SC-200 Mitigate threats using Microsoft Sentinel Practice Test 6 — 15 Questions

Question 1

A SOC analyst wants to ingest firewall logs from a Palo Alto Networks appliance into Microsoft Sentinel using the Common Event Format (CEF) connector. The analyst has already set up a Linux syslog forwarder. What is the next required step to complete the data ingestion?

Accepted Answer

Run the installation script provided by the Sentinel CEF connector page on the Linux forwarder.. The CEF connector for Palo Alto Networks in Microsoft Sentinel requires a Linux syslog forwarder to have the CEF agent installed and configured. The installation script provided on the Sentinel CEF connector page automates the setup of the Log Analytics agent (formerly OMS agent) with the correct syslog daemon configuration to parse and forward CEF-formatted logs. Since the forwarder is already deployed, running this script is the immediate next step to enable log ingestion.

Answer

Install the Azure Monitor Agent on the Linux forwarder.

Answer

Create a Syslog data connector in Sentinel and specify the Palo Alto facility.

Answer

Enable Azure Arc on the firewall appliance.

Question 2

A SOC analyst wants to create a scheduled analytics rule in Microsoft Sentinel that runs every 5 minutes and alerts when a single IP address fails to authenticate more than 10 times in that time window using the Microsoft Entra ID SigninLogs table. Which KQL function should be used to group the results into 5-minute intervals?

Accepted Answer

bin(). The `bin()` function is the correct choice because it is specifically designed to group time-series data into fixed-size buckets (e.g., 5-minute intervals) for aggregation. In this scenario, you need to align each authentication event to its corresponding 5-minute window so that you can count failures per IP address per window. Without `bin()`, the `summarize` operator would not automatically create these fixed intervals; it would group by the raw timestamp values, which would not produce the required 5-minute buckets.

Answer

summarize

Answer

count

Answer

where

Question 3

A SOC analyst creates a scheduled analytics rule in Microsoft Sentinel with the following KQL query: SigninLogs | where TimeGenerated > ago(1h) | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by UserPrincipalName, IPAddress | where EndTime - StartTime < 5m and count_IPAddress > 1 The intended purpose is to detect users logging in from multiple IP addresses in a short time (impossible travel). However, the rule does not generate any alerts. What is the most likely cause?

Accepted Answer

The query references a column 'count_IPAddress' that does not exist. The summarize operator does not create a column with that name.. The query uses `summarize ... by UserPrincipalName, IPAddress` which groups by both fields, so it does not create a column named `count_IPAddress`. The `where` clause then references `count_IPAddress`, which does not exist, causing the query to fail silently or return no results. This is why no alerts are generated.

Answer

The query does not filter for failed sign-ins (e.g., ResultType == 0).

Answer

The rule should use a longer time range, such as 24 hours.

Answer

The rule needs to use the 'make_set' function to correctly count distinct IP addresses.

Question 4

A security analyst needs to connect a Palo Alto Networks firewall to Microsoft Sentinel to ingest logs. The firewall supports Syslog and Common Event Format (CEF). Which data connector should the analyst use?

Accepted Answer

Palo Alto Networks (via Syslog CEF). The Palo Alto Networks firewall supports sending logs in Common Event Format (CEF) over Syslog, and Microsoft Sentinel provides a dedicated data connector specifically for Palo Alto Networks (via Syslog CEF). This connector parses the CEF-formatted syslog messages using a Log Analytics agent or AMA, normalizing fields into the CommonSecurityLog table for seamless ingestion. Using the vendor-specific connector ensures proper field mapping and schema alignment, unlike a generic CEF connector which may not handle Palo Alto's specific CEF extensions correctly.

Answer

Common Event Format (CEF) via Syslog (generic)

Answer

Syslog (without CEF)

Answer

Custom Text Logs

Question 5

A security analyst wants to create a custom detection rule in Microsoft Sentinel that alerts when a user logs in from an IP address that is not in the company's approved IP range. The analyst has an existing watchlist named 'ApprovedIPs' containing the allowed ranges. Which KQL operator should the analyst use to compare the IP address from the SigninLogs table against the watchlist?

Accepted Answer

lookup. The `lookup` operator is the correct choice because it is specifically designed to enrich or filter data in one table based on a dimension table (like a watchlist) without requiring a full merge of columns. In this scenario, the analyst needs to compare IP addresses from the SigninLogs table against the ApprovedIPs watchlist to find logins from non-approved ranges, and `lookup` performs this efficiently by matching on a key field (the IP address) and returning only rows that do not have a match in the watchlist when used with a `kind=leftanti` parameter.

Answer

join

Answer

evaluate

Answer

where

Question 6

A SOC analyst is configuring an analytics rule in Microsoft Sentinel. The rule should run every hour and check for sign-ins from users who have been inactive for more than 30 days. The analyst uses the SigninLogs and IdentityInfo tables. Which KQL query pattern should be used to identify these users?

