SC-200 Security Operations & Monitoring 2 — Questions and Answers
Question 1: A SOC analyst needs to correlate alerts from multiple Microsoft Sentinel workspaces across different Azure subscriptions. Which feature enables this?
- Log Analytics workspace linking
- Azure Lighthouse with Sentinel (Correct answer)
- Microsoft Defender XDR multi-tenant
- Azure Monitor cross-workspace queries
Correct answer: Azure Lighthouse with Sentinel
Azure Lighthouse allows managed security service providers and enterprise SOCs to manage and monitor multiple Sentinel workspaces across tenants from a single pane.
Question 2: In Microsoft Sentinel, which data connector type uses a Common Event Format (CEF) agent deployed on a Linux forwarder?
- Azure Monitor Agent (AMA)
- Log Analytics Agent (MMA) with CEF (Correct answer)
- REST API direct ingestion
- Azure Event Hub streaming
Correct answer: Log Analytics Agent (MMA) with CEF
CEF-formatted syslog data from third-party appliances is collected via the Log Analytics (MMA) agent configured as a syslog forwarder on a Linux VM.
Question 3: A security engineer wants to suppress known-benign alerts in Microsoft Sentinel for 48 hours while a maintenance window occurs. What is the correct approach?
- Delete the analytics rule temporarily
- Create a suppression rule on the analytics rule (Correct answer)
- Disable the data connector
- Archive the Log Analytics workspace
Correct answer: Create a suppression rule on the analytics rule
Suppression rules on analytics rules prevent alert generation for a configurable duration without removing the detection logic.
Question 4: Which Microsoft Sentinel table stores raw syslog events forwarded from Linux systems?
- SecurityEvent
- CommonSecurityLog
- Syslog (Correct answer)
- WindowsEvent
Correct answer: Syslog
The Syslog table in Log Analytics holds events collected from Linux systems via the syslog daemon and the MMA/AMA agent.
Question 5: An analyst is reviewing an incident in Microsoft Sentinel and wants to understand the sequence of events across an attack. Which Sentinel feature provides a visual timeline of entities and alerts?
- Workbooks
- Investigation graph (Correct answer)
- Hunting queries
- Notebooks
Correct answer: Investigation graph
The investigation graph in Sentinel visually maps relationships between entities (users, IPs, hosts) and alerts to reveal the attack sequence.
Question 6: A Microsoft Sentinel analytics rule uses a Fusion detection. What distinguishes Fusion from standard scheduled query rules?
- Fusion runs only on Windows Security events
- Fusion uses ML to correlate low-fidelity signals into high-confidence incidents (Correct answer)
- Fusion requires manual KQL authoring
- Fusion only works with Microsoft Defender data connectors
Correct answer: Fusion uses ML to correlate low-fidelity signals into high-confidence incidents
Fusion is a machine-learning correlation engine that combines multiple low-fidelity anomalies across different data sources to detect advanced multi-stage attacks.
Question 7: Which KQL operator would a Sentinel analyst use to join the SigninLogs table with the AuditLogs table on a common user principal name?
- union
- join (Correct answer)
- lookup
- extend
Correct answer: join
The KQL `join` operator combines rows from two tables based on matching values in specified columns, such as UserPrincipalName.
SC-200 Security Operations & Monitoring 2
A SOC analyst needs to correlate alerts from multiple Microsoft Sentinel workspaces across different Azure subscriptions.
Which feature enables this?