Microsoft Certified: Security Operations Analyst Associate — Practice Set 1

Question 1

Your organization has deployed Microsoft Sentinel. The SOC team wants to visualize the number of security incidents by severity over the past 30 days in a dashboard that can be shared with management. Which Microsoft Sentinel feature should you use?

Accepted Answer

Microsoft Sentinel workbooks provide interactive dashboards and visualizations built on Azure Monitor workbooks. You can create charts, tables, and graphs showing incident counts by severity, trends over time, and other operational metrics, and share them with stakeholders. Analytics rules create incidents from alerts. Hunting queries are used for proactive threat detection. Automation rules respond to incidents automatically.

Question 2

Your organization is onboarding data sources to Microsoft Sentinel. You need to ingest Windows Security events from Azure virtual machines using the currently recommended agent. Which connector should you use?

Accepted Answer

The Windows Security Events via AMA connector uses the Azure Monitor Agent (AMA), which is Microsoft's current recommended agent. It uses Data Collection Rules (DCRs) to specify exactly which events to collect, reducing ingestion costs. The legacy Log Analytics (MMA) agent is deprecated. Azure Diagnostics captures Azure platform logs, not VM guest OS events. Syslog is for Linux systems; Windows Event Forwarding to a Linux collector is an unnecessary workaround when AMA is available.

Question 3

Your SOC team uses Microsoft Defender XDR and Microsoft Sentinel. A security analyst needs to create a custom detection rule that runs every hour and generates an alert when more than 10 failed sign-in attempts occur from the same IP address within a 5-minute window. The rule should correlate data from multiple Defender products. Where should you create this rule?

Accepted Answer

Custom detection rules in Microsoft Defender XDR Advanced Hunting are designed for creating detections that run on a scheduled basis against the unified schema that spans data from Defender for Endpoint, Defender for Identity, Defender for Office 365, and Microsoft Entra ID. Running hourly and correlating across Defender products is precisely the use case for Defender XDR custom detections. Sentinel analytics rules are the right tool for Sentinel-ingested data. Azure Monitor alert rules are for infrastructure metrics. Anomaly detection rules use ML-based detection, not custom threshold logic.

Question 4

Your organization's Microsoft Sentinel workspace is generating significant costs due to high data ingestion volumes. The SOC manager asks you to review which data sources are contributing most to cost and to optimize data retention tiers. Which Microsoft Sentinel feature should you use to get ingestion cost insights and configure retention tiers?

Accepted Answer

SOC optimization in Microsoft Sentinel provides data-driven recommendations to improve the value-to-cost ratio of the workspace. It identifies data tables with high ingestion that contribute little detection value, recommends adjusting retention tiers (Analytics, Data lake/Basic), and helps optimize the deployment. The workspace usage workbook shows ingestion trends but does not provide actionable optimization recommendations with retention tier guidance. Azure Cost Management shows billing data but not Sentinel-specific optimization guidance. Defender for Cloud is a separate service focused on security posture.

Question 5

Your organization uses Microsoft Defender for Endpoint. The security team wants to automatically isolate a device from the network when an active ransomware alert is triggered on that device, without requiring manual analyst intervention. Which Microsoft Defender XDR feature should you configure?

Accepted Answer

Automatic attack disruption in Microsoft Defender XDR uses high-confidence signals to automatically take containment actions (such as isolating devices or disabling user accounts) when an active attack like ransomware is detected, without waiting for analyst approval. This provides near-real-time response to active threats. While automated investigation and response (AIR) can also take remediation actions, automatic attack disruption is specifically designed for high-confidence, high-impact active attack scenarios like ransomware and human-operated attacks. Sentinel playbooks introduce latency. Custom detection rules generate alerts but do not natively execute remediation actions.

Question 6

Your organization is configuring Microsoft Sentinel for data ingestion from various sources. You need to ingest threat intelligence indicators (such as malicious IP addresses and domains) to enrich alerts and enable threat intelligence-based detection. Which two methods can you use to ingest threat indicators into Microsoft Sentinel? Choose 2.

