I85PREP
⌘ K
SC-200 study materials
SC-200 study resources

SC-200 practice questions

One question at a time. Build your SC-200 understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Manage a security operations environment

A security operations team wants Microsoft Sentinel to automatically create an incident when a suspicious sign-in is detected. Which Sentinel component is responsible for generating incidents from alerts?

  1. Watchlists
  2. Workbooks
  3. Data connectors
  4. Analytics rules Correct answer.

Explanation

Analytics rules evaluate ingested data on a schedule or in near real time and produce alerts that are grouped into incidents. Workbooks only visualize data, watchlists supply reference data, and connectors bring data in.

Question 2Manage a security operations environment

Which role should be assigned to an analyst who must triage and investigate incidents in Microsoft Sentinel but should not be able to modify analytics rules?

  1. Microsoft Sentinel Contributor
  2. Owner
  3. Microsoft Sentinel Reader
  4. Microsoft Sentinel Responder Correct answer.

Explanation

The Microsoft Sentinel Responder role allows an analyst to view data and manage incidents, including assigning and closing them, without changing detection content. Contributor and Owner can modify rules, while Reader is view-only.

Question 3Manage a security operations environment

An organization needs Microsoft Defender XDR to correlate alerts across endpoints, email, identity, and cloud apps. Which configuration is required to enable this cross-domain correlation?

  1. Create a separate workspace for each Defender workload
  2. Disable built-in alert correlation in each product
  3. Enable the unified Microsoft Defender XDR portal and connect each workload Correct answer.
  4. Install the Log Analytics agent on all domain controllers

Explanation

Cross-domain incident correlation in Defender XDR occurs when the individual Defender workloads are onboarded and surfaced through the unified portal. Separate workspaces or disabling correlation would prevent unified incidents, and the Log Analytics agent is unrelated.

Question 4Manage a security operations environment

A SOC wants to reduce noise by suppressing a specific low-fidelity analytics rule during business hours only. What is the most appropriate built-in mechanism?

  1. Change the rule severity to Informational
  2. Add an automation rule with a time condition that closes matching incidents Correct answer.
  3. Delete the analytics rule each morning
  4. Disable the connector that supplies the data

Explanation

Automation rules can run conditionally, including time-based conditions, and can close or modify matching incidents without destroying detection content. Deleting rules or disabling connectors removes detection entirely, and lowering severity does not suppress the incidents.

Question 5Manage a security operations environment

Which Microsoft Sentinel feature lets analysts run a saved query on demand and optionally attach it to an incident for investigation?

  1. Data collection rules
  2. Playbooks
  3. Watchlists
  4. Hunting queries Correct answer.

Explanation

Hunting queries are saved log queries that analysts run proactively to look for threats and can be linked to incidents as part of investigation. Watchlists hold reference data, playbooks automate responses, and collection rules govern ingestion.

Question 6Manage a security operations environment

A SOC needs to automatically enrich new incidents with threat intelligence indicators before an analyst reviews them. Which Sentinel capability should be used?

  1. A workbook with a time chart
  2. A scheduled analytics rule
  3. A watchlist uploaded manually each week
  4. An automation rule that triggers a playbook Correct answer.

Explanation

Automation rules can trigger playbooks when incidents are created, and the playbook can query threat intelligence and write results back to the incident. Scheduled rules only detect, workbooks only display, and manual watchlists are not automated enrichment.

Question 7Manage a security operations environment

Which data connector type in Microsoft Sentinel uses the Azure Monitor Agent and data collection rules to ingest Windows security events from virtual machines?

  1. Microsoft 365 Defender connector
  2. Codeless connector via the data connector page
  3. Syslog via the Log Analytics agent
  4. Windows Security Events via AMA Correct answer.

Explanation

The Windows Security Events via AMA connector uses the Azure Monitor Agent and data collection rules to select which event sets to collect. The legacy Log Analytics agent connector is deprecated, and the other connectors target different sources.

Question 8Manage a security operations environment

An analyst wants to see which analytics rules are currently firing most often to prioritize tuning. Which Sentinel area provides rule-level health and incident counts?

