SC-200 Security Operations & Monitoring 3

Question 1

A security analyst configures a Microsoft Sentinel playbook to run automatically when a high-severity incident is created. What Azure service hosts the playbook logic?

Accepted Answer

Azure Logic Apps

Answer

Sentinel playbooks are built on Azure Logic Apps, which provide the workflow engine, connectors, and triggers for automated response actions.

Question 2

In Microsoft Defender for Endpoint, which feature allows a SOC analyst to isolate a compromised device while keeping the management channel open?

Accepted Answer

Full isolation

Answer

Full isolation blocks all network communication except the Defender for Endpoint management channel, allowing continued investigation while stopping lateral movement.

Question 3

An analyst needs to collect Windows Security Event ID 4688 (process creation) with command-line arguments in Microsoft Sentinel. Which data connector should be used?

Accepted Answer

Windows Security Events via AMA

Answer

The Windows Security Events via AMA connector streams Windows event log data including process creation events (4688) to Sentinel's SecurityEvent table.

Question 4

A threat hunter runs a KQL query in Microsoft Sentinel and wants to save it for team reuse and promote it to detection. Which pathway is correct?

Accepted Answer

Save as hunting query → promote to analytics rule

Answer

Hunting queries can be saved in the Hunting section and, once validated, promoted directly into an analytics rule for continuous monitoring.

Question 5

Which Microsoft Sentinel entity type represents a network connection and contains properties like source IP, destination IP, and port?

Accepted Answer

Network connection entity

Answer

The Network connection entity in Sentinel encapsulates network flow data including source/destination IPs and ports for enrichment and investigation.

(SC-200) Microsoft Security Operations Analyst Practice Test

(SC-200) Microsoft Security Operations Analyst Practice Test

SC-200 Security Operations & Monitoring 3