SC-200 Security Analytics & Automation 2

Question 1

A SOC analyst needs to automatically close low-fidelity alerts in Microsoft Sentinel after 7 days if no activity occurs. Which automation feature should they configure?

Accepted Answer

Automation rule with 'Close incident' action after time condition

Answer

Automation rules in Sentinel support time-based conditions and can automatically close incidents meeting specified criteria.

Question 2

Which KQL operator is used in Microsoft Sentinel to join two tables and return only rows that have matching values in both tables?

Accepted Answer

join kind=inner

Answer

join kind=inner returns only rows with matches in both the left and right tables.

Question 3

A playbook in Microsoft Sentinel needs to enrich an incident with threat intelligence data from an external API. Which Logic Apps connector action is most appropriate?

Accepted Answer

HTTP action to call the external REST API

Answer

The HTTP action in Logic Apps allows playbooks to call external REST APIs to retrieve enrichment data.

Question 4

What does the 'bag_unpack' plugin do in a KQL query within Microsoft Sentinel?

Accepted Answer

Expands a dynamic property bag column into separate columns

Answer

bag_unpack expands a dynamic (JSON) property bag into individual columns, making nested fields queryable.

Question 5

An analyst wants to detect when a user logs in from two different countries within 30 minutes. Which Microsoft Sentinel analytic rule technique best achieves this?

Accepted Answer

Scheduled rule using 'arg_max' and time-windowed joins

Answer

A scheduled analytic rule using joins with time windows and arg_max can identify impossible travel by comparing login geolocations within a time frame.

(SC-200) Microsoft Security Operations Analyst Practice Test

(SC-200) Microsoft Security Operations Analyst Practice Test

SC-200 Security Analytics & Automation 2