Microsoft Security Operations Analyst SC-200 Exam Questions

Page: 1 / 14
Total 408 questions
Question 1

You have an Azure subscription that uses Microsoft Defender for Cloud.

You have a GitHub account named Account1 that contains 10 repositories.

You need to ensure that Defender for Cloud can assess the repositories in Account1.

What should you do first in the Microsoft Defender for Cloud portal?



Answer : A

To allow Microsoft Defender for Cloud to assess GitHub repositories, you must first add GitHub as an environment in the Defender for Cloud portal.

Defender for Cloud supports connecting to external DevOps environments --- including GitHub and Azure DevOps --- to assess code repositories for security issues such as exposed secrets, vulnerable dependencies, or misconfigurations.

The connection process begins by selecting ''Add environment'' and then choosing GitHub. After authorization via OAuth to your GitHub account, Defender for Cloud scans the repositories to provide security posture assessments and recommendations.

Other options are not correct because:

Enable security policies: Used for configuring compliance and standards within subscriptions, not external code repositories.

Enable integrations: General connector setup, but GitHub integration specifically starts through Add environment.

Enable a plan: Plans (e.g., Defender for Servers, Defender for App Service) control billing and coverage scope, not onboarding.

Correct Answer: A. Add an environment


Question 2

You need to deploy the native cloud connector to Account1 to meet the Microsoft Defender for Cloud requirements. What should you do in Account! first?



Answer : B

When connecting an Amazon Web Services (AWS) account to Microsoft Defender for Cloud using the native cloud connector, the very first requirement is to allow Defender for Cloud to access AWS resources securely. According to official Microsoft Defender for Cloud documentation, this is accomplished by creating an AWS Identity and Access Management (IAM) role that grants Microsoft Defender for Cloud the necessary permissions to read configuration and security data from the AWS environment.

Here's the detailed process based on Microsoft documentation:

1 Create an IAM Role in AWS:

In the AWS console, you create an IAM role that establishes a trust relationship with Microsoft Defender for Cloud's AWS connector. The trust policy allows Azure's Defender for Cloud service principal to assume the role securely.

2 Attach the Required Policies:

The IAM role is then granted read-only permissions by attaching the Microsoft-provided policy template. This policy enables Defender for Cloud to assess AWS resources, collect security configuration data, and generate security recommendations.

3 Connect the AWS Account in Defender for Cloud:

After the IAM role is in place, you return to Azure and complete the connector setup by providing the Role ARN (Amazon Resource Name). Defender for Cloud then uses this role to continuously monitor and assess the AWS environment.

Options such as creating an AWS user or configuring AWS Security Hub are subsequent integration or enhancement steps, not the first action in setting up the native connector. Deploying the SSM agent is only required for enabling Defender for Servers on AWS EC2 instances, not for the initial connector setup.

Therefore, the correct answer is B. Create an Access control (IAM) role for Defender for Cloud.


Question 3

You are investigating an incident in Azure Sentinel that contains more than 127 alerts.

You discover eight alerts in the incident that require further investigation.

You need to escalate the alerts to another Azure Sentinel administrator.

What should you do to provide the alerts to the administrator?



Answer : D

In Microsoft Sentinel, when you need to escalate or transfer responsibility for an incident (which can include multiple alerts), the proper method is to assign the incident to another user or group. Assigning updates the Owner field, notifying the designated analyst or administrator responsible for further investigation.

Sharing the incident URL (B) only provides a link but does not change ownership or trigger notifications.

Creating a scheduled query rule (C) or incident creation rule (A) defines detection logic, not escalation workflow.


Question 4

You have a Microsoft 365 E5 subscription that uses Microsoft Copilot for Security. You have a Copilot for Security workspace that uses the following plugins:

* Microsoft Entra

* Microsoft Defender XDR

From the Microsoft Defender portal, you use Copilot for Security to investigate a reported incident. You need to run a promptbook that will include information from Microsoft Entra ID Protection in the investigation. What should you do first?



Answer : C


Question 5

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You are configuring Microsoft Defender for Identity integration with Active Directory.

From the Microsoft Defender for identity portal, you need to configure several accounts for attackers to exploit.

Solution: From Azure Identity Protection, you configure the sign-in risk policy.

Does this meet the goal?



Answer : B

Azure Identity Protection is used to detect and remediate risky sign-ins based on user behavior and risk levels, but it does not configure decoy or Honeytoken accounts. Honeytoken accounts are a Defender for Identity feature, not an Identity Protection feature.

The solution described (configuring sign-in risk policies in Azure Identity Protection) relates to conditional access and risk-based sign-in responses, not to creating monitored decoy accounts.

Hence, the goal of configuring several accounts for attacker exploitation (Honeytoken monitoring) is not met by this solution.


Question 6

You have an Azure subscription that contains a virtual machine named VM1 and uses Microsoft Defender for Cloud Microsoft Defender for Cloud has automatic provisioning configured to use Azure Monitor Agent.

You need to create a custom alert suppression rule that will suppress false positive alerts for suspicious use of PowerShell on VM1. What should you do first?



Answer : B


Question 7

You have a Microsoft 365 E5 subscription.

Automated investigation and response (AIR) is enabled in Microsoft Defender for Office 365 and devices use full automation in Microsoft Defender for Endpoint.

You have an incident involving a user that received maIware-infected email messages on a managed device.

Which action requires manual remediation of the incident?



Answer : C


Page:    1 / 14   
Total 408 questions