SC-200 · Domain 1: Manage a security operations environment · 41% of the exam
Task 1.4: Configure detections
Custom detection rules from advanced hunting, Sentinel scheduled, NRT, threat intelligence and machine learning analytics rules, MITRE ATT&CK coverage, and anomalies.
Study it
Custom detections in Defender XDR: frequency, lookback, entities and actions
Lesson coming
Sentinel analytics rules: scheduled, NRT, threat intelligence and machine learning
Lesson coming
MITRE ATT&CK coverage and customizable anomalies
Lesson coming
Sample questions
Try each one before opening the answer. Every option is explained, with the Microsoft documentation page that proves it.
Question 1 · choose 1
A custom detection joins DeviceProcessEvents with DeviceNetworkEvents to find a process that launches and connects out within one minute. You want it to run at Continuous (NRT) frequency, but the option isn't offered for the rule. What should you change?
ALower the lookback to five minutes
BAdd DeviceId and ReportId to the projected columns
CRemove the comment lines and keep the join
DRewrite it as single-table queries without a join
Show the answer and why
ALower the lookback to five minutes
Incorrect
The lookback isn't what blocks Continuous frequency.
BAdd DeviceId and ReportId to the projected columns
Incorrect
Projected columns don't change whether a join is eligible.
CRemove the comment lines and keep the join
Incorrect
Comments do block Continuous frequency, but so does the join.
DRewrite it as single-table queries without a join
Correct
Continuous frequency needs a query on one table with no joins, unions or externaldata.
A custom detection can run continuously only when the query references one table, uses supported operators, and has no joins, unions, externaldata or comment lines. A join across two tables must be rewritten, for example as separate single-table rules, or kept at a scheduled frequency.
A custom detection on Defender for Endpoint tables runs every three hours. An analyst is surprised that a run flagged an event that happened ten hours earlier. What lookback does each run of this rule apply?
A12 hours on every run
B3 hours, matching the frequency
C48 hours on every run
D30 days on every run
Show the answer and why
A12 hours on every run
Correct
Rules on Defender XDR data that run every three hours look back 12 hours.
B3 hours, matching the frequency
Incorrect
Lookback for Defender data is fixed per frequency and longer than the interval.
C48 hours on every run
Incorrect
48 hours is the lookback for rules that run every 12 hours.
D30 days on every run
Incorrect
30 days applies to the first run and to daily rules.
For custom detections that include Defender XDR data, the lookback is fixed by frequency: 24 hours to 30 days, 12 hours to 48 hours, 3 hours to 12 hours and hourly to 4 hours. A new rule first checks the past 30 days. Overlapping results are deduplicated automatically.
A scheduled analytics rule is set to Trigger an alert for each event. During an outbreak, one run returns 400 results. How many alerts does that run create?
A400, one for each result
B150: 149 for single events and one that summarizes all of them
C30: 29 alerts for single events and a 30th alert that summarizes the rest
DOne, because the threshold was exceeded
Show the answer and why
A400, one for each result
Incorrect
Analytics rules can generate up to 150 alerts per run.
B150: 149 for single events and one that summarizes all of them
Correct
Past 150 results, the 150th alert summarizes the whole result set.
C30: 29 alerts for single events and a 30th alert that summarizes the rest
Incorrect
The 30-alert cap applies to NRT rules.
DOne, because the threshold was exceeded
Incorrect
One alert per run happens only with Group all events into a single alert.
Analytics rules can generate up to 150 alerts. With Trigger an alert for each event and more than 150 results, the first 149 events each create an alert and the 150th alert summarizes the entire result set.
Your workspace is onboarded to the Defender portal and already has 50 NRT analytics rules. You need another near-real-time detection on SigninLogs, with a query that would qualify for an NRT rule, and you want an approach that keeps scaling. What should you do?
ACreate a scheduled analytics rule that runs every minute
BDuplicate an existing NRT rule and change its query
CRaise the NRT rule limit for the workspace in Microsoft Sentinel settings
DCreate a custom detection with Continuous (NRT) frequency
Show the answer and why
ACreate a scheduled analytics rule that runs every minute
Incorrect
Scheduled rules run at intervals of 5 minutes or more.
BDuplicate an existing NRT rule and change its query
Incorrect
A duplicate is still an NRT rule and counts toward the 50-rule cap.
CRaise the NRT rule limit for the workspace in Microsoft Sentinel settings
Incorrect
The 50-rule limit isn't a setting you can change.
DCreate a custom detection with Continuous (NRT) frequency
Correct
Continuous custom detections support SigninLogs and aren't NRT analytics rules, so the 50-rule limit doesn't apply to them.
No more than 50 NRT analytics rules can be defined. Custom detections are a separate rule type, and their Continuous (NRT) frequency supports Sentinel tables such as SigninLogs, so a qualifying query runs in near real time without counting toward that limit.
You enable the Microsoft Defender Threat Intelligence Analytics rule. Which two of your ingested data sources does the rule match against Microsoft indicators? (Choose TWO.)
ASecurityEvent process command lines
BCommonSecurityLog RequestURL and DestinationIP values
CDevice file hashes in DeviceFileEvents
DWindows DNS lookup queries in the DnsEvents table
EOnly sources covered by a premium Defender Threat Intelligence license
Show the answer and why
ASecurityEvent process command lines
Incorrect
Windows security events aren't among the sources the rule matches.
