SC-200 · Domain 1: Manage a security operations environment · 41% of the exam
Task 1.1: Configure automation for Microsoft Defender XDR and Microsoft Sentinel
Email notifications, alert tuning and correlation, Defender for Endpoint advanced features, rules, custom data collection and ASR rules, automated investigation, automatic attack disruption, device groups and automation levels, and Sentinel automation rules and playbooks.
Study it
Email notifications in Defender XDR: incidents, response actions and threat analytics
Lesson coming
Alert tuning, suppression and detection rule correlation settings
Lesson coming
Defender for Endpoint advanced features, rules, indicators and custom data collection
Lesson coming
Attack surface reduction rules and endpoint security policies
Lesson coming
Automated investigation, device groups, permissions and automation levels
Lesson coming
Automatic attack disruption: actions, prerequisites and exclusions
Lesson coming
Sentinel automation rules and Logic Apps playbooks
Lesson coming
Sample questions
Try each one before opening the answer. Every option is explained, with the Microsoft documentation page that proves it.
Question 1 · choose 1
A weekly phishing simulation run by an internal team raises Defender for Office 365 alerts that open incidents each Monday. The SOC wants a rule in the Microsoft Defender portal that handles only these alerts, keeps them out of the open incident queue, and uses a built-in action. Which alert tuning action can the rule use?
AHide alert
BSet as behavior, so the signals stay in BehaviorInfo for hunting
CResolve alert
DAn alert suppression rule under Settings > Endpoints > Rules
Show the answer and why
AHide alert
Incorrect
Hide alert applies only to Defender for Endpoint alerts.
BSet as behavior, so the signals stay in BehaviorInfo for hunting
Incorrect
Set as behavior isn't supported for Defender for Office 365 or Defender for Cloud alerts.
CResolve alert
Correct
Resolve alert works for this service source and closes matching alerts and their incidents automatically.
DAn alert suppression rule under Settings > Endpoints > Rules
Incorrect
Endpoint alert suppression rules manage Defender for Endpoint alerts, not email alerts.
Alert tuning rules in Settings > Microsoft Defender XDR > Alert tuning can hide, resolve or set alerts as behaviors. Hide alert is limited to Defender for Endpoint alerts and Set as behavior excludes Defender for Office 365 and Defender for Cloud alerts, so Resolve alert is the action left for a phishing simulation that raises Defender for Office 365 alerts.
After onboarding Microsoft Sentinel to the Defender portal, the tenant keeps the Incident correlation default setting turned off so analytics rule alerts group as they did before. One rule that detects ransomware staging should now join correlated attack stories, without changing how any other rule behaves. What should you do?
AAdd #INC_CORR# at the beginning of that rule's description
BAdd #DONT_CORR# at the end of every other rule's description
CTurn on the Incident correlation default setting
DSet the rule's alert grouping to group all alerts into one incident
Show the answer and why
AAdd #INC_CORR# at the beginning of that rule's description
Correct
With the default off, a rule is included in correlation only when its description starts with the include tag.
BAdd #DONT_CORR# at the end of every other rule's description
Incorrect
The exclude tag only matters when the default is on, and tags must be at the beginning of the description.
CTurn on the Incident correlation default setting
Incorrect
That includes every analytics rule without an explicit tag, which changes the behavior of the other rules.
DSet the rule's alert grouping to group all alerts into one incident
Incorrect
Alert grouping controls how the rule groups its own alerts; it doesn't put the rule's alerts into the correlation engine.
The tenant default under Settings > Microsoft Defender XDR > Rules > Incident correlation is off by default, which excludes analytics rules from correlation. A rule is included by starting its description with #INC_CORR# (or choosing Enabled in the Incident correlation box of the rule wizard, which writes the tag). Tags aren't case sensitive but must be at the start of the description.
A regional SOC has RBAC access only to its own device groups in Defender for Endpoint. Incidents often combine alerts from its devices and from devices in other regions, and the regional team can't manage those incidents. The global SOC accepts seeing more, smaller incidents. What should you configure?
ARank the regional device groups above the global groups
BExclude the regional analytics rules from correlation
CAn alert tuning rule that resolves alerts from other regions
DTurn on Restrict correlation to within scoped device groups
Show the answer and why
ARank the regional device groups above the global groups
Incorrect
Ranking decides which group a device lands in; it doesn't change how alerts are correlated into incidents.
BExclude the regional analytics rules from correlation
Incorrect
Correlation settings apply to detection rules, not to endpoint alerts that span device groups.
CAn alert tuning rule that resolves alerts from other regions
Incorrect
Resolving alerts hides real detections instead of splitting the incidents.
DTurn on Restrict correlation to within scoped device groups
Correct
With this advanced feature on, alerts that cross device groups are no longer combined into one incident.
The scoped device group correlation advanced feature limits alert correlation to device groups, so a local SOC with access to one group can act on its incidents while the global SOC sees several incidents instead of one. The change affects future correlations only.
You turn on custom network indicators and create a Block execution indicator for the domain fabrikam-files.example. Network protection is in block mode on all Windows devices. Which two outcomes should you expect? (Choose TWO.)