  1. The Analytics blade with rule status and incident metrics Correct answer.
  2. The Logs blade query history
  3. The Repositories blade
  4. The Watchlist blade

Explanation

The Analytics blade lists rules with their status and links to the incidents they generate, which supports tuning decisions. Query history, watchlists, and repositories do not summarize rule firing frequency.

Question 9Manage a security operations environment

A SOC wants to ensure that only specific IP ranges can access the Microsoft Sentinel workspace while analysts work remotely. Which control should be applied?

  1. A watchlist of allowed IPs
  2. An analytics rule that flags foreign IPs
  3. Conditional Access with named locations Correct answer.
  4. A workbook showing sign-in locations

Explanation

Conditional Access policies with named locations enforce network-based access conditions at the identity layer. A watchlist or analytic rule only observes traffic after access, and a workbook only reports on it.

Question 10Manage a security operations environment

Which Microsoft Sentinel setting determines how long ingested data is retained in the workspace before being purged?

  1. The playbook trigger condition
  2. The data connector schedule
  3. The analytics rule frequency
  4. The workspace retention setting Correct answer.

Explanation

Workspace retention controls how long data remains queryable before deletion, and it can be configured per table. Rule frequency, connector schedules, and playbook triggers affect processing, not storage duration.

Question 11Manage a security operations environment

An analyst is investigating an incident and wants to view the full alert timeline and related entities such as accounts, hosts, and IP addresses. Which incident feature provides this?

  1. The data connector status page
  2. The watchlist editor
  3. The workbook gallery
  4. The incident investigation graph Correct answer.

Explanation

The investigation graph maps entities and their relationships around an incident so analysts can explore the attack path. Workbooks, connector pages, and watchlist editors do not provide entity relationship mapping.

Question 12Manage a security operations environment

A SOC needs to grant a managed identity permission to read incidents so a playbook can update them automatically. Which approach follows least privilege?

  1. Assign Owner at the subscription scope to the managed identity
  2. Assign the Microsoft Sentinel Responder role at the workspace scope Correct answer.
  3. Share an administrator account credential with the playbook
  4. Enable the global administrator role for the identity

Explanation

Granting the Sentinel Responder role scoped to the workspace gives the identity exactly the incident permissions needed. Subscription Owner and global administrator are far broader than required, and sharing credentials violates secure practice.

Question 13Manage a security operations environment

Which Microsoft Defender XDR feature allows a SOC to run a query across all connected workloads to hunt for threats?

  1. Advanced hunting Correct answer.
  2. Attack surface reduction rules
  3. Safe Links policies
  4. Device groups

Explanation

Advanced hunting uses Kusto Query Language to search across endpoint, email, identity, and cloud app data in Defender XDR. Attack surface reduction, Safe Links, and device groups are protection or management features, not cross-workload hunting.

Question 14Manage a security operations environment

An organization wants automated investigation and remediation to run when Defender XDR raises a high-severity incident. Which configuration enables this?

  1. Create a watchlist of high-severity alerts
  2. Disable the alert correlation engine
  3. Set the incident severity to Informational
  4. Enable automated investigation in the Defender XDR settings Correct answer.

Explanation

Automated investigation settings in Defender XDR control whether incidents trigger automated analysis and remediation actions. Severity changes, watchlists, and disabling correlation do not start automated investigations.

Question 15Manage a security operations environment

A SOC wants to onboard a new analyst quickly and ensure they can see incidents but not change workspace settings. Which built-in role best fits?

  1. Logic App Contributor
  2. Microsoft Sentinel Playbook Operator
  3. Microsoft Sentinel Contributor
  4. Microsoft Sentinel Reader Correct answer.

Explanation

Microsoft Sentinel Reader grants read access to incidents and data without configuration rights. Contributor can modify content, Playbook Operator runs playbooks, and Logic App Contributor manages automation resources.

Question 16Manage a security operations environment

An analyst needs to correlate sign-in events with a list of known bad IP addresses maintained by the threat intelligence team. Which Sentinel feature is designed for this correlation?

  1. A data collection rule
  2. A playbook trigger
  3. A workbook parameter
  4. A watchlist queried in an analytics rule Correct answer.

