SC-200 practice questions 221–230

1. Question 221 · 392 in bank

   You have a custom Microsoft Sentinel workbook named Workbook1. You need to add a grid to Workbook1. The solution must ensure that the grid contains a maximum of 100 rows. What should you do?

   • AIn the grid query, include the take operator.
   • BIn the grid query, include the project operator.
   • CIn the query editor interface, configure Settings.
   • DIn the query editor interface, select Advanced Editor.

   Show answer

   Answer: A

   Explanation

   A. In the grid query, include the take operator. The take operator allows you to limit the number of rows returned by a query. By including the take operator in the grid query and specifying a maximum of 100 rows, you can ensure that the grid in Workbook1 contains a maximum of 100 rows. For example, you could use the following query: | take 100

   Source: Adapted from community discussion — eddz25

   References

   • Microsoft Learn

   Next question

2. Question 222 · 392 in bank

   HOTSPOT - You have a Microsoft Sentinel workspace named SW1. You plan to create a custom workbook that will include a time chart. You need to create a query that will identify the number of security alerts per day for each provider. How should you complete the query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Time charts are similar to line graphs but lay out more information and focus more on a time frame of information. This ties into tracking anomalies, unhealthy trends, and more. This also ties into time brushing in the advanced section. Similar to regular graphs, the query option must be chosen. This time around, the query will need a ‘bin’ operator. The bin operator will take a variable and a time scale value and create a series based on the data. An example would be ‘summarize count() by ProviderName, bin(TimeGenerated, 1d)'. This is taking a count of ProviderName from the query results and generating a time series that will show the amount of results per day.

   Source: Adapted from community discussion — donathon

   

   Next question

3. Question 223 · 392 in bank

   You have a Microsoft Sentinel workspace named Workspace1. You need to exclude a built-in, source-specific Advanced Security Information Model (ASIM) parser from a built-in unified ASIM parser. What should you create in Workspace1?

   • Aan analytic rule
   • Ba watchlist
   • Ca workbook
   • Da hunting query

   Show answer

   Answer: B

   Explanation

   Answer B To modify an existing, built-in source-specific parser: 1 Create a custom parser based on the original parser and add it to the built-in parser. 2 Add a record to the ASim Disabled Parsers watchlist. 3 Define the CallerContext value as Exclude , where is the name of the unifying parsers you want to exclude the parser from. 4 Define the SourceSpecificParser value Exclude , where is the name of the parser you want to exclude, without a version specifier. (From: https://learn.microsoft.com/en-us/azure/sentinel/normalization-manage-parsers)

   Source: Adapted from community discussion — JoeP1

   References

   • Microsoft Learn

   Next question

4. Question 224 · 392 in bank

   You have an Azure subscription that contains a Microsoft Sentinel workspace. You need to create a playbook that will run automatically in response to a Microsoft Sentinel alert. What should you create first?

   • Aa hunting query in Microsoft Sentinel
   • Ban Azure logic app
   • Can automation rule in Microsoft Sentinel
   • Da trigger in Azure Functions

   Show answer

   Answer: B

   Explanation

   Creating a logic app before creating the automation rule that triggers said logic app is ... logically the correct answer.

   Source: Adapted from community discussion — PhoenixSlasher

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

5. Question 225 · 392 in bank

   HOTSPOT - You have a Microsoft Sentinel workspace named Workspace1. You configure Workspace1 to collect DNS events and deploy the Advanced Security Information Model (ASIM) unifying parser for the DNS schema. You need to query the ASIM DNS schema to list all the DNS events from the last 24 hours that have a response code of ‘NXDOMAIN’ and were aggregated by the source IP address in 15-minute intervals. The solution must maximize query performance. How should you complete the query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   First box is correct, second option should be (and correct me if I'm wrong) (starttime=ago(1d), responsecodename='NXDOMAIN') Question states: 'from the last 24 hrs' and 'The solution must maximize query performance' Both the second and third option in the second box give 'TimeGenerate>ago(1d)', for me that reads as events generated greater than the last 24 hours - not what we're looking for. so the query is: _Im_Dns(starttime=ago(1d), responsecodename='NXDOMAIN') | summarize count() by SrcIpAddr, bin(TimeGenerated,15m) using the link Albonzi gives https://learn.microsoft.com/en-us/azure/sentinel/normalization-about-parsers#optimizing-parsing-using-parameters Every schema that supports filtering parameters supports at least the starttime and endtime parameters and using them is often critical for optimizing performance