Accepted Answer

Microsoft Sentinel supports multiple methods for ingesting threat intelligence indicators. The Microsoft Defender Threat Intelligence connector imports curated Microsoft threat intelligence directly into Sentinel's ThreatIntelligenceIndicator table. The Threat Intelligence TAXII connector allows you to connect to any TAXII 2.x server that exposes STIX-formatted threat intelligence, enabling integration with commercial and open-source feeds. Azure Monitor DCRs are for log data collection, not threat intelligence indicators. The Windows Security Events connector ingests Windows logs, not threat indicators. Defender for Cloud is a security posture and workload protection service.

Question 7

Your organization uses Microsoft Sentinel and needs to ensure that security alerts generated by a Scheduled analytics rule create incidents only when the same alert fires multiple times within a 24-hour period, grouping them into a single incident. Which setting in the analytics rule should you configure?

Accepted Answer

Microsoft Sentinel analytics rules have two distinct grouping settings: Event grouping (which controls how query result rows are grouped into individual alerts) and Alert grouping (which controls how multiple alerts from the same rule are grouped into a single incident within a time window). Configuring alert grouping with a 24-hour time window will group repeated alerts from the same rule into a single incident. Modifying the query adds complexity. Automation rules for merging incidents is a post-creation workaround. Fusion rules correlate alerts across different data sources for multi-stage attacks — they cannot be applied to a specific analytics rule.

Question 8

Your organization uses Microsoft Sentinel and ingests data from multiple sources. The SOC team wants to analyze which MITRE ATT&CK techniques are covered by the current active analytics rules and identify gaps in detection coverage. Which Microsoft Sentinel feature provides this visualization?

Accepted Answer

Microsoft Sentinel includes a MITRE ATT&CK matrix view that visually maps active analytics rules and hunting queries to MITRE ATT&CK tactics and techniques, allowing the SOC team to see which techniques are covered by current detections and identify gaps. The Threat Intelligence workbook shows indicator data, not detection coverage. Hunting queries with MITRE tags provide a list view but not the matrix visualization. Defender XDR threat analytics shows information about specific threats, not a coverage map of analytics rules.

Question 9

Your organization's Microsoft Sentinel workspace has grown significantly. The security operations team needs to ingest large volumes of verbose network flow logs for threat hunting purposes, but these logs are not needed for real-time analytics rules. You want to minimize cost while retaining these logs for 90 days. Which Sentinel data tier should you use for these logs?

Accepted Answer

The Data lake tier (also known as Auxiliary Logs or Basic Logs in Log Analytics) is designed for verbose, high-volume logs that are used infrequently for hunting or investigation rather than real-time analytics. It offers significantly lower ingestion costs than the Analytics tier but with limited query capabilities. For 90-day retention of non-analytics data, this tier provides the right cost-performance balance. The Analytics tier is priced for full query support and real-time detection, which is unnecessary for verbose network logs. Archive tier is for long-term cold storage beyond the retention period of other tiers. Separate workspaces add management complexity.

Question 10

Your organization has a Microsoft Sentinel workspace that ingests logs from multiple Azure subscriptions. You need to restrict access so that analysts from Team A can only query and view incidents from Subscription A's logs, while analysts from Team B can only access Subscription B's logs. Both teams share the same Sentinel workspace. Which Sentinel feature enables this resource-based access control?

Accepted Answer

Microsoft Sentinel resource-context RBAC allows users to access only the data in the Sentinel workspace that is associated with Azure resources they have access to. By granting Team A Reader access on Subscription A's resources, they can only see and query data from those resources in Sentinel, even though all data resides in a single workspace. Separate workspaces per subscription would work but defeats the purpose of a centralized SIEM and increases management overhead. Analytics rule permissions are not a data access control mechanism. Table-level RBAC in Log Analytics restricts access to entire tables, not to specific subscription data within a table.

Question 11

Your organization uses Microsoft Defender for Endpoint and needs to create a custom data collection configuration that gathers additional process creation events with full command-line arguments from Windows endpoints that are not captured by the default sensor configuration. Which Defender for Endpoint feature allows you to define this custom event collection?

