SC-200 Governance & Compliance 3 — Questions and Answers
Question 1: A security team needs to continuously monitor resource configurations against CIS benchmarks. Which Microsoft service provides this capability natively?
- Microsoft Sentinel
- Microsoft Defender for Cloud with security policies (Correct answer)
- Azure Monitor Alerts
- Microsoft Defender for Endpoint
Correct answer: Microsoft Defender for Cloud with security policies
Microsoft Defender for Cloud provides built-in security policies mapped to CIS benchmarks and continuously assesses resource compliance against them.
Question 2: An analyst needs to review all changes made to Azure Role-Based Access Control (RBAC) assignments in the last 30 days. Where should they look?
- Microsoft Sentinel AuditLogs table
- Azure Activity Log filtered by role assignment operations (Correct answer)
- Azure AD Sign-in logs
- Microsoft Defender for Cloud alerts
Correct answer: Azure Activity Log filtered by role assignment operations
Azure Activity Log captures all management-plane operations including RBAC role assignment changes, filterable by operation type and time range.
Question 3: Which Sentinel data connector is required to ingest Azure Active Directory audit and sign-in logs into Microsoft Sentinel?
- Azure Activity connector
- Azure Active Directory connector (Correct answer)
- Microsoft 365 Defender connector
- Azure AD Identity Protection connector
Correct answer: Azure Active Directory connector
The Azure Active Directory data connector in Sentinel ingests AAD audit logs and sign-in logs for identity-related compliance monitoring.
Question 4: A compliance requirement mandates that privileged access to Azure resources must use multi-factor authentication. Which tool enforces this at the policy level?
- Microsoft Sentinel analytics rule
- Azure AD Conditional Access policy (Correct answer)
- Microsoft Defender for Identity policy
- Azure Policy deny assignment
Correct answer: Azure AD Conditional Access policy
Azure AD Conditional Access policies can require MFA for privileged roles and high-risk sign-ins, enforcing authentication standards at the identity plane.
Question 5: In the context of SC-200, what is the purpose of the MITRE ATT&CK framework mapping in Microsoft Sentinel analytics rules?
- To automatically block detected threats
- To categorize detections by adversary tactics and techniques for coverage assessment (Correct answer)
- To generate compliance reports for regulators
- To score the severity of individual alerts
Correct answer: To categorize detections by adversary tactics and techniques for coverage assessment
Mapping analytics rules to MITRE ATT&CK tactics and techniques helps SOC teams assess detection coverage and identify gaps across the attack lifecycle.
Question 6: An organization's compliance policy requires that all Azure storage accounts have secure transfer (HTTPS) enabled. Which approach automatically remediates non-compliant accounts?
- Azure Policy with DeployIfNotExists effect (Correct answer)
- Microsoft Sentinel playbook triggered on alert
- Defender for Cloud manual remediation
- Azure Blueprints artifact
Correct answer: Azure Policy with DeployIfNotExists effect
Azure Policy with the DeployIfNotExists effect can automatically deploy configurations to remediate non-compliant resources, such as enabling HTTPS on storage accounts.
Question 7: A security analyst must demonstrate that no lateral movement techniques (MITRE T1021) went undetected over the past quarter. Which Sentinel feature helps build this evidence?
- Threat intelligence import
- Coverage map against MITRE ATT&CK in Sentinel Content Hub (Correct answer)
- Incident comments and audit trail
- Watchlist lookups
Correct answer: Coverage map against MITRE ATT&CK in Sentinel Content Hub
The MITRE ATT&CK coverage map in Sentinel Content Hub shows which tactics and techniques have active detection rules, supporting gap analysis and audit evidence.
SC-200 Governance & Compliance 3
A security team needs to continuously monitor resource configurations against CIS benchmarks.
Which Microsoft service provides this capability natively?