Explanation

Watchlists store reference lists such as known bad IPs and can be joined in analytics rule queries for correlation. Workbooks, collection rules, and playbook triggers do not provide reference list correlation.

Question 17Manage a security operations environment

Which Microsoft Sentinel content type packages analytics rules, playbooks, and workbooks for deployment across multiple workspaces?

  1. A data connector
  2. A watchlist
  3. A solution Correct answer.
  4. An incident task

Explanation

Solutions bundle related Sentinel content such as rules, playbooks, and workbooks for consistent deployment. Watchlists, connectors, and incident tasks are individual components rather than packaged content.

Question 18Manage a security operations environment

A SOC wants to automatically assign new incidents to the on-call analyst based on a rotating schedule stored in a watchlist. Which approach is most appropriate?

  1. Use an automation rule with a playbook that reads the watchlist and sets the owner Correct answer.
  2. Add the roster to an analytics rule query
  3. Manually reassign incidents each shift
  4. Create a workbook showing the on-call roster

Explanation

Automation rules can trigger a playbook that looks up the on-call entry in a watchlist and updates the incident owner. Manual reassignment is inefficient, and workbooks or rule queries cannot change incident ownership.

Question 19Manage a security operations environment

An analyst wants to test a new analytics rule without generating production incidents. Which approach is recommended?

  1. Disable all other rules while testing
  2. Set the rule severity to High and monitor closely
  3. Set the rule to run in a test workspace with sample data
  4. Run the rule query manually in Logs and review results Correct answer.

Explanation

Running the rule's query manually in Logs lets an analyst validate logic and results without creating incidents. Disabling other rules disrupts detection, and severity changes do not prevent incident creation.

Question 20Manage a security operations environment

Which setting in Microsoft Sentinel controls whether an incident is created when multiple alerts from the same rule fire within a short window?

  1. The workspace retention period
  2. The playbook run history
  3. Alert grouping settings in the analytics rule Correct answer.
  4. The data connector schedule

Explanation

Alert grouping settings determine how related alerts are combined into a single incident, reducing duplicate incidents. Retention, connector schedules, and playbook history do not affect incident grouping.

Question 21Manage a security operations environment

A SOC wants to review which automation playbooks failed during the last week. Where can this information be found?

  1. The data connector health page
  2. The watchlist audit log
  3. The automation run history in Microsoft Sentinel Correct answer.
  4. The incident investigation graph

Explanation

Automation run history shows playbook executions and their outcomes, allowing failed runs to be identified. Investigation graphs, connector health, and watchlist logs do not track playbook execution results.

Question 22Manage a security operations environment

An organization wants to ensure that Defender XDR incidents and Microsoft Sentinel incidents appear in a single view. Which configuration achieves this?

  1. Export incidents to a spreadsheet daily
  2. Create a separate workbook for each product
  3. Connect Microsoft Sentinel to the unified Defender portal Correct answer.
  4. Disable incident creation in Sentinel

Explanation

Onboarding Microsoft Sentinel to the unified Microsoft Defender portal surfaces both Sentinel and Defender incidents in one experience. Separate workbooks, disabling Sentinel incidents, and manual exports do not unify the views.

Question 23Manage a security operations environment

A SOC lead must design a process so that only approved analytics rule changes reach production. Which approach best supports this governance requirement?

  1. Allow all analysts to edit rules directly in production
  2. Disable audit logging to reduce noise
  3. Rely on workbook change history
  4. Use source control repositories with review and deployment pipelines Correct answer.

Explanation

Storing Sentinel content in repositories enables pull-request review and automated deployment, enforcing approval before production changes. Direct edits, workbook history, and disabling audit logs do not provide controlled change management.

Question 24Manage a security operations environment

Which Microsoft Sentinel table typically stores security events collected from Windows machines through the Azure Monitor Agent?

  1. SecurityEvent Correct answer.
  2. SigninLogs
  3. AuditLogs
  4. CommonSecurityLog

Explanation

The SecurityEvent table holds Windows security events collected via the Azure Monitor Agent. SigninLogs holds Entra ID sign-ins, AuditLogs holds directory audit records, and CommonSecurityLog holds CEF-formatted device logs.

