use to achieve this suppression?

Accepted Answer

Using the 'Event grouping' option under 'Alert grouping' with a 6-hour re-open window. Option A is correct because the 'Event grouping' setting under 'Alert grouping' allows the analyst to group alerts that fire within a specified time window into a single incident. By setting the 'Re-open window' to 6 hours, any new alert matching the same user and source IP address combination will not create a new incident but will instead re-open the existing incident, effectively suppressing duplicate incidents within that window.

Answer

Setting a custom query threshold so that alerts are only generated once per time window

Answer

Enabling 'Suppression' on the 'Schedule' page to stop running the query after the first incident

Answer

Using the 'Custom' alert grouping and setting a time window for re-opening

Question 4

A SOC analyst wants to detect when a user signs in from a device that has never been used by that user before. The analyst plans to use Microsoft Sentinel with the SigninLogs table. Which KQL approach correctly identifies sign-ins from devices not previously associated with the user within the last 30 days?

Accepted Answer

Join the SigninLogs table with itself to find the earliest sign-in per user and device, then filter for those that match the earliest timestamp. Option A is correct because it uses a self-join on the SigninLogs table to identify the earliest sign-in per user-device pair within the last 30 days. By filtering for rows where the sign-in timestamp matches the earliest timestamp, the query isolates sign-ins from devices that have never been used by that user before, effectively detecting first-time device usage.

Answer

Use the _GetWatchlist function with a custom watchlist of known user-device pairs

Answer

Use the BehaviorAnalytics table which already identifies new devices

Answer

Apply the 'where DeviceId != '' and DeviceId startswith "device-"' filter to ensure the device is new

Question 5

A SOC analyst is creating a scheduled analytics rule in Microsoft Sentinel to detect when a user is added to the Global Administrator role in Microsoft Entra ID. The analyst also needs to capture the user who performed the addition. Which Microsoft Entra ID table should the analyst query in the rule's KQL query?

Accepted Answer

AuditLogs. The AuditLogs table in Microsoft Entra ID (formerly Azure AD) records all directory-level changes, including role assignments like adding a user to the Global Administrator role. Each audit log entry contains the 'InitiatedBy' property, which captures the user or service principal who performed the action, meeting the analyst's requirement to identify the actor. SigninLogs only tracks authentication events, not administrative changes, making AuditLogs the correct choice for this detection.

Answer

SigninLogs

Answer

IdentityInfo

Answer

BehaviorAnalytics

Question 6

A SOC analyst is creating a scheduled analytics rule in Microsoft Sentinel to detect sign-ins from IP addresses that are not in the organization's known allow list. The allow list is maintained in a custom watchlist named 'AllowedIPs'. The analyst wants the KQL query to efficiently filter out allowed IPs. Which KQL approach should the analyst use?

Accepted Answer

Use the _GetWatchlist('AllowedIPs') function and filter with the '!in' operator.. Option C is correct because the _GetWatchlist('AllowedIPs') function retrieves the watchlist content at query runtime, and combining it with the '!in' operator efficiently filters out sign-ins from IPs present in the watchlist. This approach is dynamic, meaning updates to the watchlist are automatically reflected without modifying the query, and it avoids hardcoding IPs or using inefficient row-by-row lookups.

Answer

Use the 'lookup' operator to map IPs against the watchlist.

Answer

Use a 'let' statement to define a static list of allowed IPs.

Answer

Use the 'evaluate' operator with a python script.

Question 7

A SOC analyst wants to create a visual dashboard in Microsoft Sentinel to monitor sign-in activity trends over the past 30 days. Which feature should the analyst use?

Accepted Answer

Workbooks. Workbooks in Microsoft Sentinel provide a flexible canvas for creating custom visual dashboards using Azure Monitor Workbooks. They allow the analyst to query Log Analytics workspaces (e.g., SigninLogs table) and render time-series charts, trend lines, and other visualizations to monitor sign-in activity over the past 30 days. This is the correct feature for building a visual dashboard.

Answer

Analytics rules

Answer

Playbooks

Answer

Threat Intelligence

Question 8

An organization ingests Windows Security Events into Microsoft Sentinel via the Security Events connector. An analyst wants to create a scheduled analytics rule that alerts when more than 10 failed logon events (Event ID 4625) occur for the same user within a 5-minute window. Which KQL operator should the analyst use to count events per user in that time window?

Accepted Answer

summarize. The `summarize` operator is correct because it groups events by user and then applies an aggregation function (like `count()`) to calculate the number of failed logon events per user within the 5-minute window. This directly supports the rule's requirement to count events per user and compare the count to a threshold of 10.

Answer

extend

Answer

project

Answer

where

Question 9

A SOC analyst wants to ensure that multiple alerts from the same analytics rule that occur within a 1-hour window for the same user are automatically merged into a single incident. Which configuration setting should the analyst adjust in the analytics rule?

Accepted Answer

Incident grouping settings. Option A is correct because the Incident grouping settings in a Microsoft Sentinel analytics rule control whether multiple alerts from the same rule are automatically merged into a single incident. By configuring the grouping to 'Group alerts into a single incident if they match the specified conditions' and setting the time window to 1 hour, the SOC analyst ensures that alerts triggered for the same user within that window are combined, reducing alert noise and improving incident management efficiency.