Accepted Answer

IdentityInfo | join kind=leftanti (SigninLogs | where TimeGenerated > ago(30d)) on UserPrincipalName. Option B is correct because it uses a `leftanti` join to return all rows from the `IdentityInfo` table that have no matching `UserPrincipalName` in the `SigninLogs` table for the last 30 days. This directly identifies users who are in the identity inventory but have not signed in within the past 30 days, which is the exact requirement for detecting inactive users.

Answer

union IdentityInfo, SigninLogs | where TimeGenerated > ago(30d) | summarize by UserPrincipalName

Answer

SigninLogs | where TimeGenerated > ago(30d) | summarize by UserPrincipalName | join kind=rightanti IdentityInfo on UserPrincipalName

Answer

SigninLogs | where TimeGenerated < ago(30d) | summarize by UserPrincipalName

Question 7

A SOC analyst needs to create an automated response in Microsoft Sentinel that, when a specific type of incident is created, automatically creates a ticket in ServiceNow and blocks the source IP address in Azure Firewall. The analyst already has a playbook that performs these actions. What is the correct configuration to trigger this playbook?

Accepted Answer

Attach the playbook to an automation rule that includes the condition for the target incident type.. Automation rules in Microsoft Sentinel are the correct mechanism to trigger a playbook automatically when an incident is created. By attaching the playbook to an automation rule with a condition that matches the specific incident type (e.g., based on incident title or tag), the rule executes the playbook immediately upon incident creation, fulfilling the requirement without manual intervention.

Answer

Configure the playbook to run on a scheduled recurrence every 5 minutes.

Answer

Add the playbook to the incident's comments as a quick link.

Answer

Use a separate Power Automate flow with a trigger that watches for new Sentinel incidents.

Question 8

A security analyst wants to quickly check the number of incidents created in Microsoft Sentinel in the last 7 days, grouped by severity. Which KQL query should the analyst use?

Accepted Answer

SecurityIncident | where TimeGenerated > ago(7d) | summarize count() by Severity. Option A is correct because the SecurityIncident table in Microsoft Sentinel stores incident records, and the query filters for incidents created in the last 7 days using `where TimeGenerated > ago(7d)`, then groups them by severity with `summarize count() by Severity`. This directly answers the analyst's need to check the number of incidents grouped by severity.

Answer

SecurityAlert | where TimeGenerated > ago(7d) | summarize count() by Severity

Answer

SigninLogs | where TimeGenerated > ago(7d) | summarize count() by Status

Answer

DeviceEvents | where TimeGenerated > ago(7d) | summarize count() by ActionType

Question 9

A SOC analyst wants to create a scheduled analytics rule in Microsoft Sentinel that detects when a user is added to a privileged Microsoft Entra ID role (e.g., Global Administrator). Which data table is essential for the query?

Accepted Answer

AuditLogs. The AuditLogs table in Microsoft Sentinel captures all directory-level audit activities, including modifications to Microsoft Entra ID (formerly Azure AD) role assignments. When a user is added to a privileged role like Global Administrator, the event is logged as an 'Add member to role' activity in the AuditLogs table. This makes AuditLogs the essential data source for detecting such privileged role changes.

Answer

SigninLogs

Answer

SecurityEvent

Answer

CommonSecurityLog

Question 10

A SOC analyst wants to automate a response in Microsoft Sentinel such that whenever an incident is created containing a specific user entity (e.g., compromised user), a playbook runs that disables the user in Microsoft Entra ID. Which condition should be configured in the automation rule?

Accepted Answer

When incident is created, and the incident contains a user entity.. Option A is correct because the automation rule must trigger on incident creation and evaluate whether the incident contains a specific user entity to run the playbook that disables the user in Microsoft Entra ID. This ensures the playbook only executes when the relevant entity is present, aligning with the requirement to automate a response based on a compromised user entity.

Answer

When alert is generated, and the alert contains a user entity.

Answer

When incident is created with severity high, then run the playbook.

Answer

When playbook is triggered manually from the incident details page.

Question 11

A SOC analyst wants to create a watchlist in Microsoft Sentinel from a CSV file that contains IP addresses. The analyst needs to configure the watchlist so that it can be efficiently queried using IP address comparison operators (e.g., IP prefix matching). Which data type should be set for the key column?

Accepted Answer

ipaddress. The 'ipaddress' data type is correct because it enables Microsoft Sentinel to parse and index the column values as IP addresses, allowing efficient use of IP-specific operators such as 'has_ip_prefix()' for prefix matching. Without this type, the watchlist would treat IPs as plain strings, preventing optimized IP comparison queries.

