Microsoft Security Operations Analyst SC-200 Exam Questions

Page: 1 / 14
Total 391 questions
Question 1

You need to correlate data from the SecurityEvent Log Anarytks table to meet the Microsoft Sentinel requirements for using UEBA. Which Log Analytics table should you use?



Answer : D

User and Entity Behavior Analytics (UEBA) in Microsoft Sentinel correlates security events with identity data to build behavioral baselines. UEBA enriches security signals with identity context from Azure AD, Defender for Identity, and other connected identity sources.

The IdentityInfo table in Log Analytics stores user account metadata and enrichment information, such as department, group membership, job title, and account status. This table is used to correlate events from the SecurityEvent table and others to link activity to known users and entities.

Microsoft documentation states:

''The IdentityInfo table contains enriched identity information from connected identity providers. It is used by UEBA to correlate with the SecurityEvent table and other identity-related logs.''


Question 2

You use Microsoft Sentinel.

You need to receive an alert in near real-time whenever Azure Storage account keys are enumerated. Which two actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point



Answer : B, C

In Microsoft Sentinel, to receive near real-time alerts when specific activities occur---such as Azure Storage account key enumeration---you combine two Sentinel capabilities: Livestream and Analytics rules.

Livestream provides real-time monitoring of events based on KQL queries. According to Microsoft Sentinel documentation, Livestream ''lets you run queries continuously and get notified immediately when results match specific conditions.'' This allows SOC analysts to detect ongoing attacks (such as credential enumeration) as they happen.

Analytics rules provide ongoing automated monitoring and alerting. A scheduled analytics rule runs periodically (for example, every 5 minutes) and generates an alert when a defined condition is met. The ''Storage account keys enumerated'' event comes from Microsoft Defender for Cloud (or Azure Activity) logs, so you can define a KQL-based rule to detect these activities.

Therefore:

B (Analytics rule): to automatically generate alerts when the condition is met.

C (Livestream): to receive those alerts or detections in near real-time as they occur.

Together, these meet the requirement for near real-time detection and alerting with minimal manual monitoring.


Question 3

You have an Azure subscription that contains a Microsoft Sentinel workspace. The workspace contains a Microsoft Defender for Cloud data connector. You need to customize which details will be included when an alert is created for a specific event. What should you do?



Answer : C

The core requirement is to customize details included when an alert is created for a specific event. In Microsoft Sentinel, the most effective and granular way to enrich, map, and customize alert fields is by using a Scheduled Query Rule within the Analytics section.

Customization for Microsoft Defender Alerts

Defender for Cloud Data Connector: This connector, categorized as a Microsoft Security rule type, automatically imports alerts and incidents generated by Microsoft Defender for Cloud into the Microsoft Sentinel SecurityAlert table. These imported alerts have a predefined schema and initial set of details.

Customization Limitation: You cannot modify the alert schema or customize the details directly on the Microsoft Defender for Cloud data connector itself (Option A).

Scheduled Query Rule for Enrichment: To customize the alert details, an analyst must run a custom Kusto Query Language (KQL) query against the ingested security alerts (in the SecurityAlert table) or related raw log events. This query is packaged within a Scheduled Query Rule (Option C).

The Role of a Scheduled Query Rule

Scheduled query rules provide the necessary Alert enrichment features to customize alert properties:

Custom Details (Surface Custom Event Details): This feature allows an analyst to pull any field from the KQL query result and display it prominently in the resulting Sentinel alert and incident.

Customize Alert Details: This feature allows an analyst to override the default properties of the alert, such as:

Alert Name Format: Dynamically change the alert title to include specific event values (e.g., Alert from {{ProviderName}}: {{AccountName}} failed to sign in to computer {{ComputerName}}).

Alert Description Format: Embed custom messages or specific log data into the description.

AlertSeverity, Tactics, ConfidenceScore, AlertLink, and other key fields: Use values from the query results to set these properties dynamically for each alert instance.

By creating a scheduled query rule that specifically queries the Defender for Cloud alerts and uses KQL to extract or calculate the required custom information, an analyst can then apply the Alert details and Custom details features on the rule's Set rule logic tab to meet the customization requirement.


Question 4

You have a Microsoft 365 subscription that uses Microsoft Defender XDR. All endpoint devices are onboarded to Microsoft Defender for Endpoint.

You have an Azure subscription that contains a Microsoft Sentinel workspace named Workspace 1. All Microsoft Defender XDR events are ingested into Workspace1.

You have a Microsoft Entra tenant.

You create a KQL query named query1 that searches device logs for a known vulnerability.

You need to ensure that query1 runs every hour. The solution must minimize administrative effort.

What should you configure?



Answer : D

To have your query1 run every hour in a Microsoft Sentinel environment, you should configure it as an analytics rule---specifically a scheduled query (custom detection) rule. Microsoft's official documentation for Sentinel describes ''scheduled analytics rules'' as queries that you configure to run on a recurring schedule, with a defined lookback period, and trigger alerts if the query results meet the rule criteria. Those scheduled rules are the mechanism by which KQL queries are periodically executed automatically.