Question 25Manage a security operations environment

A SOC wants to detect impossible travel sign-ins and automatically open an incident with the affected user as an entity. Which configuration is required in the analytics rule?

  1. Enable entity mapping for the account field Correct answer.
  2. Disable alert grouping
  3. Set the rule to run every 24 hours
  4. Add the user list to a workbook

Explanation

Entity mapping links fields in the query output to entity types such as Account so the incident shows the affected user. Rule frequency, workbooks, and alert grouping do not populate incident entities.

Question 26Manage a security operations environment

Which Microsoft Sentinel role allows a user to manage incidents and automation rules but does not allow changing workspace-level settings such as data retention?

  1. Microsoft Sentinel Reader
  2. Microsoft Sentinel Responder Correct answer.
  3. Microsoft Sentinel Contributor
  4. Microsoft Sentinel Playbook Operator

Explanation

The Microsoft Sentinel Responder role is scoped to triaging and acting on incidents, including assigning, closing, and running automation on them, but it deliberately excludes workspace configuration. Contributor adds the ability to create and edit content such as analytics rules and workbooks. Only Owner-level or specific administrative roles control workspace settings like retention.

Question 27Manage a security operations environment

A SOC wants a single identity to authenticate playbooks that read and update Microsoft Sentinel incidents without storing a client secret. Which Azure AD construct should be used?

  1. A managed identity assigned to the logic app Correct answer.
  2. A service principal with a client secret stored in the playbook
  3. A shared mailbox account with delegated permissions
  4. A user account with multi-factor authentication disabled

Explanation

A managed identity gives an Azure resource, such as a Logic App, an automatically managed credential in Azure AD, so no secret is stored or rotated by the SOC. The identity is then granted a Sentinel role on the workspace, such as Responder. This removes the credential-management risk that secrets and password-based accounts introduce.

Question 28Manage a security operations environment

An analyst needs to review the complete alert history, entities, and investigation graph for a single security incident in Microsoft Sentinel. Which feature provides this consolidated view?

  1. The incident details page Correct answer.
  2. The workbooks gallery
  3. The data connectors page
  4. The Logs blade

Explanation

The incident details page consolidates the alerts that make up an incident, the mapped entities such as accounts and hosts, and the investigation experience. Analysts use it as the starting point for triage and evidence gathering. The other areas serve querying, reporting, and ingestion configuration rather than incident-centric review.

Question 29Manage a security operations environment

Which Microsoft Sentinel table stores Windows security events forwarded from machines using the Azure Monitor Agent and a data collection rule?

  1. SecurityEvent Correct answer.
  2. CommonSecurityLog
  3. SigninLogs
  4. AuditLogs

Explanation

The SecurityEvent table is the standard destination for Windows Security event log data collected through the Azure Monitor Agent and an associated data collection rule. SigninLogs holds Azure AD sign-in records, CommonSecurityLog holds CEF-formatted device logs, and AuditLogs holds Azure AD audit activity. Analysts query SecurityEvent when investigating Windows authentication and privilege events.

Question 30Manage a security operations environment

Which Microsoft Sentinel setting controls how long ingested data remains queryable in the workspace before it is removed?

  1. The analytics rule lookback window
  2. The data collection rule stream declaration
  3. The incident grouping setting
  4. The workspace retention setting Correct answer.

Explanation

Workspace retention defines how long data stays available in the workspace, and it can be configured per table. After the retention period elapses, data is purged unless archived or exported. Lookback windows and grouping settings affect detection behavior, not storage lifetime.

Question 31Manage a security operations environment

A SOC wants to run a single hunting query across Microsoft Defender XDR workloads such as endpoints, email, and identities. Which capability should the analyst use?

  1. Sentinel workbooks
  2. Attack surface reduction rules
  3. Advanced hunting with KQL Correct answer.
  4. Defender for Cloud regulatory compliance

Explanation

Advanced hunting in Microsoft Defender XDR uses KQL to query a unified schema spanning endpoints, email, identities, and cloud apps. This lets analysts correlate signals across workloads in one query rather than switching portals. Workbooks, compliance dashboards, and ASR rules do not provide cross-workload query access.

