SC-200 Threat Detection & Monitoring 3

Question 1

Which KQL operator would you use in Microsoft Sentinel to join the SecurityAlert table with the IdentityInfo table to enrich alerts with user department information?

Accepted Answer

join

Answer

The KQL 'join' operator merges rows from two tables based on a matching key, enabling enrichment of alerts with identity data.

Question 2

A security engineer is configuring Microsoft Defender for Identity. Which on-premises component is required to collect and forward Active Directory signals?

Accepted Answer

MDI sensor

Answer

The Microsoft Defender for Identity sensor is installed on domain controllers to capture AD traffic and forward it to the Defender for Identity cloud service.

Question 3

You need to detect when a user's account is used to sign in from two geographically distant locations within an impossibly short time. Which Microsoft Entra ID Protection risk detection covers this?

Accepted Answer

Atypical travel

Answer

The 'Atypical travel' risk detection identifies sign-ins from geographically distant locations where travel between them would be impossible given the time elapsed.

Question 4

In Microsoft Defender for Cloud, what does a 'Secure Score' represent?

Accepted Answer

A percentage reflecting how many security recommendations have been implemented

Answer

Secure Score in Defender for Cloud measures the percentage of security recommendations that have been remediated, giving a posture health percentage.

Question 5

An analyst is reviewing a Microsoft Sentinel incident and sees multiple alerts grouped together. What determines whether alerts are grouped into the same incident?

Accepted Answer

Alert grouping settings in the analytics rule

Answer

Alert grouping is configured within the analytics rule settings, allowing similar alerts to be merged into a single incident based on entity matching criteria.

(SC-200) Microsoft Security Operations Analyst Practice Test

(SC-200) Microsoft Security Operations Analyst Practice Test

SC-200 Threat Detection & Monitoring 3