SC-200 Mitigate threats using Microsoft Sentinel Practice Test 7 — 15 Questions

Question 1

A SOC analyst wants to create a scheduled analytics rule in Microsoft Sentinel that runs every hour and detects multiple failed user login attempts from a single IP address within a 5-minute window. Which KQL function should be used in the query to group the failed events by 5-minute time intervals?

Accepted Answer

summarize count() by IPAddress, bin(TimeGenerated, 5m). Option A is correct because the `bin()` function in KQL is specifically designed to group data into fixed-size time buckets, such as 5-minute intervals. By using `summarize count() by IPAddress, bin(TimeGenerated, 5m)`, the query counts failed login attempts per IP address within each 5-minute window, which directly meets the requirement for a scheduled rule that detects multiple failures from a single IP in a 5-minute period.

Answer

summarize count() by IPAddress, TimeGenerated

Answer

extend interval = datetime_diff('minute', TimeGenerated, ago(5m))

Answer

scan with (match all events within 5m by IPAddress)

Question 2

A SOC analyst is building a scheduled analytics rule in Microsoft Sentinel to detect when a user is added to a privileged Microsoft Entra ID role (e.g., Global Administrator). Which two tables must be included in the KQL query to capture the role assignment event and to retrieve user details? (Choose 2.)

Accepted Answer

AADAuditLogs. AADAuditLogs captures all directory audit events, including role assignment activities such as adding a user to a privileged Microsoft Entra ID role. This table is essential because it records the 'Add member to role' operation with details like the target user, role name, and initiating actor, which are required to detect the security event.

Answer

SigninLogs

Answer

AzureActivity

Question 3

A SOC manager wants to quickly view the number of incidents generated in Microsoft Sentinel over the past 7 days, grouped by Azure subscription. Which KQL query should be used on the SecurityIncident table?

Accepted Answer

SecurityIncident | where CreatedTime > ago(7d) | summarize count() by SubscriptionId. Option A is correct because the SecurityIncident table stores incident records, and the CreatedTime field records when each incident was generated. Filtering with `where CreatedTime > ago(7d)` limits results to the past 7 days, and `summarize count() by SubscriptionId` groups the count by the Azure subscription that owns the resources involved in the incident. This directly meets the SOC manager's requirement to view the number of incidents per subscription over the last week.

Answer

SecurityAlert | where TimeGenerated > ago(7d) | summarize count() by SubscriptionId

Answer

SecurityIncident | where TimeGenerated > ago(7d) | summarize count() by SubscriptionId

Answer

SecurityIncident | where CreatedTime > ago(7d) | summarize count() by WorkspaceSubscriptionId

Question 4

A SOC analyst is configuring a multi-region deployment of Microsoft Sentinel. The requirement is to ingest security logs from Azure resources located in three different Azure regions. The analyst needs to create the workspace in one region and then use cross-workspace queries to view data from all regions. What is the correct sequence of steps?

Accepted Answer

Step 1: Create Log Analytics workspaces in each region. Step 2: Enable Sentinel on each workspace. Step 3: Connect data sources. Step 4: Configure cross-workspace queries.. Option A is correct because to use cross-workspace queries in Microsoft Sentinel, you must first create a Log Analytics workspace in each region, enable Sentinel on each workspace, connect the data sources to their respective regional workspaces, and then configure cross-workspace queries to unify the data. This sequence ensures that each region's logs are ingested locally, which is required for cross-workspace queries to reference them via the `workspace()` expression.

Answer

Step 1: Enable Sentinel in one region. Step 2: Create workspaces in other regions. Step 3: Connect data sources. Step 4: Configure cross-workspace queries.

Answer

Step 1: Connect data sources. Step 2: Create workspaces. Step 3: Enable Sentinel. Step 4: Configure cross-workspace queries.

Answer

Step 1: Create a central workspace. Step 2: Enable Sentinel on it. Step 3: Connect data sources from all regions to the central workspace. Step 4: Configure cross-workspace queries.

Question 5

A SOC analyst creates a scheduled analytics rule in Microsoft Sentinel to detect anomalous Microsoft Entra ID sign-ins. The rule uses the SigninLogs table and runs every 15 minutes. The analyst wants to alert when a user signs in from a country that is not in the allowed list (['US', 'CA']). Which KQL query pattern should be used in the rule?

Accepted Answer

SigninLogs | where Location.countryOrRegion !in (dynamic(['US','CA'])). Option A is correct because the SigninLogs table stores the sign-in location in the `Location.countryOrRegion` field, which is a nested property of the `Location` dynamic object. The KQL operator `!in` with `dynamic(['US','CA'])` correctly performs a case-sensitive comparison against a list of string values, ensuring that only sign-ins from countries outside the allowed list trigger the alert.

Answer

SigninLogs | where Country !in ('US','CA')

Answer

SigninLogs | where location != 'US' and location != 'CA'

Answer

SigninLogs | where geoLocation !in (dynamic(['US','CA']))

Question 6

A SOC analyst creates a watchlist in Microsoft Sentinel from a CSV file containing IP ranges (10.0.0.0/16) and a tag. The analyst wants to use this watchlist in a KQL query to check if a sign-in IP is within the ranges. Which KQL function should be used?

Accepted Answer

_GetWatchlist('name') and use the ipv4_is_in_range function with the watchlist as a parameter. Option C is correct because the `ipv4_is_in_range` function is designed to check whether an IPv4 address falls within a specified CIDR range. When combined with `_GetWatchlist('name')`, you can iterate over the watchlist entries and use `ipv4_is_in_range` to compare the sign-in IP against each range. This is the only approach that correctly handles CIDR notation (e.g., 10.0.0.0/16) rather than performing string matching or exact value comparison.

