SC-100 Security Operations 2 — Questions and Answers
Question 1: A security architect needs to reduce mean time to detect (MTTD) for identity-based attacks across a hybrid environment. Which Microsoft Sentinel feature should be prioritized?
- Enable User and Entity Behavior Analytics (UEBA) to baseline and detect anomalous identity activity (Correct answer)
- Configure scheduled analytics rules with KQL queries running every 5 minutes
- Deploy Azure Monitor Alerts for all Azure AD sign-in failures
- Use Microsoft Defender for Cloud Apps shadow IT discovery reports
Correct answer: Enable User and Entity Behavior Analytics (UEBA) to baseline and detect anomalous identity activity
UEBA in Microsoft Sentinel uses machine learning to baseline normal behavior and detect anomalous identity activity, directly reducing MTTD for identity-based attacks.
Question 2: During an incident investigation, a SOC analyst discovers that an attacker used a Pass-the-Hash technique to move laterally. Which Microsoft Defender for Identity alert would have flagged this activity?
- Suspected identity theft using Pass-the-Hash attack (Correct answer)
- Suspected Kerberos SPN exposure
- Remote code execution attempt
- Suspected DCSync attack
Correct answer: Suspected identity theft using Pass-the-Hash attack
Microsoft Defender for Identity includes a specific detection for Pass-the-Hash attacks, which alerts when NTLM authentication is used with a stolen hash.
Question 3: An organization wants to automate response to phishing emails detected by Microsoft Defender for Office 365. What is the recommended approach in Microsoft Sentinel?
- Create a Playbook using Azure Logic Apps triggered by a Sentinel incident with PhishingEmail entity (Correct answer)
- Write a custom KQL detection rule that calls a webhook on match
- Configure Defender for Office 365 safe links to auto-delete phishing messages
- Set up a Microsoft Flow to monitor the shared mailbox for flagged emails
Correct answer: Create a Playbook using Azure Logic Apps triggered by a Sentinel incident with PhishingEmail entity
Sentinel Playbooks are Azure Logic Apps that can be triggered by incidents and automate responses such as blocking senders or deleting phishing emails.
Question 4: A cybersecurity architect must design a solution to ingest security logs from a third-party firewall into Microsoft Sentinel. Which connector type is most appropriate when no native connector exists?
- Common Event Format (CEF) connector via a Linux log forwarder (Correct answer)
- Custom REST API polling connector
- Azure Event Hub with direct agent installation
- Syslog connector using the Windows Security Event agent
Correct answer: Common Event Format (CEF) connector via a Linux log forwarder
CEF over Syslog via a Linux forwarder is the standard approach for ingesting logs from third-party network appliances that support CEF output.
Question 5: Which Microsoft Sentinel feature allows a security team to proactively search for threats that have not triggered any alerts?
- Hunting queries using KQL across historical log data (Correct answer)
- Watchlists configured with known malicious IP ranges
- Analytics rules with real-time correlation
- Workbooks with custom visualization dashboards
Correct answer: Hunting queries using KQL across historical log data
Hunting queries in Sentinel allow analysts to proactively search historical data using KQL for indicators of compromise that may not have triggered automated alerts.
Question 6: An organization's security operations team is overwhelmed by alert fatigue from Microsoft Sentinel. Which configuration change would most effectively reduce false positives while maintaining detection coverage?
- Tune analytics rules by adding exclusion conditions based on known safe entities from watchlists (Correct answer)
- Increase the alert threshold for all rules to suppress low-severity findings
- Disable analytics rules that generate more than 100 alerts per day
- Switch from scheduled rules to near-real-time (NRT) rules to reduce duplicate alerts
Correct answer: Tune analytics rules by adding exclusion conditions based on known safe entities from watchlists
Adding exclusion conditions using watchlists of known safe entities allows fine-tuning of analytics rules to reduce false positives without removing detection coverage.
Question 7: A security architect is designing the data retention strategy for Microsoft Sentinel. Which storage tier should be used for logs that must be retained for compliance but are rarely queried?
- Auxiliary logs or archive tier in the Log Analytics workspace (Correct answer)
- Azure Blob Storage with lifecycle management policies
- A secondary Log Analytics workspace with lower pricing tier
- Microsoft Defender for Cloud continuous export to Azure Storage
Correct answer: Auxiliary logs or archive tier in the Log Analytics workspace
Sentinel's archive tier (auxiliary logs) allows long-term retention of data at lower cost, suitable for compliance requirements where frequent querying is not needed.
SC-100 Security Operations 2
A security architect needs to reduce mean time to detect (MTTD) for identity-based attacks across a hybrid environment.
Which Microsoft Sentinel feature should be prioritized?