SC-200 Threat Detection & Monitoring 2

Question 1

A SOC analyst notices repeated failed sign-in attempts followed by a successful login from an unusual country. Which Microsoft Sentinel analytics rule type is BEST suited to detect this pattern?

Accepted Answer

Scheduled

Answer

Scheduled analytics rules use KQL queries run on a defined schedule and are ideal for detecting multi-step patterns like brute-force followed by success.

Question 2

Which Microsoft Defender XDR feature correlates alerts from multiple Defender products into a single, unified incident?

Accepted Answer

Automatic Attack Disruption

Answer

Automatic Attack Disruption uses AI to correlate signals across Defender products and contain active attacks by isolating affected assets.

Question 3

You want to hunt for suspicious PowerShell executions across all endpoints in your organization. Which tool in Microsoft Defender XDR should you use?

Accepted Answer

Advanced Hunting

Answer

Advanced Hunting uses KQL to query up to 30 days of raw telemetry across endpoints, email, identity, and cloud apps.

Question 4

An analyst wants Microsoft Sentinel to automatically assign a severity of High to any incident involving a watchlist match. Which feature enables this?

Accepted Answer

Automation Rule

Answer

Automation rules in Microsoft Sentinel can modify incident properties such as severity, owner, and status based on trigger conditions.

Question 5

Which Microsoft Sentinel data connector uses the Common Event Format (CEF) over Syslog to ingest logs from third-party security appliances?

Accepted Answer

CEF via AMA

Answer

The CEF via Azure Monitor Agent connector forwards CEF-formatted syslog messages from Linux forwarders directly into Microsoft Sentinel.

(SC-200) Microsoft Security Operations Analyst Practice Test

(SC-200) Microsoft Security Operations Analyst Practice Test

SC-200 Threat Detection & Monitoring 2