Answer

_GetWatchlist('name') and use the has operator

Answer

_GetWatchlist('name') and use the in operator

Answer

_GetWatchlist('name') and use the contains operator

Question 7

A SOC analyst wants to create an automation rule in Microsoft Sentinel that runs a playbook to disable a user's Microsoft Entra ID account every time an incident is created with a specific 'User' entity (e.g., compromised user). Which condition should be configured in the automation rule?

Accepted Answer

When incident is created, if entity type equals 'Account' and entity value equals 'user@domain.com'. Option A is correct because the automation rule must trigger specifically when an incident is created that contains a 'User' entity with a specific value (e.g., user@domain.com). By setting the condition to 'entity type equals Account' and 'entity value equals user@domain.com', the rule ensures the playbook only runs for incidents involving that exact compromised user, preventing unnecessary or incorrect automation. This matches the requirement to disable a specific user's Microsoft Entra ID account based on the entity present in the incident.

Answer

When incident is created, if the incident contains a 'User' entity

Answer

When incident is created with severity High

Answer

When incident is created, the playbook automatically runs without conditions

Question 8

A SOC analyst is creating a scheduled analytics rule in Microsoft Sentinel to detect potential account compromise. The rule should trigger when a user account is created in Microsoft Entra ID and, within one hour, that same account is used to sign in from an unfamiliar location. The queries use the AuditLogs table for account creation and the SigninLogs table for sign-ins. Which KQL operator should be used to correlate these two events from different tables within a specific time window?

Accepted Answer

join. The correct answer is B (join) because the scenario requires correlating two events from different tables (AuditLogs and SigninLogs) based on a common field (e.g., UserPrincipalName) and within a specific time window (one hour). The join operator in KQL allows you to combine rows from two tables by matching keys, and you can use the 'where' clause on the time fields to enforce the one-hour window. This is the only operator that supports row-wise correlation across tables with a time constraint.

Answer

where

Answer

union

Answer

summarize

Question 9

A SOC analyst wants to use Microsoft Sentinel's User and Entity Behavior Analytics (UEBA) to identify a user who is performing suspicious actions, such as accessing a high number of resources outside of their normal pattern. What must be enabled for UEBA to function correctly in Microsoft Sentinel?

Accepted Answer

Enable Microsoft Entra ID Identity Protection and ensure the Microsoft Sentinel workspace has UEBA enabled.. UEBA in Microsoft Sentinel relies on data sources that provide user activity logs, such as Microsoft Entra ID Audit Logs and Sign-in Logs, to establish behavioral baselines and detect anomalies. However, for UEBA to function correctly, the Microsoft Sentinel workspace must have UEBA enabled at the workspace level, and Microsoft Entra ID Identity Protection must be enabled to provide the necessary risk signals and enrichments that feed into the anomaly detection engine. Without Identity Protection, UEBA lacks the contextual risk data required to identify suspicious actions like accessing a high number of resources outside normal patterns.

Answer

Enable Microsoft Entra ID Audit Logs and Sign-in Logs streaming directly to the Sentinel workspace.

Answer

Install the Microsoft 365 Defender connector and enable UEBA in Microsoft 365 Defender.

Answer

Deploy the Azure Sentinel UEBA solution from Content Hub and configure watchlists for user baselines.

Question 10

A Microsoft Sentinel scheduled analytics rule detects impossible travel but creates too many duplicate incidents for the same user within a short period. Which two rule settings should you tune? (Choose 2.)

Accepted Answer

Configure event grouping or incident grouping by user entity.. Option A is correct because configuring event grouping or incident grouping by user entity consolidates multiple alerts for the same user into a single incident, reducing duplicate incidents. In Microsoft Sentinel, this setting controls how alerts are aggregated into incidents based on entity fields like user account, ensuring that a burst of impossible travel alerts for the same user generates one incident instead of many.

Answer

Disable the data connector.

Answer

Delete the Log Analytics workspace.

Question 11

A KQL query detects brute-force attempts by summarizing failed sign-ins by user, IP address, and five-minute time bins. Which operator is most appropriate for this aggregation?

Accepted Answer

summarize.. The `summarize` operator is the correct choice because it groups rows by specified columns (user, IP address, and five-minute time bins) and applies an aggregation function (e.g., `count()`) to detect brute-force patterns. In KQL, `summarize` is the only operator that can create time-binned aggregations using the `bin()` function, which is essential for grouping failed sign-ins into fixed five-minute intervals. This directly supports the brute-force detection requirement by counting failed attempts per user/IP/time window.

Answer

project-away.

Answer

parse_json.

Answer

extend.

Question 12

A Microsoft Sentinel incident contains alerts from multiple analytics rules. The analyst suspects the same compromised account performed impossible travel followed by suspicious mailbox access. Which two actions best help correlate identity and mailbox activity?

Accepted Answer

Query SigninLogs for the account around the alert timestamps. Option A is correct because querying SigninLogs for the account around the alert timestamps directly retrieves Azure AD authentication events, which are essential for identifying the source IP addresses, locations, and timestamps that define the impossible travel pattern. This data is the primary evidence for the first part of the suspected compromise.

Answer

Delete the incident to force it to regenerate

Answer

Disable all analytics rules that contributed alerts

Question 13

Arrange the steps to run a Microsoft 365 Defender advanced hunting query and create a custom detection rule from it.

Question 14

Order the steps to configure a Microsoft Sentinel analytics rule using a scheduled query.

Question 15

Arrange the steps to configure a Microsoft Sentinel playbook (automation) using Azure Logic Apps.