SC-200 Threat Intelligence & Analysis 2

Question 1

A security analyst is reviewing Microsoft Sentinel threat intelligence indicators. Which STIX object type is used to represent a malicious IP address as a threat indicator?

Accepted Answer

Indicator

Answer

In STIX 2.0/2.1, the Indicator object type is used to represent detectable patterns such as malicious IP addresses, domains, or file hashes.

Question 2

In Microsoft Defender Threat Intelligence (MDTI), what does the 'Reputation' score of an artifact primarily indicate?

Accepted Answer

The likelihood that the artifact is associated with malicious activity

Answer

MDTI Reputation scores indicate the likelihood that an artifact (IP, domain, hash) is malicious based on historical threat data and behavioral signals.

Question 3

A SOC team wants to automatically enrich incidents in Microsoft Sentinel with threat intelligence data from MDTI. Which feature should they configure?

Accepted Answer

Azure Logic Apps with MDTI connector

Answer

Azure Logic Apps with the MDTI connector can be used to automate enrichment of Sentinel incidents with threat intelligence context from MDTI.

Question 4

When threat intelligence is imported into Microsoft Sentinel via a TAXII data connector, where are the indicators stored?

Accepted Answer

The ThreatIntelligenceIndicator table in Log Analytics

Answer

Threat intelligence indicators imported into Microsoft Sentinel are stored in the ThreatIntelligenceIndicator table within Log Analytics workspace.

Question 5

Which Microsoft Sentinel feature allows threat hunting by pivoting on threat intelligence indicators to find related entities across your environment?

Accepted Answer

Hunting queries with ThreatIntelligenceIndicator joins

Answer

Analysts can write KQL hunting queries that join the ThreatIntelligenceIndicator table with other log tables to find entities matching known malicious indicators.

(SC-200) Microsoft Security Operations Analyst Practice Test

(SC-200) Microsoft Security Operations Analyst Practice Test

SC-200 Threat Intelligence & Analysis 2