AConnections to downloads.fabrikam-files.example are blocked too
BAn IP indicator for 198.51.100.0/24 would block that whole range
CA full HTTPS URL path indicator would block that path in every browser
DA blocked visit can still be logged as a ConnectionSuccess network event
EDevices with Defender Antivirus in passive mode also enforce it
Show the answer and why
AConnections to downloads.fabrikam-files.example are blocked too
Correct
A domain indicator matches the domain and all its subdomains.
BAn IP indicator for 198.51.100.0/24 would block that whole range
Incorrect
IP indicators take single IPv4 or IPv6 addresses; ranges and wildcards aren't supported.
CA full HTTPS URL path indicator would block that path in every browser
Incorrect
HTTPS URL paths are matched only in Microsoft Edge; other browsers are matched on the domain.
DA blocked visit can still be logged as a ConnectionSuccess network event
Correct
Network protection decides after the TCP handshake, which is already logged as a successful connection.
EDevices with Defender Antivirus in passive mode also enforce it
Incorrect
Indicators aren't supported when Defender Antivirus is in passive mode.
Domain indicators cover subdomains, IP indicators accept single addresses only, and full URL paths over HTTPS are enforced only in Microsoft Edge. Because network protection blocks after the three-way handshake, a network connection event with ConnectionSuccess can appear for a site that was blocked. Indicators aren't supported with Defender Antivirus in passive mode.
You need to collect every PowerShell script execution from 40 administrative workstations into Microsoft Sentinel by using custom data collection in Defender for Endpoint. The workstations carry a manual tag named PAW. When you define the rule scope, the PAW tag can't be selected. What should you do?
ACreate a device group whose matching rule uses the PAW tag, then scope the collection rule to that device group
BCreate a dynamic rule in asset rule management that tags these workstations, then use that tag
CReapply the PAW tag through the API so the rule can see it
DQuery DeviceEvents instead, which already holds all script content
Show the answer and why
ACreate a device group whose matching rule uses the PAW tag, then scope the collection rule to that device group
Incorrect
Custom data collection rules don't scope to device groups; they target dynamic tags.
BCreate a dynamic rule in asset rule management that tags these workstations, then use that tag
Correct
Only dynamic tags from asset rule management can target custom collection rules.
CReapply the PAW tag through the API so the rule can see it
DQuery DeviceEvents instead, which already holds all script content
Incorrect
Default telemetry is what custom collection extends; the rule's DeviceCustomScriptEvents table holds the extra events.
Custom data collection requires dynamic tags configured in asset rule management and run at least once; manual tags aren't supported because they don't update as devices change. Collected script events land in DeviceCustomScriptEvents in the selected Sentinel workspace.
All Windows 11 devices run with Local Security Authority (LSA) protection and Credential Guard. The attack surface reduction view lists Block credential stealing from the Windows local security authority subsystem as not applicable, and a manager asks you to put it in Warn mode so users see a bypassable prompt. What do you tell the manager?
AWarn mode works once the rule is moved from Audit to Block
BWarn mode needs the cloud protection level raised to High plus
CIt adds nothing here, and it has no Warn mode in any case
DCredential Guard must be turned off so the rule can take over
Show the answer and why
AWarn mode works once the rule is moved from Audit to Block
Incorrect
This rule doesn't support Warn mode at all.
BWarn mode needs the cloud protection level raised to High plus
Incorrect
Cloud protection levels affect alerts and pop-ups for some other rules; this rule has no Warn mode.
CIt adds nothing here, and it has no Warn mode in any case
Correct
With LSA protection on, the rule isn't required, and it's one of the rules that doesn't support Warn mode.
DCredential Guard must be turned off so the rule can take over
Incorrect
Microsoft recommends LSA protection and Credential Guard; disabling them to use the rule weakens the devices.
When LSA protection is enabled, the LSASS credential theft rule isn't required, provides no extra protection and is classified as not applicable. The rule doesn't support Warn mode, so it can't produce a user prompt.
A penetration test runs for the next ten days and will trigger the analytics rule Suspicious RDP Chain many times. The SOC wants those incidents closed as benign with a tag, and wants the handling to stop on its own after the test, while the analytics rule keeps detecting real attacks. What should you create?
AAn automation rule that closes and tags these incidents, with an expiration date
BQuery suppression on the analytics rule for ten days
CA playbook with the alert trigger called from the analytics rule
DDisable the analytics rule for ten days, then turn it back on after the test ends
Show the answer and why
AAn automation rule that closes and tags these incidents, with an expiration date
Correct
Automation rules can change status, add tags and stop running after their expiration date.
BQuery suppression on the analytics rule for ten days
Incorrect
Suppression stops the rule from running after an alert, so real attacks in that window go undetected.
CA playbook with the alert trigger called from the analytics rule
Incorrect
Alert-trigger playbooks can't change incidents without extra logic and don't end on their own.
DDisable the analytics rule for ten days, then turn it back on after the test ends
Incorrect
A disabled rule detects nothing, real or simulated.
