SC-200 Security Analytics & Automation 3

Question 1

Which Microsoft Sentinel feature allows analysts to visually investigate the relationships between entities such as accounts, IPs, and hosts involved in an incident?

Accepted Answer

Investigation graph

Answer

The Investigation graph in Microsoft Sentinel provides a visual map of entity relationships and timeline for an incident.

Question 2

A Logic Apps playbook fails intermittently when querying Microsoft Sentinel. Which best practice reduces transient failures?

Accepted Answer

Add retry policies to the HTTP or connector actions

Answer

Configuring retry policies on connector actions handles transient API errors and improves playbook reliability.

Question 3

An analyst uses 'externaldata' in a KQL query. What is the primary use case for this operator in Microsoft Sentinel hunting?

Accepted Answer

Import reference data from a URL (e.g., threat intel CSV) into a query

Answer

externaldata loads tabular data from an external URL like Azure Blob Storage into a KQL query for enrichment or lookups.

Question 4

In Microsoft Sentinel, what is the purpose of the 'entity mapping' section in an analytic rule?

Accepted Answer

Maps query output fields to recognized entity types for incident enrichment

Answer

Entity mapping links query result columns to entity types (Account, IP, Host) so Sentinel can enrich incidents with entity context.

Question 5

Which Microsoft Sentinel data connector type uses a Log Analytics agent (MMA/AMA) installed on the source machine?

Accepted Answer

Agent-based connector (Syslog/CEF)

Answer

Agent-based connectors (Syslog/CEF) require the Log Analytics or Azure Monitor agent installed on the log source.

(SC-200) Microsoft Security Operations Analyst Practice Test

(SC-200) Microsoft Security Operations Analyst Practice Test

SC-200 Security Analytics & Automation 3