Accepted Answer

Microsoft Defender for Endpoint supports custom data collection configuration that allows security teams to define additional event types and data to be collected by the MDE sensor beyond the default telemetry, including process creation events with full command-line arguments. This is configured within the Defender for Endpoint settings. Sentinel analytics rules process already-ingested data and cannot define what the endpoint sensor collects. Azure Monitor Agent is a separate agent for log forwarding; it does not configure MDE sensor behavior. Defender Antivirus scanning options relate to malware detection, not event telemetry collection.

Question 12

Your organization uses Microsoft Defender XDR. A security analyst receives an alert about a phishing email that was delivered to multiple users. The analyst needs to quickly remove the malicious email from all affected users' mailboxes. Which action in Microsoft Defender for Office 365 should the analyst take?

Accepted Answer

Microsoft Defender for Office 365 Threat Explorer allows security analysts to search for and analyze email messages based on various criteria (subject, sender, recipient, URL, file hash). From Threat Explorer, analysts can select the affected emails and perform a soft delete (moves to Deleted Items) or hard delete (permanently removes) action directly on the messages across all affected mailboxes. A mail flow rule blocks future messages but does not remove already-delivered emails. Content Search in Purview can also locate and delete messages but requires additional steps and eDiscovery permissions. The Tenant Allow/Block List prevents future delivery but does not remediate delivered messages.

Question 13

Your organization uses Microsoft Defender for Identity. An alert indicates that a domain user account has been identified as performing suspicious LDAP reconnaissance activities. A security analyst needs to investigate the account's recent activity and understand which systems it has authenticated to in the past 48 hours. Which Microsoft Defender XDR capability should the analyst use?

Accepted Answer

Microsoft Defender XDR entity pages provide a comprehensive view of a user's activity across all Defender products, including sign-ins, devices accessed, alerts associated with the account, and lateral movement paths detected by Defender for Identity. This gives analysts a unified view of the account's activity in the past 48 hours without having to pivot across multiple tools. Sentinel hunting queries require the data to already be ingested. Sensor logs on the domain controller require direct server access. Azure AD sign-in logs show cloud authentication but not on-premises Kerberos/NTLM authentication activity captured by Defender for Identity.

Question 14

Your organization uses Microsoft Sentinel. A security analyst is investigating a high-severity incident involving suspicious PowerShell execution on multiple endpoints. The incident contains alerts from Microsoft Defender for Endpoint and Microsoft Entra ID. The analyst needs to understand the full attack chain across these signals in a single view. Which Microsoft Sentinel capability should the analyst use?

Accepted Answer

The Microsoft Sentinel investigation graph provides an interactive, visual representation of the entities (users, devices, IPs, files) involved in an incident and the relationships and alerts connected to them. This allows analysts to follow the attack chain across multiple data sources (MDE, Entra ID) and understand the full scope of the incident. While Defender XDR's unified incident timeline is also valuable for Defender-specific signals, the Sentinel investigation graph encompasses all ingested data sources. Manual query correlation and Excel export are inefficient and error-prone for complex multi-source investigations.

Question 15

Your organization uses Microsoft Defender for Endpoint. During an incident investigation, a security analyst suspects that a device has been compromised and needs to collect forensic evidence including running processes, network connections, and scheduled tasks without disrupting the user's work. Which Defender for Endpoint capability should the analyst use?

Accepted Answer

Live Response in Microsoft Defender for Endpoint provides a remote shell connection to a device, allowing analysts to run commands, upload and download files, and collect an investigation package (which includes running processes, network connections, scheduled tasks, prefetch files, and more) without interrupting the user's work. Device isolation is disruptive and prevents user access to network resources. Offboarding destroys the agent connection and is irreversible for forensic purposes. An antivirus scan detects malware but does not collect the broad forensic artifacts needed for investigation.

Question 16

Your organization uses Microsoft Sentinel and needs to automate incident response. When a new high-severity incident is created, the team wants to automatically assign the incident to an analyst and post a notification in a Microsoft Teams channel. Which two Microsoft Sentinel components are required to implement this automation? Choose 2.