Automation rules handle incident suppression without playbooks: a rule triggered when an incident is created, filtered on the analytics rule name, can close it with a reason and add a tag. An expiration date disables the rule automatically when the test ends.
Tier 1 analysts hold Microsoft Sentinel Responder. They can open an incident and see the Run playbook option, but they can't run the Reset user password playbook on it. They must not edit playbooks or analytics rules. Which role should they also get on the playbook's resource group?
AMicrosoft Sentinel Automation Contributor
BMicrosoft Sentinel Playbook Operator
CLogic App Contributor
DMicrosoft Sentinel Contributor
Show the answer and why
AMicrosoft Sentinel Automation Contributor
Incorrect
That role lets automation rules run playbooks and isn't meant for user accounts.
BMicrosoft Sentinel Playbook Operator
Correct
It lists, views and manually runs playbooks without the right to edit them.
CLogic App Contributor
Incorrect
It also lets them create and edit the logic apps.
DMicrosoft Sentinel Contributor
Incorrect
It adds rights to create and edit analytics rules and other content.
Microsoft Sentinel Responder lets a user open an incident to run a playbook manually but doesn't let them run it. Microsoft Sentinel Playbook Operator grants listing, viewing and running playbooks. Automation Contributor is for the Sentinel service account that runs playbooks from automation rules.
The SOC manager wants an email whenever a new high-severity incident is created in the Microsoft Defender portal. Where do you create the rule?
ASettings > Microsoft Defender XDR > Email notifications, on the Incidents tab
BSettings > Endpoints > Rules > Alert suppression
CSettings > Microsoft Defender XDR > Alert tuning
DThe Action center History tab
Show the answer and why
ASettings > Microsoft Defender XDR > Email notifications, on the Incidents tab
Correct
Incident notification rules are added from the Incidents tab of Email notifications.
BSettings > Endpoints > Rules > Alert suppression
Incorrect
That page manages endpoint alert suppression, not email.
CSettings > Microsoft Defender XDR > Alert tuning
Incorrect
Alert tuning hides, resolves or converts alerts; it doesn't send email.
DThe Action center History tab
Incorrect
The Action center lists remediation actions.
Incident email notification rules are created under Settings > Microsoft Defender XDR > Email notifications > Incidents. A rule sets the alert severities, device group scope and recipients.
Analysts want an email only when Microsoft publishes or updates a threat analytics report tagged Ransomware. What can a threat analytics notification rule do?
ANotify only when a report raises an alert in your tenant
BNotify only for reports that list your devices as exposed
CNotify for new or updated reports of a chosen type or tag
DNotify for every report; filtering by tag isn't possible
Show the answer and why
ANotify only when a report raises an alert in your tenant
Incorrect
Report notifications follow publishing and updates, not your alerts.
BNotify only for reports that list your devices as exposed
Incorrect
The rule filters by report type or tag, not by exposure.
CNotify for new or updated reports of a chosen type or tag
Correct
You can choose all reports or only those of a certain type or with a specific tag.
DNotify for every report; filtering by tag isn't possible
Incorrect
Filtering by report type or tag is supported.
Threat analytics notification rules are created on the Threat analytics tab of Email notifications. They can cover all newly published or updated reports, or only reports of a certain type or with a specific tag such as Ransomware.
You're rolling out attack surface reduction rules to Windows devices. For which group of rules does Microsoft recommend Block mode without extensive testing in Audit mode first?
AAll rules in the Productivity apps category
BThe standard protection rules
CRules that support Warn mode
DNone; every rule needs a month in Audit mode
Show the answer and why
AAll rules in the Productivity apps category
Incorrect
Those are other ASR rules, which need testing in Audit mode first.
BThe standard protection rules
Correct
They offer significant benefit with minimal user impact, so Block mode is recommended.
CRules that support Warn mode
Incorrect
Warn support isn't how Microsoft groups rules for deployment.
DNone; every rule needs a month in Audit mode
Incorrect
Standard protection rules are the exception.
Standard protection rules, such as Block abuse of exploited vulnerable signed drivers, offer significant security benefits with minimal user impact, so Microsoft recommends enabling them in Block mode without extensive testing. Other ASR rules need testing in Audit mode before Block or Warn mode.
Every new Microsoft Sentinel incident from the SAP analytics rules should be assigned to the SAP security specialist as soon as it's created. What's the simplest way to do this?
AA playbook that calls the Microsoft Graph API to assign the incident
BA watchlist of SAP analytics rules
CA workbook that filters SAP incidents
DAn automation rule that assigns the owner
Show the answer and why
AA playbook that calls the Microsoft Graph API to assign the incident
Incorrect
A playbook works but isn't needed for a built-in action.
BA watchlist of SAP analytics rules
Incorrect
A watchlist stores data for queries; it doesn't assign incidents.
CA workbook that filters SAP incidents
Incorrect
A workbook shows data; it doesn't act on incidents.
DAn automation rule that assigns the owner
Correct
Assigning an owner is a built-in automation rule action.
Automation rules can triage incidents without playbooks, including assigning an owner, changing status or severity, adding tags and adding tasks. A rule triggered when an incident is created can match the SAP analytics rules and assign the specialist.