SC-200 Practice Questions & Answers • ExamPrepare

Question 1

Overview

Adatum Corporation is a United States-based financial services company that has regional offices in New York, Chicago, and San Francisco.

Existing Environment

Identity Environment

The on-premises network contains an Active Directory Domain Services (AD DS) forest named corp.adatum.com that syncs with a Microsoft Entra tenant named adatum.com. All user and group management tasks are performed in corp.adatum.com. The corp.adatum.com domain contains a group named Group1 that syncs with adatum.com.

Licensing Status

All the users at Adatum are assigned a Microsoft 365 E5 license and a Microsoft Entra ID P2 license.

Cloud Environment

The cloud environment contains a Microsoft 365 subscription, an Azure subscription linked to the adatum.com tenant, and the resources shown in the following table.

Name	Type	Description
Sentinel1	Microsoft Sentinel workspace	Includes a custom hunting query named HuntingQuery1
Server2	Azure virtual machine	Runs Windows Server

On-premises Environment

The on-premises network contains the resources shown in the following table.

Name	Type	Description
Server1	Server	Runs Windows Server Is Azure Arc-enabled and has the Azure Monitor extension installed
Webapp1	Web service	An on-premises, public-facing HTTP/HTTPS web service that generates JSON output in response to GET HTTP requests
Infoblox1	Infoblox DNS service	A third-party DNS service appliance linked to Sentinel1 by using a data connector

Requirements

Planned Changes

Adatum plans to perform the following changes:

Implement a query named rulequery1 that will include the following KQL query.

AzureActivity

| where ResourceProviderValue == "MICROSOFT.CLOUDSHELL"

| where ActivityStatusValue == "Start"

| extend

Account_0_Name = tostring(split(Caller, '@', 0)[0]),

Account_0_UPNSuffix = tostring(split(Caller, '@', 1)[0])

| project Account_0_Name, Account_0_UPNSuffix, CallerIpAddress, TimeGenerated

Implement a Microsoft Sentinel scheduled rule that generates incidents based on rulequery1.

Microsoft Defender for Cloud Requirements

Adatum identifies the following Microsoft Defender for Cloud requirements:

The members of Group1 must be able to enable Defender for Cloud plans and apply regulatory compliance initiatives.
Microsoft Defender for Servers Plan 2 must be enabled on all the Azure virtual machines.
Server2 must be excluded from agentless scanning.

Microsoft Sentinel Requirements

Adatum identifies the following Microsoft Sentinel requirements:

Implement an Advanced Security Information Model (ASIM) query that will return a count of DNS requests that results in an NXDOMAIN response from Infoblox1.
Ensure that multiple alerts generated by rulequery1 in response to a single user launching Azure Cloud Shell multiple times are consolidated as a single incident.
Implement the Windows Security Events via the AMA data connector for Microsoft Sentinel and configure it to monitor the Security event log of Server1.
Ensure that incidents generated by rulequery1 are closed automatically if Azure Cloud Shell is launched by the company’s SecOps team.
Implement a custom Microsoft Sentinel workbook named Workbook1 that will include a query to dynamically retrieve data from Webapp1.
Implement a Microsoft Sentinel near-real-time (NRT) analytics rule that detects sign-ins to a designated break glass account.
Ensure that HuntingQuery1 runs automatically when the Hunting page of Microsoft Sentinel is accessed.
Ensure that higher than normal volumes of password resets for corp.adatum.com user accounts are detected.
Minimize the overhead associated with queries that use ASIM parsers.
Ensure that the Group1 members can create and edit playbooks.
Use built-in ASIM parsers whenever possible.

Business Requirements

Adatum identifies the following business requirements:

Follow the principle of least privilege whenever possible.
Minimize administrative effort whenever possible.

You need to meet the Microsoft Sentinel requirements for Group1.

Which role should you assign to Group1?

Microsoft Sentinel Playbook Operator
Automation Operator
Logic App Contributor
Microsoft Sentinel Automation Contributor

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 2

Overview

Adatum Corporation is a United States-based financial services company that has regional offices in New York, Chicago, and San Francisco.

Existing Environment

Identity Environment

The on-premises network contains an Active Directory Domain Services (AD DS) forest named corp.adatum.com that syncs with a Microsoft Entra tenant named adatum.com. All user and group management tasks are performed in corp.adatum.com. The corp.adatum.com domain contains a group named Group1 that syncs with adatum.com.

Licensing Status

All the users at Adatum are assigned a Microsoft 365 E5 license and a Microsoft Entra ID P2 license.

Cloud Environment

The cloud environment contains a Microsoft 365 subscription, an Azure subscription linked to the adatum.com tenant, and the resources shown in the following table.

Name	Type	Description
Sentinel1	Microsoft Sentinel workspace	Includes a custom hunting query named HuntingQuery1
Server2	Azure virtual machine	Runs Windows Server

On-premises Environment

The on-premises network contains the resources shown in the following table.

