SC-200 Security Operations & Monitoring 2

Question 1

A SOC analyst needs to correlate alerts from multiple Microsoft Sentinel workspaces across different Azure subscriptions. Which feature enables this?

Accepted Answer

Azure Lighthouse with Sentinel

Answer

Azure Lighthouse allows managed security service providers and enterprise SOCs to manage and monitor multiple Sentinel workspaces across tenants from a single pane.

Question 2

In Microsoft Sentinel, which data connector type uses a Common Event Format (CEF) agent deployed on a Linux forwarder?

Accepted Answer

Log Analytics Agent (MMA) with CEF

Answer

CEF-formatted syslog data from third-party appliances is collected via the Log Analytics (MMA) agent configured as a syslog forwarder on a Linux VM.

Question 3

A security engineer wants to suppress known-benign alerts in Microsoft Sentinel for 48 hours while a maintenance window occurs. What is the correct approach?

Accepted Answer

Create a suppression rule on the analytics rule

Answer

Suppression rules on analytics rules prevent alert generation for a configurable duration without removing the detection logic.

Question 4

Which Microsoft Sentinel table stores raw syslog events forwarded from Linux systems?

Accepted Answer

Syslog

Answer

The Syslog table in Log Analytics holds events collected from Linux systems via the syslog daemon and the MMA/AMA agent.

Question 5

An analyst is reviewing an incident in Microsoft Sentinel and wants to understand the sequence of events across an attack. Which Sentinel feature provides a visual timeline of entities and alerts?

Accepted Answer

Investigation graph

Answer

The investigation graph in Sentinel visually maps relationships between entities (users, IPs, hosts) and alerts to reveal the attack sequence.

(SC-200) Microsoft Security Operations Analyst Practice Test

(SC-200) Microsoft Security Operations Analyst Practice Test

SC-200 Security Operations & Monitoring 2