Question 32Manage a security operations environment

Which Microsoft Sentinel content type bundles analytics rules, playbooks, workbooks, and parsers so they can be deployed consistently across many workspaces?

  1. A hunting query
  2. A watchlist
  3. A saved search
  4. A solution Correct answer.

Explanation

Solutions package related Sentinel content, including analytics rules, automation playbooks, workbooks, and parsers, so they can be installed and versioned across workspaces. Saved searches, watchlists, and hunting queries are individual artifacts rather than deployment packages. Using solutions keeps multi-workspace deployments consistent.

Question 33Manage a security operations environment

A SOC lead wants to confirm which automation playbooks failed during the past week. Where should the lead look?

  1. The workspace usage and cost report
  2. The Logic Apps run history for the playbooks Correct answer.
  3. The Sentinel automation rule run history
  4. The analytics rule health page

Explanation

Playbooks are Logic Apps, so each execution and its failure details appear in the Logic App run history, where failed actions and error messages can be inspected. Automation rule history shows whether the rule triggered and which playbook it invoked, but the detailed failure diagnostics live in the Logic App. Reviewing run history is the standard way to troubleshoot playbook failures.

Question 34Manage a security operations environment

An analyst wants to correlate sign-in events with a list of known malicious IP addresses maintained outside Sentinel. Which approach is most appropriate?

  1. Export SigninLogs to a spreadsheet and compare manually
  2. Create a watchlist and join it to the SigninLogs table in a KQL query Correct answer.
  3. Add the IPs as entity mappings in an analytics rule
  4. Create an automation rule that emails the IP list daily

Explanation

Watchlists store reference data, such as threat indicators, that can be joined to log tables in KQL queries and referenced by analytics rules. Uploading the IP list to a watchlist makes the comparison repeatable and automatable. Manual comparison, emailing the list, and entity mappings do not provide a queryable data set for correlation.

Question 35Manage a security operations environment

A SOC wants new incidents automatically assigned to the on-call analyst whose name rotates weekly in a SharePoint list. Which Sentinel capability should be used?

  1. A data collection rule transform
  2. A workbook with a parameter for the analyst name
  3. An automation rule that reads a watchlist and assigns the owner Correct answer.
  4. An analytics rule with entity mapping

Explanation

Automation rules can trigger on incident creation and invoke a playbook that reads the current on-call entry from a watchlist, then assigns the incident owner. Keeping the rotation in a watchlist lets the schedule be updated without editing the rule. Analytics rules detect events, workbooks display data, and collection rules transform ingestion, so none of them assign ownership.

Question 36Manage a security operations environment

An analyst wants to validate a new analytics rule against historical data without creating production incidents. Which approach is recommended?

  1. Disable all other analytics rules while testing
  2. Ask another team to test the rule in their workspace
  3. Run the rule in a production workspace and delete any incidents it creates
  4. Enable the rule with incident creation turned off and review its results Correct answer.

Explanation

Sentinel lets a rule run while incident creation is disabled, so the analyst can see whether and how often it would fire without polluting the incident queue. After validating the results and tuning thresholds, incident creation can be enabled. Disabling other rules, deleting incidents, or testing in another team's workspace introduces avoidable risk or disruption.

Question 37Manage a security operations environment

A SOC wants multiple alerts from the same analytics rule to be combined into one incident while the incident is open. Which Sentinel setting controls this behavior?

  1. The rule's severity level
  2. The workspace retention period
  3. The incident grouping setting on the analytics rule Correct answer.
  4. The entity mapping configuration

Explanation

Incident grouping determines whether alerts are grouped into a single incident, for example by combining all alerts from one rule into one incident while it remains open. Severity affects prioritization, retention affects storage, and entity mapping affects which entities are attached. Grouping is the setting that governs alert-to-incident consolidation.

Question 38Manage a security operations environment

An organization wants Defender XDR incidents and Microsoft Sentinel incidents to appear in a unified incident queue. What must be configured?