Accepted Answer

Automation in Microsoft Sentinel requires two components working together: an automation rule that defines the trigger (e.g., when a new incident is created with high severity) and the action to take (e.g., run a playbook), and a playbook (Azure Logic App) that contains the actual response steps (assign the incident and post a Teams notification using the Teams connector). Analytics rules with alert grouping control incident creation, not automation responses. Workbooks are for visualization. Defender XDR custom detection rules generate alerts in the Defender portal, not Sentinel automation.

Question 17

Your organization uses Microsoft Defender XDR. A security analyst is investigating a complex, multi-stage attack involving initial access via phishing, credential theft from memory, lateral movement using pass-the-hash, and data exfiltration. The analyst needs to understand the complete attack sequence and identify all affected assets quickly. Which Microsoft Defender XDR capability provides the most comprehensive view of this type of attack?

Accepted Answer

The Microsoft Defender XDR incident page with the attack story view and entity graph provides an automatically correlated, visual representation of the complete attack chain across all Defender products. It shows the sequence of events from initial access through lateral movement to exfiltration, links all affected entities (users, devices, mailboxes), and maps the tactics and techniques to MITRE ATT&CK. Reviewing individual product alerts requires manual correlation. Advanced Hunting KQL queries provide deep investigation capability but require the analyst to manually construct the correlation logic. Sentinel Fusion rules detect multi-stage attacks in Sentinel but provide less interactive drill-down than the Defender XDR incident story.

Question 18

Your organization uses Microsoft Sentinel with embedded Copilot for Security. During an active incident investigation, a security analyst needs to quickly summarize all the evidence associated with a suspicious IP address that appears in multiple alerts, understand what the IP address is known for based on threat intelligence, and get suggested investigation steps — all without leaving the Sentinel incident page. Which feature should the analyst use?

Accepted Answer

Copilot for Security embedded in the Microsoft Sentinel incident page provides an AI-assisted investigation experience that can summarize incident evidence, explain entity context (including threat intelligence about an IP address), and suggest next investigation steps in natural language — all within the context of the open incident without requiring the analyst to leave the page or write queries. The Defender XDR entity page provides threat intelligence but requires navigating away. A KQL query requires technical expertise and manual correlation. The MDTI standalone portal provides deep intelligence but is separate from the active incident context.

Question 19

Your organization's security team is responding to a suspected insider threat incident. An analyst needs to determine if a specific user exfiltrated files via email over the past 60 days. The analyst needs to search email messages and attachment content across the entire organization. Which Microsoft service should the analyst use?

Accepted Answer

Content Search in Microsoft Purview is the purpose-built tool for searching across Exchange Online mailboxes, SharePoint sites, and OneDrive accounts for specific content including message bodies and attachment content. It supports complex search queries and can return results going back to the beginning of the mailbox, well beyond 60 days. Threat Explorer is designed for analyzing malware and phishing threats, not for broad insider threat investigations of email content. Sentinel hunting queries require the email data to be ingested into the workspace. Advanced Hunting in Defender XDR covers email metadata (header information, sender, recipient, attachment names) but not full content search of email bodies and attachments.

Question 20

Your organization uses Microsoft Sentinel for threat hunting. A threat analyst wants to search for evidence of the Mimikatz credential dumping tool being executed on endpoints based on process creation events. The analyst needs to write a query against the data ingested from Windows Security Events. Which table in Microsoft Sentinel contains Windows process creation events (Event ID 4688)?

Accepted Answer

The SecurityEvent table in Microsoft Sentinel (populated by the Windows Security Events via AMA or legacy MMA connector) contains Windows Security event log data including Event ID 4688 (process creation). Threat analysts can query this table to search for specific process names, command-line arguments, or parent-child process relationships. SecurityAlert contains alerts generated by Defender products and analytics rules. AuditLogs contains Microsoft Entra ID directory audit events. DeviceProcessEvents is the Microsoft Defender XDR Advanced Hunting table for process creation events from MDE-onboarded devices.

Question 21

You are a security analyst using Microsoft Sentinel for threat hunting. You want to find all DNS queries to domain names that match a known domain generation algorithm (DGA) pattern — specifically, domains longer than 20 characters with high entropy that were queried in the past 7 days. Which KQL function helps you identify high-entropy domain names?