   Source: Adapted from community discussion — ultraRunningCA

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

6. Question 226 · 392 in bank

   HOTSPOT - Your on-premises network contains 100 servers that run Windows Server. You have an Azure subscription that uses Microsoft Sentinel. You need to upload custom logs from the on-premises servers to Microsoft Sentinel. What should you do? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   This is certainly outdated question, now we would use ARC + AMA + DCR + DCE and a custom tables. https://learn.microsoft.com/en-us/azure/azure-monitor/agents/data-collection-text-log?tabs=portal If we stick to the legacy solution, answers are Log analytics agent - can be installed different ways, no need of ARC as mentioned in previous comments Data Connectors page of Sentinel - configure custom logs https://learn.microsoft.com/en-us/azure/sentinel/connect-custom-logs?tabs=DCG

   Source: Adapted from community discussion — 7c0a

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

7. Question 227 · 392 in bank

   You have an Azure subscription that contains a Microsoft Sentinel workspace. The workspace contains a Microsoft Defender for Cloud data connector. You need to customize which details will be included when an alert is created for a specific event. What should you do?

   • AEnable User and Entity Behavior Analytics (UEBA).
   • BCreate a Data Collection Rule (DCR).
   • CModify the properties of the connector.
   • DCreate a scheduled query rule.

   Show answer

   Answer: D

   Explanation

   A & B are obviously not relevant C - might be true for some data connectors, but this one Defender for Cloud does not provide any filtering options D - correct one, https://learn.microsoft.com/en-us/azure/sentinel/connect-defender-for-cloud

   Source: Adapted from community discussion — 7c0a

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

8. Question 228 · 392 in bank

   You have a Microsoft Sentinel workspace named Workspace1 and 200 custom Advanced Security Information Model (ASIM) parsers based on the DNS schema. You need to make the 200 parses available in Workspace1. The solution must minimize administrative effort. What should you do first?

   • ACopy the parsers to the Azure Monitor Logs page.
   • BCreate a JSON file based on the DNS template.
   • CCreate an XML file based on the DNS template.
   • DCreate a YAML file based on the DNS template.

   Show answer

   Answer: D

   Explanation

   Answer is D. @exmITQS you need to look at the link from @smosmo. The question is about a large number of parsers... this is specifically mentioned in the linked article Deploy parsers manually by copying them to the Azure Monitor Log page and saving the query as a function. This method is useful for testing. For more information, see Create a function. To deploy a large number of parsers, we recommend using parser ARM templates, as follows: Create a YAML file based on the relevant template for each schema and include your query in it. Start with the YAML template relevant for your schema and parser type, filtering or parameter-less. Use the ASIM Yaml to ARM template converter to convert your YAML file to an ARM template. If deploying an update, delete older versions of the functions using the portal or the function delete PowerShell tool. Deploy your template using the Azure portal or PowerShell. You can also combine multiple templates to a single deploy process using linked templates

   Source: Adapted from community discussion — D_PaW

   References

   • Microsoft Learn

   Next question

9. Question 229 · 392 in bank

   HOTSPOT - You have a Microsoft Sentinel workspace. A Microsoft Sentinel incident is generated as shown in the following exhibit.

   

   Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   In order to check the activities during the investigation, normally you go to "Activity Log" and there you can check the activities and the comments. Since there is no "Activy Log" option, i would go for "Comments" Also from the below link we can see "Comment on incidents https://learn.microsoft.com/en-us/azure/sentinel/investigate-incidents#audit-and-comment-on-incidents As a security operations analyst, when investigating an incident you will want to thoroughly document the steps you take, both to ensure accurate reporting to management and to enable seamless cooperation and collaboration amongst coworkers. Microsoft Sentinel gives you a rich commenting environment to help you accomplish this." "Alerts" tab for sure doesnt show you the activities that took place during the investigation

   Source: Adapted from community discussion — teouba

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

10. Question 230 · 392 in bank

    Select 2

    You provision Azure Sentinel for a new Azure subscription. You are configuring the Security Events connector. While creating a new rule from a template in the connector, you decide to generate a new alert for every event. You create the following rule query.

    

    By which two components can you group alerts into incidents? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

    • Auser
    • Bresource group
    • CIP address
    • Dcomputer

    Show answer

    Answer: AD

    Explanation

    Answer should be A, D. IP address data is removed from the query in the | summarize, and is not mapped to the IP custom entity.

    Source: Adapted from community discussion — hyperion

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SC-200 practice, question 221. 392 questions available.