SC-200 Security Analytics & Automation 2 — Questions and Answers
Question 1: A SOC analyst needs to automatically close low-fidelity alerts in Microsoft Sentinel after 7 days if no activity occurs. Which automation feature should they configure?
- Playbook triggered on alert creation
- Automation rule with 'Close incident' action after time condition (Correct answer)
- Workbook with scheduled refresh
- Analytic rule with suppression enabled
Correct answer: Automation rule with 'Close incident' action after time condition
Automation rules in Sentinel support time-based conditions and can automatically close incidents meeting specified criteria.
Question 2: Which KQL operator is used in Microsoft Sentinel to join two tables and return only rows that have matching values in both tables?
- union
- join kind=leftouter
- join kind=inner (Correct answer)
- lookup
Correct answer: join kind=inner
join kind=inner returns only rows with matches in both the left and right tables.
Question 3: A playbook in Microsoft Sentinel needs to enrich an incident with threat intelligence data from an external API. Which Logic Apps connector action is most appropriate?
- HTTP action to call the external REST API (Correct answer)
- Azure Function with managed identity
- Service Bus trigger
- Event Hub output connector
Correct answer: HTTP action to call the external REST API
The HTTP action in Logic Apps allows playbooks to call external REST APIs to retrieve enrichment data.
Question 4: What does the 'bag_unpack' plugin do in a KQL query within Microsoft Sentinel?
- Decompresses compressed log data
- Expands a dynamic property bag column into separate columns (Correct answer)
- Unpacks nested arrays into rows
- Decodes base64-encoded fields
Correct answer: Expands a dynamic property bag column into separate columns
bag_unpack expands a dynamic (JSON) property bag into individual columns, making nested fields queryable.
Question 5: An analyst wants to detect when a user logs in from two different countries within 30 minutes. Which Microsoft Sentinel analytic rule technique best achieves this?
- Threshold rule counting login events
- Fusion rule correlating multiple alerts
- Scheduled rule using 'arg_max' and time-windowed joins (Correct answer)
- Anomaly rule with built-in ML model
Correct answer: Scheduled rule using 'arg_max' and time-windowed joins
A scheduled analytic rule using joins with time windows and arg_max can identify impossible travel by comparing login geolocations within a time frame.
Question 6: In Microsoft Defender XDR advanced hunting, which table contains information about email attachments and their verdicts?
- EmailEvents
- EmailAttachmentInfo (Correct answer)
- UrlClickEvents
- EmailPostDeliveryEvents
Correct answer: EmailAttachmentInfo
EmailAttachmentInfo stores details about email attachments including file names, SHA256 hashes, and malware verdicts.
Question 7: A security team wants to measure the average time to close incidents in Microsoft Sentinel over the past 30 days. Which KQL function calculates the duration between two datetime fields?
- datediff()
- datetime_diff() (Correct answer)
- totimespan()
- datetime_add()
Correct answer: datetime_diff()
datetime_diff() computes the difference between two datetime values in a specified unit such as hours or minutes.
SC-200 Security Analytics & Automation 2
A SOC analyst needs to automatically close low-fidelity alerts in Microsoft Sentinel after 7 days if no activity occurs.
Which automation feature should they configure?