SC-200 Threat Intelligence & Analysis 3

Question 1

A threat actor group uses a specific TTPs pattern identified in MITRE ATT&CK. Which Microsoft Sentinel feature maps detected alerts to these TTPs for visualization?

Accepted Answer

MITRE ATT&CK Matrix view in Sentinel

Answer

Microsoft Sentinel includes a MITRE ATT&CK Matrix view that maps analytics rules and incidents to specific ATT&CK techniques, showing coverage and detected activity.

Question 2

When configuring a threat intelligence platform (TIP) integration with Microsoft Sentinel, what protocol is typically used for automated indicator sharing?

Accepted Answer

TAXII 2.0/2.1 over HTTPS

Answer

TAXII (Trusted Automated eXchange of Indicator Information) versions 2.0 and 2.1 over HTTPS is the standard protocol for automated sharing of STIX-formatted threat intelligence.

Question 3

An analyst in Microsoft Sentinel wants to create an analytics rule that triggers when a network connection is made to a known malicious IP from the threat intelligence feed. Which approach is most appropriate?

Accepted Answer

Create a scheduled query rule joining ThreatIntelligenceIndicator with CommonSecurityLog

Answer

A scheduled query analytics rule that joins the ThreatIntelligenceIndicator table with network log tables like CommonSecurityLog is the standard approach for matching traffic against threat intel indicators.

Question 4

Which MDTI feature provides a graphical representation of connections between threat actors, infrastructure, malware, and vulnerabilities?

Accepted Answer

Intel Explorer graph

Answer

MDTI's Intel Explorer provides an interactive graph that visually maps relationships between threat actors, their infrastructure, associated malware, and related vulnerabilities.

Question 5

A security team wants to share threat indicators from Microsoft Sentinel with an external TAXII client. What must they configure?

Accepted Answer

Export indicators via Microsoft Graph Security API

Answer

Microsoft Sentinel threat intelligence indicators can be shared externally via the Microsoft Graph Security API, which supports reading and writing TI indicators programmatically.

(SC-200) Microsoft Security Operations Analyst Practice Test

(SC-200) Microsoft Security Operations Analyst Practice Test

SC-200 Threat Intelligence & Analysis 3