Microsoft Security Operations Analyst Associate Practice Test (SC-200)

Microsoft Sentinel includes a built-in analytics rule template named Ingestion volume anomalies. When enabled, the rule automatically learns normal ingestion patterns for each table and generates an incident if the current volume sharply exceeds the historical baseline. A daily cap limits cost but produces no alert, the Usage and estimated costs workbook is only for interactive review, and the Entity behavior analytics template focuses on user and host behavior rather than ingestion metrics.

Only members of the Insider Risk Management Investigators role group can open and read the full content of files and emails referenced in insider risk alerts. Insider Risk Management Analysts can review alert metadata and user activity timelines but cannot see content. Compliance Data Administrators and eDiscovery Managers have capabilities in other Microsoft Purview areas but do not grant the specific permission required to preview insider risk evidence.

When device discovery is enabled and left in its default Basic mode, the SenseNDR component on each onboarded Windows device passively captures local network traffic such as ARP, DHCP, DNS, and NetBIOS broadcasts. From this broadcast traffic it infers the presence of other hosts on the same subnet. Any host that appears in the traffic but does not report itself to the MDE service is added to the device inventory as an unmanaged device. Basic mode never initiates active ICMP ping sweeps or TCP port scans. Those active probes are performed only when an administrator explicitly switches discovery to Standard mode. No additional agents such as Azure Arc are required for either mode because the existing Defender for Endpoint sensor performs the discovery work.

When you want a query in an Azure Monitor or Microsoft Sentinel workbook to run against the workspace the workbook is opened from, you do not hard-code the workspace name. Instead, you use the workspace() function without arguments. At run time the workbook engine replaces the empty workspace() call with the ID of the currently selected Log Analytics workspace, so the query always scopes itself correctly after the workbook is copied to or opened from another workspace.

Hard-coding a workspace name inside workspace('Contoso-Sentinel') would force the query to run against that specific workspace only. The workspaceGuid() and workspaces() functions require you to supply one or more explicit workspace identifiers, so they cannot adjust automatically.

Microsoft Sentinel detects entities in query results when the column name matches the pattern CustomEntity. By adding an extend statement that creates a new column named AccountCustomEntity and sets it equal to the existing UserPrincipalName field, Sentinel will classify every value in that column as a user account entity. Renaming the original column or projecting it under another name will not trigger automatic entity recognition unless the CustomEntity suffix is used, and there is no KQL function that converts a field into an entity implicitly.

Microsoft Defender for Endpoint does not provide a per-timeline time-zone toggle. To change how times are shown, you must adjust the time-zone preference for your session in the Microsoft Defender portal. Go to Settings, open Preferences, set the time-zone setting to Coordinated Universal Time, and then reload the timeline. Exporting the timeline, merely refreshing the view, or changing the locale (which affects only language and number formats) will not switch the displayed timestamps to UTC.

Microsoft Sentinel does not calculate or display UEBA insights until the User and entity behavior analytics (UEBA) feature is explicitly turned on for the workspace. Enabling UEBA in the Settings page activates the profiling pipeline that builds user and host profiles from ingested identity, authentication, and activity data. Without this setting, connecting Azure AD logs alone will not populate the Entity behavior blade, and creating additional workbooks, watchlists, or analytic rules will not start the underlying analytics. Once UEBA is enabled, Sentinel begins processing the Azure AD sign-in data to surface anomalous behaviors.

When a device matches more than one Microsoft Defender for Endpoint (MDE) device group, the group with the highest priority (that is, the lowest numeric rank value) takes precedence. Because SensitiveGroup has a rank of 10, it outranks FinanceGroup, which has a rank of 100. Therefore, MDE will apply the automation level configured for SensitiveGroup (Semi-automated) to the device. The platform does not choose the most or least restrictive setting, nor does creation time affect precedence-only the rank value determines which group wins.

The MailItemsAccessed activity is logged whenever any user or process opens or previews a message in an Exchange Online mailbox. Each MailItemsAccessed record contains a ClientIP property that stores the IP address from which the access occurred, allowing you to tie the item access to a specific network location. MailboxLogin events record only the act of signing in, not item access, and ExchangeAdmin or Azure AD sign-in events do not show when individual mailbox items were opened.

The in operator compares the value of a column to a comma-separated list (or to the contents of a scalar dynamic array) using case-sensitive, whole-string equality. This satisfies the need to match the complete SHA256 value exactly as it appears in targetHashes.

• in is case-sensitive by default and does not perform substring matching.
• contains and contains_cs perform substring searches, so they would return false positives for hashes that only partially match.
• has_any is designed to look for any element of an array inside a dynamic array column, not to compare a scalar column against an external list.

