SC-200 Security Analytics & Automation 5

Question 1

A SOC team wants to track mean time to respond (MTTR) across all incidents in Microsoft Sentinel. Which built-in feature provides this metric without writing custom KQL?

Accepted Answer

Microsoft Sentinel workspace analytics workbook (SOC Efficiency workbook)

Answer

The SOC Efficiency workbook in Microsoft Sentinel includes pre-built MTTR, MTTA, and incident closure metrics.

Question 2

Which Microsoft Sentinel feature uses machine learning to correlate low-fidelity alerts from multiple products into high-fidelity incidents without requiring custom rules?

Accepted Answer

Fusion detection

Answer

Fusion uses ML to correlate signals across multiple Microsoft and third-party products, producing high-confidence incidents from low-signal alerts.

Question 3

In a Microsoft Sentinel playbook, an analyst needs to parse a JSON field returned from an HTTP action before using its values. Which Logic Apps action should they use?

Accepted Answer

Parse JSON

Answer

The 'Parse JSON' action deserializes a JSON string into a structured object whose fields can be referenced in subsequent steps.

Question 4

When onboarding a new Syslog data source to Microsoft Sentinel using AMA, which resource must be created to define which facilities and severities are collected?

Accepted Answer

Data Collection Rule (DCR)

Answer

A Data Collection Rule (DCR) defines the Syslog facilities, severities, and destination workspace for the Azure Monitor Agent.

Question 5

Which advanced hunting KQL query technique allows a Defender XDR analyst to parameterize a query and reuse it across multiple investigations?

Accepted Answer

Saved functions in the Sentinel function library

Answer

Microsoft Sentinel allows saving KQL as reusable functions in the workspace function library, which can be called by name in any query.

(SC-200) Microsoft Security Operations Analyst Practice Test

(SC-200) Microsoft Security Operations Analyst Practice Test

SC-200 Security Analytics & Automation 5