Answer

string

Answer

dynamic

Answer

guid

Question 12

An organization has connected a Palo Alto Networks firewall to Microsoft Sentinel using the Common Event Format (CEF) connector via a Linux log forwarder. The analyst notices that some expected firewall logs are missing in Sentinel. Which troubleshooting step should be performed first to check if the logs are reaching the Sentinel workspace?

Accepted Answer

Run a KQL query in the Sentinel Logs workspace: CommonSecurityLog | where TimeGenerated > ago(1h) | take 10. Option A is correct because the first step in troubleshooting missing logs in Microsoft Sentinel is to verify whether the logs are actually reaching the workspace. Running a KQL query against the CommonSecurityLog table (which stores CEF data) with a recent time filter confirms if any CEF logs have been ingested. If the query returns results, the issue lies elsewhere (e.g., parsing or missing events); if it returns no results, the problem is upstream (connector, forwarder, or source). This step isolates the problem to the Sentinel ingestion pipeline before investigating network or configuration issues.

Answer

Check the firewall configuration to ensure syslog forwarding is enabled and pointing to the correct Linux forwarder

Answer

Verify network connectivity between the firewall and the Linux forwarder on port 514 (or the configured port)

Answer

Restart the Log Analytics agent on the Linux forwarder

Question 13

A SOC analyst wants to create a Microsoft Sentinel scheduled analytics rule that alerts when a user from a critical department (e.g., Finance) logs on from an IP address that is not in the company's approved IP address ranges. The analyst has an Azure Sentinel watchlist named 'FinanceApprovedIPs' containing the allowed IP ranges. Which KQL operator should be used in the rule's query to efficiently check if the IP address from SigninLogs falls within any of the watchlist ranges?

Accepted Answer

join kind=inner (watchlist) on $left.IPAddress $right.IPRange with condition using ipv4_is_in_range() or ipv4_lookup(). Option A is correct because the `ipv4_lookup()` function (or `ipv4_is_in_range()` used with a join) is specifically designed to efficiently check whether an IP address falls within a range defined in a watchlist. In Microsoft Sentinel, watchlists store data as tables, and `ipv4_lookup()` performs a range-based lookup using CIDR notation, which is far more efficient than string-based or exact-match operators. This allows the query to match the `IPAddress` from `SigninLogs` against the `IPRange` column in the `FinanceApprovedIPs` watchlist without iterating over every possible address.

Answer

where IPAddress has any (watchlist)

Answer

where IPAddress in (watchlist)

Answer

where IPAddress startswith (watchlist)

Question 14

An organization uses Microsoft Sentinel to monitor Microsoft Entra ID sign-ins. A SOC analyst creates a scheduled analytics rule that runs every 15 minutes and uses the following KQL query: SigninLogs | where TimeGenerated > ago(30m) | summarize count() by IPAddress | where count_ > 10. The rule is intended to detect brute-force attacks from a single IP address. However, the analyst notices that alerts are generated even when IP addresses are within the company's trusted corporate network range. What is the most appropriate fix to reduce false positives?

Accepted Answer

Modify the query to exclude IP addresses from the corporate network by adding '| where IPAddress notin (dynamic(['10.0.0.0/8', '172.16.0.0/12', '192.168.0.0/16']))' or by using a watchlist. Option A is correct because the query currently counts all sign-in attempts, including those from trusted corporate IP ranges, which generates false positives for brute-force detection. By adding a filter to exclude corporate IP addresses (e.g., RFC 1918 ranges) or using a watchlist, the rule only alerts on external IPs that exceed the threshold, reducing noise. This directly addresses the root cause—internal traffic being incorrectly flagged—without altering detection logic or data sources.

Answer

Increase the threshold from 10 to 20 failed attempts

Answer

Decrease the rule's run frequency to every 5 minutes

Answer

Change the data source to AADNonInteractiveUserSignInLogs

Question 15

A SOC analyst wants to automate a response in Microsoft Sentinel: whenever an incident is created that contains a compromised user entity (e.g., a user whose credentials were used in a breach), a playbook should run to disable that user in Microsoft Entra ID. Which condition should be configured in the automation rule to trigger this playbook?

Accepted Answer

Set the condition to 'When incident is created with entity type Account'.. Option C is correct because the automation rule must trigger when an incident is created with an entity type of 'Account' to match the compromised user entity. In Microsoft Sentinel, a user whose credentials were used in a breach is represented as an 'Account' entity, not an 'IP' or 'Host'. The playbook to disable the user in Microsoft Entra ID requires this entity type to pass the user principal name (UPN) or object ID to the action.

Answer

Set the trigger to 'When incident is created' with no additional condition.

Answer

Set the condition to 'When incident is created with entity type IP'.

Answer

Set the condition to 'When incident is updated with entity type Host'.