SC-200 Threat Intelligence & Analysis 3 — Questions and Answers
Question 1: A threat actor group uses a specific TTPs pattern identified in MITRE ATT&CK. Which Microsoft Sentinel feature maps detected alerts to these TTPs for visualization?
- Entity behavior analytics dashboard
- ATT&CK coverage workbook
- Threat Intelligence Workbook
- MITRE ATT&CK Matrix view in Sentinel (Correct answer)
Correct answer: MITRE ATT&CK Matrix view in Sentinel
Microsoft Sentinel includes a MITRE ATT&CK Matrix view that maps analytics rules and incidents to specific ATT&CK techniques, showing coverage and detected activity.
Question 2: When configuring a threat intelligence platform (TIP) integration with Microsoft Sentinel, what protocol is typically used for automated indicator sharing?
- OpenIOC over HTTPS
- TAXII 2.0/2.1 over HTTPS (Correct answer)
- STIX over SMTP
- MISP over FTP
Correct answer: TAXII 2.0/2.1 over HTTPS
TAXII (Trusted Automated eXchange of Indicator Information) versions 2.0 and 2.1 over HTTPS is the standard protocol for automated sharing of STIX-formatted threat intelligence.
Question 3: An analyst in Microsoft Sentinel wants to create an analytics rule that triggers when a network connection is made to a known malicious IP from the threat intelligence feed. Which approach is most appropriate?
- Create a scheduled query rule joining ThreatIntelligenceIndicator with CommonSecurityLog (Correct answer)
- Enable the Fusion ML analytics rule for IP threats
- Create a Near-Real-Time (NRT) rule checking SecurityAlert
- Use an anomaly detection rule based on UEBA
Correct answer: Create a scheduled query rule joining ThreatIntelligenceIndicator with CommonSecurityLog
A scheduled query analytics rule that joins the ThreatIntelligenceIndicator table with network log tables like CommonSecurityLog is the standard approach for matching traffic against threat intel indicators.
Question 4: Which MDTI feature provides a graphical representation of connections between threat actors, infrastructure, malware, and vulnerabilities?
- Threat Analytics dashboard
- Intel Explorer graph (Correct answer)
- Security Score card
- Threat Intelligence Workbook
Correct answer: Intel Explorer graph
MDTI's Intel Explorer provides an interactive graph that visually maps relationships between threat actors, their infrastructure, associated malware, and related vulnerabilities.
Question 5: A security team wants to share threat indicators from Microsoft Sentinel with an external TAXII client. What must they configure?
- Export indicators via Microsoft Graph Security API (Correct answer)
- Set up Sentinel as a TAXII server using the built-in export feature
- Deploy an Azure Function to push indicators to the external system
- Configure the TAXII push connector in Sentinel data connectors
Correct answer: Export indicators via Microsoft Graph Security API
Microsoft Sentinel threat intelligence indicators can be shared externally via the Microsoft Graph Security API, which supports reading and writing TI indicators programmatically.
Question 6: In the context of SC-200, what does 'diamond model' help analysts understand in threat intelligence analysis?
- The financial cost structure of a cyberattack
- The relationships between adversary, capability, infrastructure, and victim (Correct answer)
- A tiered severity model for classifying threats
- The four phases of the NIST incident response lifecycle
Correct answer: The relationships between adversary, capability, infrastructure, and victim
The Diamond Model of Intrusion Analysis describes the core features of an intrusion event: the adversary, their capabilities, the infrastructure used, and the victim — and the relationships between them.
Question 7: An analyst uses Microsoft Sentinel to investigate a potential phishing campaign. Which KQL query approach best identifies emails with threat intelligence-matched URLs?
- Query SecurityAlert where AlertName contains 'phishing'
- Join EmailUrlInfo with ThreatIntelligenceIndicator on matching URLs (Correct answer)
- Query OfficeActivity where Operation == 'MailReceived'
- Run Fusion rule detection on EmailEvents
Correct answer: Join EmailUrlInfo with ThreatIntelligenceIndicator on matching URLs
Joining the EmailUrlInfo table (from Defender for Office 365) with ThreatIntelligenceIndicator on the URL field identifies emails containing URLs that match known malicious indicators.
SC-200 Threat Intelligence & Analysis 3
A threat actor group uses a specific TTPs pattern identified in MITRE ATT&CK.
Which Microsoft Sentinel feature maps detected alerts to these TTPs for visualization?