SC-200 practice questions 171–180

1. Question 171 · 392 in bank

   You have an Azure Sentinel deployment in the East US Azure region. You create a Log Analytics workspace named LogsWest in the West US Azure region. You need to ensure that you can use scheduled analytics rules in the existing Azure Sentinel deployment to generate alerts based on queries to LogsWest. What should you do first?

   • ADeploy Azure Data Catalog to the West US Azure region.
   • BModify the workspace settings of the existing Azure Sentinel deployment.
   • CAdd Azure Sentinel to a workspace.
   • DCreate a data connector in Azure Sentinel.

   Show answer

   Answer: C

   Explanation

   Correct answer - C. Cross-workspace queries can now be included in scheduled analytics rules. You can use cross-workspace analytics rules in a central SOC, and across tenants (using Azure Lighthouse) as in the case of an MSSP, subject to the following limitations: * Up to 20 workspaces can be included in a single query. * Azure Sentinel must be deployed on every workspace referenced in the query. * Alerts generated by a cross-workspace analytics rule, and the incidents created from them, exist only in the workspace where the rule was defined. They will not be displayed in any of the other workspaces referenced in the query. https://docs.microsoft.com/en-us/azure/sentinel/extend-sentinel-across-workspaces-tenants#cross-workspace-workbooks

   Source: Adapted from community discussion — Eltooth

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

2. Question 172 · 392 in bank

   Select 2

   You create a custom analytics rule to detect threats in Azure Sentinel. You discover that the rule fails intermittently. What are two possible causes of the failures? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

   • AThe rule query takes too long to run and times out.
   • BThe target workspace was deleted.
   • CPermissions to the data sources of the rule query were modified.
   • DThere are connectivity issues between the data sources and Log Analytics

   Show answer

   Answer: AD

   References

   • Microsoft Learn

   Next question

3. Question 173 · 392 in bank

   Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You are configuring Azure Sentinel. You need to create an incident in Azure Sentinel when a sign-in to an Azure virtual machine from a malicious IP address is detected. Solution: You create a scheduled query rule for a data connector. Does this meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: A

   Explanation

   You can create scheduled rules from Data connector pages (Next steps tab). But the bottom line is whoever wrote this question should be fired on the spot.

   Source: Adapted from community discussion — stromnessian

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

4. Question 174 · 392 in bank

   Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You are configuring Azure Sentinel. You need to create an incident in Azure Sentinel when a sign-in to an Azure virtual machine from a malicious IP address is detected. Solution: You create a hunting bookmark. Does this meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: B

   Explanation

   Reference: https://docs.microsoft.com/en-us/azure/sentinel/connect-azure-security-center

   References

   • Microsoft Learn

   Next question

5. Question 175 · 392 in bank

   HOTSPOT - From Azure Sentinel, you open the Investigation pane for a high-severity incident as shown in the following exhibit.

   

   Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://docs.microsoft.com/en-us/azure/sentinel/tutorial-investigate-cases#use-the-investigation-graph-to-deep-dive

   Source: Adapted from community discussion — Haz56

   

   Next question

6. Question 176 · 392 in bank

   Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You are configuring Azure Sentinel. You need to create an incident in Azure Sentinel when a sign-in to an Azure virtual machine from a malicious IP address is detected. Solution: You create a Microsoft incident creation rule for a data connector. Does this meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: A

   Explanation

   No Creating a Microsoft incident creation rule for a data connector will not meet the goal of creating an incident in Azure Sentinel when a sign-in to an Azure virtual machine from a malicious IP address is detected. An incident creation rule is used to create incidents in Azure Sentinel based on specific criteria, such as when a certain number of alerts are triggered within a certain timeframe. While an incident creation rule can be used in conjunction with data connectors to analyze data from other sources, it does not directly detect sign-ins from malicious IP addresses. To detect sign-ins from malicious IP addresses, you would need to create an analytics rule that looks for specific signs of a malicious IP address, such as a high number of failed login attempts or login attempts from a known malicious IP. Once the rule detects a sign-in from a malicious IP, it can trigger an alert, which can then be used to create an incident in Azure Sentinel.

   Source: Adapted from community discussion — eddz25

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

7. Question 177 · 392 in bank

   You plan to create a custom Azure Sentinel query that will track anomalous Azure Active Directory (Azure AD) sign-in activity and present the activity as a time chart aggregated by day. You need to create a query that will be used to display the time chart. What should you include in the query?

   • Aextend
   • Bbin
   • Cmakeset
   • Dworkspace

   Show answer

   Answer: B

   Explanation

   Grouping results can also be based on a time column, or another continuous value. Simply summarizing by TimeGenerated, though, would create groups for every single millisecond over the time range, because these are unique values. To create groups that are based on continuous values, it's best to break the range into manageable units by using bin. Thus correct answer.

   Source: Adapted from community discussion — werbinich

   References

   • Microsoft Learn

   Next question

8. Question 178 · 392 in bank

   Select 2

   You are configuring Azure Sentinel. You need to send a Microsoft Teams message to a channel whenever a sign-in from a suspicious IP address is detected. Which two actions should you perform in Azure Sentinel? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

   • AAdd a playbook.
   • BAssociate a playbook to an incident.
   • CEnable Entity behavior analytics.
   • DCreate a workbook.
   • EEnable the Fusion rule.

   Show answer

   Answer: AB

   Explanation

   Playbooks are collections of procedures that can be run from Azure Sentinel in response to an alert or incident. A playbook can help automate and orchestrate your response, and can be set to run automatically when specific alerts or incidents are generated, by being attached to an analytics rule or an automation rule, respectively. It can also be run manually on-demand. Playbooks in Azure Sentinel are based on workflows built in Azure Logic Apps, which means that you get all the power, customizability, and built-in templates of Logic Apps. Thus correct answer

   Source: Adapted from community discussion — werbinich

   Next question

9. Question 179 · 392 in bank

   You need to visualize Azure Sentinel data and enrich the data by using third-party data sources to identify indicators of compromise (IoC). What should you use?

   • Anotebooks in Azure Sentinel
   • BMicrosoft Cloud App Security
   • CAzure Monitor
   • Dhunting queries in Azure Sentinel

   Show answer

   Answer: A

   Explanation

   The Azure portal and all Azure Sentinel tools use a common API to access this data store. The same API is also available for external tools such as Jupyter notebooks and Python. While many common tasks can be carried out in the portal, Jupyter extends the scope of what you can do with this data. It combines full programmability with a huge collection of libraries for machine learning, visualization, and data analysis. These attributes make Jupyter a compelling tool for security investigation and hunting. Thus Correct Answer.

   Source: Adapted from community discussion — werbinich

   Next question

10. Question 180 · 392 in bank

    You plan to create a custom Azure Sentinel query that will provide a visual representation of the security alerts generated by Azure Security Center. You need to create a query that will be used to display a bar graph. What should you include in the query?

    • Aextend
    • Bbin
    • Ccount
    • Dworkspace

    Show answer

    Answer: C

    Explanation

    Sample query : requests | summarize Requests = count() by Result = strcat('Http ', resultCode) | order by Requests desc The query returns two columns: Requests metric and Result category. Each value of the Result column will get its own bar in the chart with height proportional to the Requests metric. Thus correct answer.

    Source: Adapted from community discussion — werbinich

    References

    • Microsoft Learn
    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SC-200 practice, question 171. 392 questions available.