SC-200 Security Analytics & Automation 3 — Questions and Answers
Question 1: Which Microsoft Sentinel feature allows analysts to visually investigate the relationships between entities such as accounts, IPs, and hosts involved in an incident?
- Workbooks
- Investigation graph (Correct answer)
- Hunting queries
- Notebooks
Correct answer: Investigation graph
The Investigation graph in Microsoft Sentinel provides a visual map of entity relationships and timeline for an incident.
Question 2: A Logic Apps playbook fails intermittently when querying Microsoft Sentinel. Which best practice reduces transient failures?
- Increase the playbook timeout to 24 hours
- Add retry policies to the HTTP or connector actions (Correct answer)
- Disable authentication on the Sentinel connection
- Switch to a consumption plan Logic App
Correct answer: Add retry policies to the HTTP or connector actions
Configuring retry policies on connector actions handles transient API errors and improves playbook reliability.
Question 3: An analyst uses 'externaldata' in a KQL query. What is the primary use case for this operator in Microsoft Sentinel hunting?
- Export query results to external storage
- Import reference data from a URL (e.g., threat intel CSV) into a query (Correct answer)
- Query external SIEM systems
- Connect to on-premises SQL databases
Correct answer: Import reference data from a URL (e.g., threat intel CSV) into a query
externaldata loads tabular data from an external URL like Azure Blob Storage into a KQL query for enrichment or lookups.
Question 4: In Microsoft Sentinel, what is the purpose of the 'entity mapping' section in an analytic rule?
- Maps log fields to MITRE ATT&CK techniques
- Maps query output fields to recognized entity types for incident enrichment (Correct answer)
- Defines how alerts are grouped into incidents
- Specifies which workbook to update
Correct answer: Maps query output fields to recognized entity types for incident enrichment
Entity mapping links query result columns to entity types (Account, IP, Host) so Sentinel can enrich incidents with entity context.
Question 5: Which Microsoft Sentinel data connector type uses a Log Analytics agent (MMA/AMA) installed on the source machine?
- REST API connector
- Azure service-to-service connector
- Agent-based connector (Syslog/CEF) (Correct answer)
- Codeless Connector Platform (CCP)
Correct answer: Agent-based connector (Syslog/CEF)
Agent-based connectors (Syslog/CEF) require the Log Analytics or Azure Monitor agent installed on the log source.
Question 6: A playbook needs to add a tag to a Microsoft Sentinel incident when a specific entity IP is found in a threat intelligence watchlist. Which Logic Apps trigger should initiate this playbook?
- Microsoft Sentinel — When a new alert is created
- Microsoft Sentinel — When a response to a Microsoft Sentinel alert is triggered
- Microsoft Sentinel — When Microsoft Sentinel incident creation rule was triggered (Correct answer)
- Recurrence trigger every 15 minutes
Correct answer: Microsoft Sentinel — When Microsoft Sentinel incident creation rule was triggered
The 'When Microsoft Sentinel incident creation rule was triggered' trigger fires when an automation rule invokes the playbook at incident creation.
Question 7: When configuring User and Entity Behavior Analytics (UEBA) in Microsoft Sentinel, which data source provides the baseline for anomaly scoring of Azure AD sign-in behavior?
- Office 365 audit logs
- Azure Activity logs
- Azure AD sign-in and audit logs (Correct answer)
- Microsoft Defender for Endpoint logs
Correct answer: Azure AD sign-in and audit logs
UEBA baselines Azure AD sign-in and audit logs to establish normal user behavior patterns and score deviations.
SC-200 Security Analytics & Automation 3
Which Microsoft Sentinel feature allows analysts to visually investigate the relationships between entities such as accounts, IPs, and hosts involved in an incident?