Accepted Answer

Entropy calculation for domain names in KQL requires computing the Shannon entropy of the string, which involves calculating character frequency distribution using string manipulation functions and the log() mathematical function. There is no built-in entropy function in KQL, so analysts implement it using countof(), strlen(), and log() to compute the -sum(p * log(p)) formula. parse_url() parses URL components but does not compute entropy. bag_keys() returns keys from a dynamic object. array_length() returns the length of an array, not string entropy.

Question 22

Your organization uses Microsoft Defender XDR for threat hunting. A threat analyst is investigating a suspected supply chain compromise and needs to identify all processes that were spawned by a specific suspicious binary across all endpoints in the organization. Which two Microsoft Defender XDR Advanced Hunting tables should the analyst query? Choose 2.

Accepted Answer

To investigate processes spawned by a suspicious binary, DeviceProcessEvents is the primary table — it records process creation events including the parent process filename and SHA256, allowing you to identify all child processes. DeviceImageLoadEvents records DLL/module loads by processes, which is critical for supply chain compromise investigation where the suspicious binary may inject DLLs or load malicious modules. DeviceFileEvents tracks file creation and modification, useful but not primary for process spawning. DeviceNetworkEvents tracks network connections. AlertEvidence links evidence to existing alerts but does not contain raw process telemetry for hunting.

Question 23

Your organization uses Microsoft Sentinel. A threat analyst is hunting for evidence of credential access techniques. The analyst writes a KQL hunting query that returns results showing suspicious LSASS memory access patterns on 15 different endpoints. The analyst wants to save this finding so that it can automatically create incidents for future occurrences and be tracked over time as part of the detection library. What should the analyst do?

Accepted Answer

Once a hunting query has proven its value in detecting malicious activity, the standard practice is to promote it to a Microsoft Sentinel analytics rule. Analytics rules run on a schedule, automatically query the data, and generate alerts and incidents when conditions are met — converting the one-time hunt into an ongoing detection. Bookmarks are for capturing specific result rows of interest during an active investigation session. Manual incident creation from a bookmark is for immediate triage, not automated ongoing detection. Exporting to CSV and creating manual incidents is not scalable. Workbooks are for visualization, not detection.

Question 24

Your organization uses Microsoft Defender XDR. You are hunting for lateral movement involving pass-the-ticket attacks in your environment. You want to identify Kerberos ticket requests where the logon was performed using an existing Kerberos ticket (TGT) from a different device than where it was originally issued. Which Advanced Hunting table and approach would best identify this activity?

Accepted Answer

Pass-the-ticket attacks involve using a stolen Kerberos ticket on a different device from where it was originally issued. The IdentityLogonEvents table (populated by Microsoft Defender for Identity) captures Kerberos authentication events at the domain controller level including source device, destination device, and authentication details. Correlating these events to find cases where a ticket is used from an unexpected source device compared to where it was issued — especially in conjunction with Defender for Identity signals — provides the highest fidelity detection. DeviceLogonEvents captures endpoint-level logons but not the full Kerberos ticket issuance context. NetworkEvents on port 445 detects SMB traffic but not Kerberos ticket misuse specifically. Querying only existing alerts limits the hunt to already-detected cases.

Question 25

Your organization uses Microsoft Sentinel for long-term threat hunting. The data lake contains two years of historical network flow logs. A threat analyst needs to run a one-time, complex analytical query across the full two-year dataset to identify beaconing behavior by correlating time intervals between outbound connections. The query may take several minutes to complete. Which Microsoft Sentinel feature should the analyst use to run this resource-intensive query efficiently?

Accepted Answer

KQL jobs in Microsoft Sentinel Data lake (previously known as Search jobs) are designed for running long-running, resource-intensive queries over large historical datasets in the Data lake/Auxiliary tier that exceed the standard interactive query limits. They run asynchronously and write results to a new table in the workspace. This allows analysts to perform deep historical analysis over multi-year datasets without hitting interactive query timeouts. The Log Analytics query editor has a 10-minute timeout for interactive queries. Sentinel workbooks are for visualization dashboards. The hunting query blade is for defining and running standard hunting queries that return results within interactive query limits.

SC-200 — Security Operations Analyst Associate