SC-200 Security Operations & Monitoring 3 — Questions and Answers
Question 1: A security analyst configures a Microsoft Sentinel playbook to run automatically when a high-severity incident is created. What Azure service hosts the playbook logic?
- Azure Functions
- Azure Logic Apps (Correct answer)
- Azure Automation Runbooks
- Azure DevOps Pipelines
Correct answer: Azure Logic Apps
Sentinel playbooks are built on Azure Logic Apps, which provide the workflow engine, connectors, and triggers for automated response actions.
Question 2: In Microsoft Defender for Endpoint, which feature allows a SOC analyst to isolate a compromised device while keeping the management channel open?
- Full isolation (Correct answer)
- Selective isolation
- Contain device
- Network block
Correct answer: Full isolation
Full isolation blocks all network communication except the Defender for Endpoint management channel, allowing continued investigation while stopping lateral movement.
Question 3: An analyst needs to collect Windows Security Event ID 4688 (process creation) with command-line arguments in Microsoft Sentinel. Which data connector should be used?
- Microsoft Defender for Cloud connector
- Windows Security Events via AMA (Correct answer)
- Azure Activity connector
- Office 365 connector
Correct answer: Windows Security Events via AMA
The Windows Security Events via AMA connector streams Windows event log data including process creation events (4688) to Sentinel's SecurityEvent table.
Question 4: A threat hunter runs a KQL query in Microsoft Sentinel and wants to save it for team reuse and promote it to detection. Which pathway is correct?
- Save as workbook → publish
- Save as hunting query → promote to analytics rule (Correct answer)
- Export to CSV → import as connector
- Pin to dashboard → set alert threshold
Correct answer: Save as hunting query → promote to analytics rule
Hunting queries can be saved in the Hunting section and, once validated, promoted directly into an analytics rule for continuous monitoring.
Question 5: Which Microsoft Sentinel entity type represents a network connection and contains properties like source IP, destination IP, and port?
- Host entity
- Account entity
- Network connection entity (Correct answer)
- Process entity
Correct answer: Network connection entity
The Network connection entity in Sentinel encapsulates network flow data including source/destination IPs and ports for enrichment and investigation.
Question 6: A security operations team wants to measure the mean time to respond (MTTR) to incidents in Microsoft Sentinel. Where should they look?
- Log Analytics usage blade
- Sentinel Workbooks — SOC efficiency workbook (Correct answer)
- Azure Monitor metrics dashboard
- Microsoft Defender XDR incidents queue
Correct answer: Sentinel Workbooks — SOC efficiency workbook
The built-in SOC Efficiency workbook in Sentinel tracks KPIs including MTTR, incident volume, and analyst performance over time.
Question 7: In a Microsoft Sentinel analytics rule, what does setting 'Event grouping' to 'Trigger an alert for each event' accomplish?
- Groups all matching events into a single alert
- Creates one alert per matching event row from the query results (Correct answer)
- Disables alert deduplication
- Sends each alert to a separate incident
Correct answer: Creates one alert per matching event row from the query results
Setting event grouping to 'each event' means every row returned by the KQL query generates its own individual alert rather than bundling them.
SC-200 Security Operations & Monitoring 3
A security analyst configures a Microsoft Sentinel playbook to run automatically when a high-severity incident is created.
What Azure service hosts the playbook logic?