When you create an analytics rule in Sentinel, you supply the query (i.e. query1) and you specify the recurrence (for example, every hour). Once configured as such, Sentinel takes care of executing it on schedule with minimal ongoing administrative intervention. This aligns exactly with ''minimize administrative effort.''

Among the answer choices:

An automation rule is used to act upon alerts (for example, route, suppress, or apply playbooks) but does not itself schedule periodic queries.

Automated Investigation and Response (AIR) is part of Defender for Endpoint's automated remediation workflow and is used for responding to alerts on endpoints---not for scheduling general KQL hunting queries.

A watchlist is a static data reference (list of values) you can use within queries or rules but does not itself execute queries on a schedule.

A custom detection (analytics) rule is exactly what you would use to wrap query1 into a scheduled operation.

Thus, converting query1 into a custom detection rule (i.e. a scheduled analytics rule) is the correct choice.

From Microsoft SecOps and Sentinel rule documentation: scheduled rules are based on Kusto queries configured to run at regular intervals over a lookback period, and if results cross a threshold, an alert is triggered. The rule's scheduling frequency (such as hourly) is part of rule configuration. This model ensures your query1 gets executed every hour automatically with minimal manual work.


Question 5

You have a Microsoft 365 B5 subscription that contains a user named User1. The subscription uses Microsoft 365 Copilot for Security. Copilot for Security uses the Sentinel plugin. User1 is assigned the Copilot Contributor role.

During an investigation, User1 submits a prompt and receives a notification that Copilot for Security cannot respond to requests because the security compute unit (SCU) usage is nearing the provisioned capacity limit.

You need to ensure that User1 can use Copilot for Security to generate a successful response.

What should User1 do?



Answer : D

Microsoft 365 Copilot for Security uses Security Compute Units (SCUs) to determine available processing capacity for AI-driven operations. Each SCU represents a fixed amount of compute resources for handling Copilot for Security prompts and plugin interactions (like Sentinel).

When a notification appears stating that ''SCU usage is nearing the provisioned capacity limit,'' it means that the organization's current SCU allocation is insufficient for ongoing demand. To restore full response functionality, the tenant admin (or authorized role) must increase the number of provisioned SCUs.

Microsoft documentation states:

''If Copilot for Security indicates that requests cannot be processed due to SCU capacity, increase your provisioned SCUs in the Microsoft 365 admin center or Azure portal to meet demand.''

The other options do not resolve the issue:

Opening a second session does not add capacity.

Waiting does not guarantee SCU availability.

The Optimization Workbook relates to Sentinel performance, not Copilot SCU allocation.

Answe r: D. Update the provisioned SCUs


Question 6

You have an Azure subscription that contains a user named User1 and a Microsoft Sentinel workspace named WS1. WS1 uses Microsoft Defender for Cloud.

You have the Microsoft security analytics rules shown in the following table.

User1 performs an action that matches Rule1, Rule2, Rule3, and Rule4. How many incidents will be created in WS1?



Answer : A

Microsoft Sentinel ''Microsoft security'' analytics rules (for products like Defender for Cloud) create incidents from alerts generated by that product. Even if multiple identical Microsoft security rules exist for the same product, a single incoming alert will result in one incident in the workspace, not one per rule.


Question 7

You have a Microsoft 365 subscription that uses Microsoft Defender for Office 365.

You have Microsoft SharePoint Online sites that contain sensitive documents. The documents contain customer account numbers that each consists of 32 alphanumeric characters.

You need to create a data loss prevention (DLP) policy to protect the sensitive documents. What should you use to detect which documents are sensitive?



Answer : D

In Microsoft 365 Security and Compliance (now part of Microsoft Purview), Data Loss Prevention (DLP) policies use Sensitive Information Types (SITs) to detect confidential data. These SITs rely on a combination of methods---primarily regular expressions (RegEx), keyword dictionaries, and validation checks---to identify patterns such as credit card numbers, national IDs, or custom formats.

Since the scenario specifies that customer account numbers are 32-character alphanumeric strings (not a predefined sensitive type in Microsoft 365), the appropriate detection mechanism is to create a custom Sensitive Information Type using RegEx pattern matching. Microsoft documentation explicitly states:

''You can create custom sensitive information types that use a regular expression to define your own pattern for detecting sensitive data.''

Using RegEx, you can define a pattern such as [A-Za-z0-9]{32} to match exactly 32 alphanumeric characters. SharePoint search (A) cannot perform sensitivity classification, hunting queries (B) are for threat detection, and Azure Information Protection (C) applies labels after data is classified. Therefore, RegEx pattern matching is the correct choice to detect sensitive documents in this case.


Page:    1 / 14   
Total 391 questions