Name	Type	Description
Server1	Server	Runs Windows Server Is Azure Arc-enabled and has the Azure Monitor extension installed
Webapp1	Web service	An on-premises, public-facing HTTP/HTTPS web service that generates JSON output in response to GET HTTP requests
Infoblox1	Infoblox DNS service	A third-party DNS service appliance linked to Sentinel1 by using a data connector

Requirements

Planned Changes

Adatum plans to perform the following changes:

Implement a query named rulequery1 that will include the following KQL query.

AzureActivity

| where ResourceProviderValue == "MICROSOFT.CLOUDSHELL"

| where ActivityStatusValue == "Start"

| extend

Account_0_Name = tostring(split(Caller, '@', 0)[0]),

Account_0_UPNSuffix = tostring(split(Caller, '@', 1)[0])

| project Account_0_Name, Account_0_UPNSuffix, CallerIpAddress, TimeGenerated

Implement a Microsoft Sentinel scheduled rule that generates incidents based on rulequery1.

Microsoft Defender for Cloud Requirements

Adatum identifies the following Microsoft Defender for Cloud requirements:

The members of Group1 must be able to enable Defender for Cloud plans and apply regulatory compliance initiatives.
Microsoft Defender for Servers Plan 2 must be enabled on all the Azure virtual machines.
Server2 must be excluded from agentless scanning.

Microsoft Sentinel Requirements

Adatum identifies the following Microsoft Sentinel requirements:

Implement an Advanced Security Information Model (ASIM) query that will return a count of DNS requests that results in an NXDOMAIN response from Infoblox1.
Ensure that multiple alerts generated by rulequery1 in response to a single user launching Azure Cloud Shell multiple times are consolidated as a single incident.
Implement the Windows Security Events via the AMA data connector for Microsoft Sentinel and configure it to monitor the Security event log of Server1.
Ensure that incidents generated by rulequery1 are closed automatically if Azure Cloud Shell is launched by the company’s SecOps team.
Implement a custom Microsoft Sentinel workbook named Workbook1 that will include a query to dynamically retrieve data from Webapp1.
Implement a Microsoft Sentinel near-real-time (NRT) analytics rule that detects sign-ins to a designated break glass account.
Ensure that HuntingQuery1 runs automatically when the Hunting page of Microsoft Sentinel is accessed.
Ensure that higher than normal volumes of password resets for corp.adatum.com user accounts are detected.
Minimize the overhead associated with queries that use ASIM parsers.
Ensure that the Group1 members can create and edit playbooks.
Use built-in ASIM parsers whenever possible.

Business Requirements

Adatum identifies the following business requirements:

Follow the principle of least privilege whenever possible.
Minimize administrative effort whenever possible.

You need to configure event monitoring for Server1. The solution must meet the Microsoft Sentinel requirements.

What should you create first?

an Azure Event Grid topic
a Microsoft Sentinel scheduled query rule
a Microsoft Sentinel automation rule
a Data Collection Rule (DCR)

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 3

You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR.

You have a Microsoft Sentinel workspace.

Microsoft Sentinel data connectors are configured as shown in the following table.

Data connector	Collected log
Microsoft Entra ID	Audit logs Microsoft Graph activity logs
Microsoft 365	Microsoft Exchange Online Microsoft SharePoint Online Microsoft Teams

You use Microsoft Sentinel to investigate suspicious Microsoft Graph API activity related to Conditional Access policies.

You need to search for the following activities:

Downloads of the Conditional Access policies by using PowerShell
Updates to the Conditional Access policies by using the Microsoft Entra admin center

Which tables should you query for each activity? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point

Question 4

You have 100 on-premises servers that run Windows Server and do NOT have internet connectivity.

You have an Azure subscription that contains a dedicated monitoring server.

You have a Microsoft Sentinel workspace named Workspace1.

You need to ingest Windows event logs from the on-premises servers into Workspace1.

What should you do? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Question 5

You have an Azure subscription that contains two resource groups named RG1 and RG2. The subscription is linked to a Microsoft Entra tenant that contains a group named Group1. RG1 contains a Microsoft Sentinel workspace named Workspace1. RG2 contains an incident-trigger playbook named Playbook1.

You need to ensure that the members of Group1 can view incidents and update incident status in Workspace1. The solution must meet the following requirements:

Ensure that the Group1 members can run Playbook1 manually.
Prevent the Group1 members from editing analytics rules.
Prevent the Group1 members from editing Playbook1.
Follow the principle of least privilege.

Which role-based access control (RBAC) role should you assign to each resource group? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Question 6

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You are configuring Microsoft Sentinel.

You need to create an incident in Microsoft Sentinel when a sign-in to an Azure virtual machine from a malicious IP address is detected.

Solution: You create a livestream from a query.

Does this meet the goal?

Yes
No

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.