BCommonSecurityLog RequestURL and DestinationIP values
Correct
CEF logs are matched on URL, domain and IPv4 indicators in these fields.
CDevice file hashes in DeviceFileEvents
Incorrect
The rule matches domain, IP and URL indicators, not file hashes in Defender tables.
DWindows DNS lookup queries in the DnsEvents table
Correct
DnsEvents rows with SubType LookupQuery are matched on domain and IPv4 indicators.
EOnly sources covered by a premium Defender Threat Intelligence license
Incorrect
The rule doesn't require a premium license.
The Microsoft Defender Threat Intelligence Analytics rule matches domain, IP and URL indicators against CEF (CommonSecurityLog), Windows DNS (DnsEvents), syslog, OfficeActivity, AzureActivity and ASIM DNS and network session data. No premium license is needed; alerts are grouped into incidents by the matched indicator.
An out-of-the-box anomaly rule records too many anomalies because its threshold is too low. You want to raise the threshold and compare the results with the original. What do you do?
AEdit the threshold on the original rule
BDelete the rule and rebuild its logic as a scheduled analytics rule
CDuplicate the rule, edit the copy's threshold and enable it
DMake two customized copies with different thresholds
Show the answer and why
AEdit the threshold on the original rule
Incorrect
Out-of-the-box anomaly rules can't be edited or deleted.
BDelete the rule and rebuild its logic as a scheduled analytics rule
Incorrect
Built-in anomaly rules can't be deleted, and that loses the anomaly logic.
CDuplicate the rule, edit the copy's threshold and enable it
Correct
The customized copy starts disabled in Flighting mode and runs alongside the original.
DMake two customized copies with different thresholds
Incorrect
Only one customized copy of a given anomaly rule is allowed.
To tune an anomaly rule, duplicate it. The copy is named with "- Customized", starts disabled and in Flighting mode, and only one copy per rule is allowed. The original keeps running, so you can compare the results of both.
How often does a Microsoft Sentinel near-real-time (NRT) analytics rule run its query?
AEvery five minutes
BEvery hour
CContinuously, event by event as data streams
DOnce every minute
Show the answer and why
AEvery five minutes
Incorrect
NRT rules run more often than that.
BEvery hour
Incorrect
That's a common scheduled rule interval.
CContinuously, event by event as data streams
Incorrect
Sentinel NRT rules test events after ingestion, at a fixed interval.
DOnce every minute
Correct
NRT rules are hard-coded to run every minute.
NRT rules are hard-coded to run once every minute and capture events ingested in the preceding minute. They query on ingestion time with a two-minute delay.
A manager asks how much better MITRE ATT&CK coverage would be if the SOC turned on all the available rule templates. How do you show this in Microsoft Sentinel?
AExport all analytics rules to ARM templates and count techniques
BSelect simulated rules on the MITRE ATT&CK page
COpen the Anomalies tab and filter by tactic
DRun all hunting queries and review the tactic bar
Show the answer and why
AExport all analytics rules to ARM templates and count techniques
Incorrect
Export moves rules; it doesn't visualize coverage.
BSelect simulated rules on the MITRE ATT&CK page
Correct
Simulated coverage shows detections that are available but not yet configured.
COpen the Anomalies tab and filter by tactic
Incorrect
It lists anomaly rules, not the overall coverage matrix.
DRun all hunting queries and review the tactic bar
Incorrect
The tactic bar counts hunting queries, not analytics coverage.
The MITRE ATT&CK page shows the coverage of active scheduled and NRT rules. Selecting items in the Simulated rules menu shows the coverage you would have if you configured the available detections.
Anomaly rules are enabled in your workspace, but they never create alerts. Where do their results go?
AThe SecurityAlert table, with severity Informational
BThe incident queue, as low-severity incidents
CThe Anomalies table
DBehaviorInfo in advanced hunting
Show the answer and why
AThe SecurityAlert table, with severity Informational
Incorrect
Anomaly rules don't generate alerts.
BThe incident queue, as low-severity incidents
Incorrect
They don't create incidents either.
CThe Anomalies table
Correct
Detected anomalies are recorded in the Anomalies table.
DBehaviorInfo in advanced hunting
Incorrect
BehaviorInfo holds Defender behaviors, not Sentinel anomalies.
Anomaly rules learn a baseline and flag behavior outside it, but anomalies alone aren't necessarily malicious, so the rules don't generate alerts. Results go to the Anomalies table, which you can query to enrich detections, investigations and hunting.
You want each alert from a custom detection to be titled with the account and country from the query results, for example "User jdoe signed in from Brazil". How do you write the title?
AUser {{AccountName}} signed in from {{Country}}
BUser $AccountName signed in from $Country
CUser <b>AccountName</b> signed in from <b>Country</b>
DIt isn't possible; titles are static text
Show the answer and why
AUser {{AccountName}} signed in from {{Country}}
Correct
Column names in double curly brackets are filled from the results.
BUser $AccountName signed in from $Country
Incorrect
Dynamic fields use double curly brackets, not dollar signs.
CUser <b>AccountName</b> signed in from <b>Country</b>
Incorrect
Titles are sanitized; HTML and Markdown don't work.
DIt isn't possible; titles are static text
Incorrect
Dynamic titles and descriptions are supported.
To make an alert title or description dynamic, reference columns from the query results in double curly brackets, such as {{AccountName}}. Up to three columns can be referenced in each field.