  1. Export Defender incidents to a watchlist on a schedule
  2. Enable auditing on the Sentinel workspace
  3. Connect Microsoft Defender XDR to Microsoft Sentinel in the workspace data connectors Correct answer.
  4. Create a duplicate analytics rule for each Defender detection

Explanation

Connecting Microsoft Defender XDR to Microsoft Sentinel streams Defender incidents and alerts into the workspace, so analysts can triage them alongside native Sentinel incidents. This integration also supports advanced hunting data and incident updates flowing between the products. Exporting, auditing, or duplicating rules does not produce a unified queue.

Question 39Manage a security operations environment

A SOC wants automated investigation and remediation to start when Defender XDR raises a high-severity incident. Which configuration is required?

  1. Set the incident severity threshold in the automated investigation settings Correct answer.
  2. Enable audit logging on the Defender portal
  3. Create a Sentinel watchlist of high-severity alerts
  4. Assign the Security Reader role to the automation account

Explanation

Defender XDR automated investigation and response settings let administrators define the severity threshold and whether remediation actions run automatically or require approval. Once configured, qualifying incidents trigger investigations without analyst initiation. Watchlists, audit logging, and read-only roles do not start automated investigations.

Question 40Manage a security operations environment

A SOC must ensure that only approved analytics rule changes reach production. Which approach best supports this requirement?

  1. Deploy rules from a source-controlled repository using an infrastructure-as-code pipeline with approvals Correct answer.
  2. Allow analysts to edit rules directly in the portal
  3. Restrict all rule creation to a single administrator
  4. Rely on weekly manual reviews of the analytics page

Explanation

Managing analytics rules as code in a repository, with a deployment pipeline that enforces review and approval, provides traceability and prevents unreviewed changes from reaching production. Direct portal edits, manual reviews, and single-administrator restrictions lack enforced gates and version history. This approach also supports rollback and consistent multi-workspace deployment.

Question 41Manage a security operations environment

An analyst needs to see which analytics rules are firing most frequently to prioritize tuning. Which Sentinel area should the analyst use?

  1. The analytics rule health and insights view Correct answer.
  2. The workspace settings blade
  3. The data connectors page
  4. The entity behavior analytics page

Explanation

The analytics rule insights and health view summarizes rule execution, alert volume, and firing frequency so analysts can spot noisy rules. This information supports tuning thresholds and reducing alert fatigue. Connector pages, workspace settings, and entity behavior pages do not report per-rule firing frequency.

Question 42Manage a security operations environment

A SOC wants to detect impossible travel sign-ins and open an incident that includes the affected user as an entity. Which configuration is needed?

  1. A data collection rule with a transform
  2. An analytics rule with scheduled frequency and user entity mapping Correct answer.
  3. A watchlist containing all user accounts
  4. A workbook with a user parameter

Explanation

A scheduled analytics rule evaluates sign-in data at a defined frequency, and entity mapping identifies the user field so the incident includes the account entity. Including the entity enables investigation and response actions against the user. Collection rules, workbooks, and watchlists do not create incidents with mapped entities.

Question 43Manage a security operations environment

A SOC wants to restrict access to the Microsoft Sentinel workspace so only specific IP ranges can reach it while analysts work remotely. Which control should be applied?

  1. Data collection rule filters
  2. Workspace retention settings
  3. Incident grouping rules
  4. Conditional Access with named locations Correct answer.

Explanation

Conditional Access policies with named locations can allow or block access based on the source network, and they apply across the Microsoft security portal and related services. Retention, collection filters, and grouping rules affect data handling rather than access control. Combining named locations with other conditions tightens remote access.

Question 44Manage a security operations environment

A SOC ingests third-party firewall logs in CEF format through a log forwarder. Which Sentinel table receives this data by default?

  1. SecurityEvent
  2. Heartbeat
  3. Syslog
  4. CommonSecurityLog Correct answer.

Explanation

CEF-formatted logs sent through the Log Analytics agent or AMA-based forwarder land in the CommonSecurityLog table, where they can be parsed and correlated. SecurityEvent holds Windows events, Syslog holds raw Linux-style messages, and Heartbeat tracks agent health. Knowing the destination table is essential for writing detection queries.

