SC-200 Security Analytics & Automation 4

Question 1

An analyst writes a KQL query using 'make-series' in Microsoft Sentinel. What is the primary purpose of this operator?

Accepted Answer

Create a time-series array of values for anomaly detection

Answer

make-series generates a dynamic array of values over time intervals, enabling time-series analysis and ML-based anomaly detection.

Question 2

Which permission is required for a managed identity used by a Logic Apps playbook to add comments to a Microsoft Sentinel incident?

Accepted Answer

Microsoft Sentinel Responder

Answer

Microsoft Sentinel Responder allows playbooks to update incidents, add comments, and change status without full contributor rights.

Question 3

In Microsoft Defender XDR, what does 'go hunt' on an alert entity automatically do?

Accepted Answer

Launches a pre-populated advanced hunting query scoped to that entity

Answer

'Go hunt' pre-populates an advanced hunting query filtered to the selected entity, accelerating investigation.

Question 4

A security engineer wants to suppress repeated alerts from the same source IP for 1 hour after the first alert fires. Which Microsoft Sentinel feature handles this?

Accepted Answer

Alert suppression (also called 'Stop running query after alert is generated')

Answer

Alert suppression in analytic rules prevents re-triggering the same rule for a configurable period after an alert is generated.

Question 5

Which table in Microsoft Sentinel (via Microsoft Defender for Endpoint) records process creation events useful for detecting LOLBin abuse?

Accepted Answer

DeviceProcessEvents

Answer

DeviceProcessEvents contains endpoint process creation telemetry from MDE, making it ideal for detecting living-off-the-land binary abuse.

(SC-200) Microsoft Security Operations Analyst Practice Test

(SC-200) Microsoft Security Operations Analyst Practice Test

SC-200 Security Analytics & Automation 4