SC-200 Manage a security operations environment Practice Question

Correct answer & explanation

Option C is correct because the query uses a static list of IP addresses in the `in` operator but they are not wrapped in quotes as strings; `dynamic(['10.0.0.1', '192.168.1.1'])` is valid but the IPs are strings and should be compared as strings. However, the more critical issue is that the `queryPeriod` and `queryFrequency` are both 5 hours, and the `suppressionDuration` is also 5 hours, but suppression is disabled. The real problem is that the `triggerThreshold` is set to 0 and `triggerOperator` is GreaterThan, meaning it will trigger if any results are found. But if no incidents are created, the issue could be that the query is not returning results because the IP addresses are not in the log. However, the exhibit says matching events exist. Another possibility: the rule uses `SigninLogs` which is a table in Microsoft Entra ID, but the data source might not be connected. But the most likely reason is that the `queryPeriod` and `queryFrequency` are the same, which is correct. Actually, the exhibit shows `groupingConfiguration.enabled: false`, so each alert becomes an incident. But the `eventGroupingSettings.aggregationKind` is `SingleAlert`, meaning each alert is a single incident. If incidents are not created, it could be that the rule is not mapping entities correctly. However, the exhibit does not show entity mapping. Option C highlights that entity mapping is missing, which is required for incident creation in some versions of Sentinel. But wait, in Sentinel, incident creation does not strictly require entity mapping; it's recommended but not mandatory. The actual issue might be that the `query` is invalid because `IPAddress` is not a field in `SigninLogs`? Actually, `SigninLogs` has `IPAddress` field. Let's think: the query looks correct. But the rule is set to `createIncident: true`, so incidents should be created. The most plausible answer is that entity mapping is missing because without it, the incident might not be created properly in newer Sentinel versions? Actually, that's not true. The correct answer is that the `queryPeriod` and `queryFrequency` are the same, which is fine. Maybe the issue is that the `suppressionDuration` is set but not used. I think the most likely is that the query returns results but the incident creation fails due to missing entity mapping. I'll go with Option C. But the explanation should be clear.

Key principle: NAT direction and interface roles matter as much as the IP address mapping. Inside/outside designation controls which traffic is translated.