Security Copilot provides four built-in application roles that can be assigned in Microsoft Entra ID:

• Security Copilot Administrator - full control, including managing settings, plugins, and access assignments.
• Security Copilot Contributor - can interact with Copilot, upload data, and create or run promptbooks, but cannot manage plugins, workspace settings, or role assignments.
• Security Copilot Responder - can run prompts and view responses but cannot create promptbooks.
• Security Copilot Reader - can only view existing content.

Because the SOC analysts need to create and run promptbooks and upload investigation data, they require more than Reader or Responder rights. However, they must be prevented from tenant-level administration, so the Administrator role is too permissive. The Contributor role meets all requirements without granting unnecessary administrative privileges, making it the correct choice.

Automation levels are configured per device group in Microsoft Defender XDR.

• Full - remediate automatically: every remediation action is applied without analyst input.
• Semi - require approval for any remediation: investigations run automatically but no remediation action is implemented until an analyst approves it.
• Semi - require approval for non-severe remediation: only actions with low or medium impact require approval; high-impact actions are applied automatically.
• No automatic remediation: automated investigations are not run at all.

Because Finance must still benefit from automated investigations but must always wait for analyst confirmation before any remediation occurs, you must select Semi - require approval for any remediation. This satisfies the requirement while leaving other groups at the Full level.

In Microsoft Defender for Office 365, Threat Explorer (or Real-time detections) lets you locate a specific message and take remediation actions across all mailboxes. Choosing the Soft delete action removes the mail item from users' visible folders and places it in the Recoverable Items folder, so end users can no longer access it while investigators can still retrieve the message through eDiscovery. An Automated Investigation or Safe Links policy does not retroactively delete already-delivered mail, and blocking the sender prevents future messages but leaves the existing message in place.

Only a file policy can inspect files at rest across connected cloud storage services and take governance actions on the affected files. By selecting the built-in U.S. Social Security Number data classification as the content inspection criterion and choosing the Apply sensitivity label governance action, Defender for Cloud Apps will automatically apply the Confidential label to matching files in SharePoint Online or OneDrive for Business. Activity policies and session policies work in near real time but cannot assign Microsoft Purview Information Protection labels, and anomaly detection policies are limited to behavioral anomalies rather than deterministic DLP actions.

Microsoft Defender for Identity surfaces the Suspend user in Active Directory response action. Suspending the svc-sql01 account immediately blocks new Kerberos authentications but leaves the account intact, preserving forensic evidence. Although the Isolate device action is also available, it targets the host and could disrupt evidence collection on SRV-APP01. Resetting the computer account password affects only the machine account, and purging the Kerberos ticket cache on a domain controller cannot be triggered from the portal.

When multiple Intune policies configure the same ASR rule, Windows applies the most restrictive action. The order of restrictiveness is Block (enabled), then Warn, Audit, and finally Disabled. Because one profile sets the rule to Block and another to Audit, Block is considered more restrictive and therefore wins. The rule will run in Block mode, preventing Office applications from starting child processes. The Audit setting is ignored.

Real-time inspection of traffic to and from a cloud app is achieved in MDCA through session policies, which rely on Conditional Access App Control. A session policy can examine each download request as it happens and, based on file attributes such as Microsoft Purview sensitivity labels, enforce controls like Block download (with custom message). File or activity policies act after the operation is complete, and anomaly detection policies are intended for behavioral analytics, so none of them can stop the download in real time or present an immediate block message.

The DeviceProcessEvents table records every process creation on protected endpoints and stores the complete command-line string in its CommandLine field. By filtering this table for values such as "powershell.exe" and "-enc", you can identify instances where PowerShell was launched with Base64-encoded input. Although tables like DeviceNetworkEvents, DeviceRegistryEvents, and DeviceFileEvents include an InitiatingProcessCommandLine value for the process that triggered the respective network, registry, or file event, they are not guaranteed to capture all process launches. DeviceProcessEvents is the authoritative source for comprehensive process-creation details.

Choose Move message to quarantine. This action pulls the email from every mailbox and places a copy in quarantine, where administrators or security analysts (with the necessary roles) can later review or download it.

Soft delete only moves the message to each user's Deleted Items folder, so users could still restore it themselves. Hard delete removes the message from visible folders and moves it to the mailbox's Recoverable Items\Purges subfolder, making it unavailable to users and harder for analysts to access. Submitting a message for analysis sends a copy to Microsoft but does not remove messages already delivered to mailboxes.

Use the Alert grouping settings in the analytics rule. Alert grouping lets you specify a time window and the condition that alerts must share-such as the same Account entity-so that all qualifying alerts are merged into a single incident. Suppression would block all alerts for the period, not just duplicates for the same user. An alert-threshold controls how many results in one query run create a single alert, but does not aggregate alerts across runs. Changing the query frequency simply slows detection and still allows multiple incidents if several matching results appear in subsequent runs.