Question 45Manage a security operations environment

An analyst wants to enrich incidents with threat intelligence indicators from Microsoft Defender Threat Intelligence inside Microsoft Sentinel. Which approach provides this enrichment?

  1. Create a workbook that lists indicators
  2. Enable auditing on the workspace
  3. Use the threat intelligence data connector and matching analytics rules Correct answer.
  4. Add indicators to an incident comment manually

Explanation

The threat intelligence connector imports indicators into Sentinel, and analytics rules that use the built-in matching templates generate alerts when logs match those indicators. This automates enrichment and detection rather than relying on manual review. Workbooks, manual comments, and auditing do not provide indicator matching.

Question 46Manage a security operations environment

A SOC wants an incident to be created only when a scheduled analytics rule produces more results than a defined baseline in a single run. Which rule configuration supports this?

  1. Change the rule severity to High
  2. Set the rule's alert threshold to trigger on the number of results Correct answer.
  3. Increase the rule's query lookback period
  4. Add more entity mappings to the rule

Explanation

Scheduled analytics rules can be configured so an alert fires only when the number of query results exceeds a threshold, which helps suppress low-volume noise. Lookback changes the query window, severity affects prioritization, and entity mappings affect incident content. Only the threshold setting gates alert creation on result count.

Question 47Manage a security operations environment

A SOC needs to grant a playbook permission to read incidents in a specific workspace only, following least privilege. Which assignment is most appropriate?

  1. Assign the managed identity the Global Administrator directory role
  2. Assign the managed identity the Owner role at the subscription scope
  3. Assign the managed identity the Security Reader role at the tenant root scope
  4. Assign the managed identity the Microsoft Sentinel Responder role on the workspace resource Correct answer.

Explanation

Granting the playbook's managed identity the Responder role scoped to the specific workspace gives it the incident read and update permissions it needs without broader access. Subscription-level Owner and tenant-wide directory roles vastly exceed the requirement. Least privilege limits the blast radius if the identity is misused.

Question 48Manage a security operations environment

A SOC observes that an automation rule fires but the playbook never runs. Which cause should be investigated first?

  1. The playbook's connection or managed identity lacks the required permissions Correct answer.
  2. The workspace retention period is too short
  3. The analytics rule severity is set to Low
  4. The incident grouping setting is disabled

Explanation

When an automation rule triggers but the playbook does not execute, the most common cause is an authorization failure in the playbook's connections or managed identity. Checking the Logic App run history and the identity's role assignments confirms whether permission is the blocker. Retention, severity, and grouping affect data lifetime or incident formation, not playbook authorization.

Question 49Manage a security operations environment

An analyst must determine whether a spike in incidents is caused by a single noisy analytics rule or by a genuine increase in malicious activity. Which analysis approach is most reliable?

  1. Compare per-rule alert volume against historical baselines and inspect a sample of matched events Correct answer.
  2. Assign all new incidents to a single analyst for review
  3. Increase retention to ninety days and wait for the next spike
  4. Disable the noisiest rule and observe whether the incident count drops

Explanation

Comparing per-rule volume with historical baselines, then sampling matched events, distinguishes a tuning problem from real adversary activity. Disabling a rule merely hides the signal, longer retention does not explain the spike, and assigning incidents does not analyze the cause. Evidence-based triage avoids both false alarms and missed threats.

Question 50Manage a security operations environment

A SOC wants to reduce ingestion cost without losing the ability to detect high-value events. Which strategy best balances cost and detection coverage?

  1. Send all logs to a basic logs table and query them only during incidents
  2. Disable all data connectors and rely on manual log review
  3. Reduce the number of analytics rules to lower ingestion volume
  4. Apply ingestion-time filtering and table-level retention plans to keep only security-relevant events Correct answer.

Explanation

Filtering at ingestion with data collection rule transforms and choosing appropriate table plans or retention tiers removes low-value data while preserving events that detections depend on. Disabling connectors, indiscriminately using basic logs, or cutting analytics rules degrades detection coverage rather than optimizing cost. The goal is to retain high-value telemetry at the right tier.