Answer

Entity mapping

Answer

Alert details

Answer

Query scheduling

Question 10

A SOC team wants to automatically run a playbook that retrieves threat intelligence details whenever a high-severity incident is created in Microsoft Sentinel. Which type of automation should they configure?

Accepted Answer

Automation rule with incident trigger. Automation rules in Microsoft Sentinel can be configured with an incident trigger to automatically run playbooks when incidents are created or updated. Since the requirement is to run a playbook on high-severity incidents, an automation rule with an incident trigger allows you to filter by severity (e.g., High) and invoke the playbook without manual intervention.

Answer

Automation rule with alert trigger

Answer

Playbook with manual trigger

Answer

Logic app with recurrence

Question 11

Which of the following detection scenarios can be implemented using a scheduled analytics rule in Microsoft Sentinel? (Select all that apply.) (Choose 2.)

Accepted Answer

Identifying sign-ins from IP addresses listed in a custom threat intelligence watchlist.. Option A is correct because scheduled analytics rules in Microsoft Sentinel can be configured to run queries at regular intervals, and these queries can reference watchlists, including custom threat intelligence watchlists. By querying sign-in logs and joining them with a watchlist of known malicious IPs, the rule can identify sign-ins from those IPs and generate alerts. This is a common pattern for leveraging external threat intelligence within Sentinel's detection capabilities.

Answer

Detecting anomalous sign-in behavior based on user entity behavior.

Answer

Automatically blocking malicious IPs on a firewall.

Question 12

Arrange the steps in the correct order to create and save a custom hunting query in Microsoft Sentinel.

Accepted Answer

Open the Microsoft Sentinel workspace in the Azure portal → Navigate to the Hunting blade in the Sentinel menu → Click on the 'New Query' button → Write the KQL query in the query editor → Run the query to verify results → Save the query with a meaningful name and description. Option A is correct because creating a custom hunting query in Microsoft Sentinel requires first accessing the workspace, then navigating to the Hunting blade, clicking 'New Query', writing the KQL query, running it to validate results, and finally saving it with a meaningful name and description. This sequence ensures the query is tested before being stored, aligning with Sentinel's workflow for ad-hoc threat hunting.

Answer

Verify results before configuring the source or rule settings.

Answer

Configure alert grouping before defining the detection query or source.

Answer

Skip validation and enable the rule or plan immediately.

Question 13

Match each Microsoft Sentinel analytics rule type to its correct description.

Accepted Answer

Scheduled → Runs a KQL query on a schedule and generates alerts based on the query results.; Fusion → Correlates multiple high-fidelity alerts from various sources to create a single, comprehensive incident.; Anomaly → Uses machine learning to identify unusual patterns in activity by analyzing entity behavior over time.; Microsoft Security → Creates incidents from alerts generated by Microsoft security products such as Microsoft Defender for Endpoint.. Option A is correct because it accurately describes the four distinct Microsoft Sentinel analytics rule types. Scheduled rules execute KQL queries at defined intervals to generate alerts based on query results. Fusion rules use advanced machine learning to correlate multiple high-fidelity alerts from different sources into a single incident, reducing alert fatigue. Anomaly rules leverage machine learning to detect unusual patterns by analyzing entity behavior over time. Microsoft Security rules automatically create incidents from alerts generated by Microsoft security products like Microsoft Defender for Endpoint, integrating native security signals.

Answer

The first and last mappings are swapped.

Answer

Every item maps to the same log table or feature category.

Answer

Only identity-related items are mapped; workload and network items are omitted.

Question 14

A SOC analyst needs to create an automation rule that triggers only when an incident contains a specific custom tag (e.g., 'PII'). Which condition should the analyst use to filter incidents based on the presence of that tag?

Accepted Answer

Incident tag contains. Option A is correct because Microsoft Sentinel automation rules use the 'Incident tag contains' condition to filter incidents based on the presence of specific custom tags. When an incident is enriched with a tag like 'PII' via analytics rules or playbooks, this condition allows the automation rule to match and trigger actions only on incidents carrying that exact tag, ensuring precise targeting without affecting unrelated incidents.

Answer

Incident severity

Answer

Alert product name

Answer

Entity type

Question 15

A SOC team in Microsoft Sentinel wants to automatically assign high-severity incidents to the 'SOC Tier 2' group and automatically close low-severity incidents that have not been updated in 7 days. Which two configuration elements are required in a single automation rule?

Accepted Answer

One condition for 'Severity equals High' with action 'Assign to SOC Tier 2' and add another condition for 'Severity equals Low' AND 'Last update time older than 7 days' with action 'Close incident'.. Option A is correct because a single Microsoft Sentinel automation rule can include multiple conditions using AND/OR logic, and each condition can trigger a different action (e.g., assign or close). This allows the SOC team to handle both high-severity assignment and low-severity auto-closure within one rule, meeting the requirement efficiently.

Answer

Create one rule for high severity assignments and another rule for low severity closure; you cannot combine different actions in one rule.

Answer

Set the automation rule to trigger on incident creation and then use a custom action to assign owner, but closure cannot be automated in an automation rule.