A security analyst at Contoso wants to detect unusual behavior in their Azure AD sign-in logs, such as sign-ins from unusual locations or at unusual times. The analyst wants to use a Microsoft Sentinel rule that can automatically learn the baseline of normal behavior and alert on deviations. Which rule type should they configure?

A scheduled analytics rule with a KQL query that looks for sign-ins from a list of known malicious IP addresses.

A custom detection rule in Microsoft Defender XDR that uses an Advanced Hunting query to detect sign-ins from unusual locations.

An anomaly detection analytics rule that uses a built-in machine learning model for sign-in logs.

A near-real-time analytics rule that triggers on every sign-in event and alerts if the location is not in a predefined list.

In Microsoft Sentinel, which rule type is best suited for detecting a security event that requires immediate attention, such as a single failed login from a critical account?

Scheduled analytics rule with a 24-hour frequency

Near-real-time (NRT) analytics rule

Machine learning analytics rule

Threat intelligence analytics rule

When configuring an anomaly detection rule in Microsoft Sentinel, what is typically required?

Writing a custom KQL query from scratch

Creating a playbook to respond to the anomaly

Selecting an anomaly model and setting a frequency for the rule to run

Providing a list of known malicious IP addresses

A security team at Fabrikam wants to assess their current detection coverage against the MITRE ATT&CK framework. They have several analytics rules in Microsoft Sentinel and want to identify which attack techniques are not covered by any rule. What should they do?

Create a new analytics rule that maps to all MITRE ATT&CK techniques to ensure full coverage.

Review each analytics rule's configuration to see if it includes a MITRE ATT&CK technique mapping, and manually compare against the full ATT&CK matrix.

Use the MITRE ATT&CK coverage dashboard in Microsoft Sentinel to view the techniques mapped to each analytics rule and identify gaps.

Use the Advanced Hunting query in Microsoft Defender XDR to list all techniques covered by custom detection rules.

When analyzing attack vector coverage using the MITRE ATT&CK matrix in Microsoft Sentinel, what does an uncovered technique indicate?

A technique that is only applicable to on-premises systems

A technique that is not relevant to your environment

A potential security gap where no analytics rule currently detects that technique

A technique that has been automatically mitigated

Microsoft Certified:Security Operations Analyst Associate

Domain 1Objective 4

Configure Detections SC-200 Practice Questions (Page 4)

Part of the Manage a security operations environment domain, which accounts for 40–45% of the SC-200 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~16–29 in this domain), expect 4–7 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

8concepts

40–45%of the exam

Questions 16–20

16application · medium
A security analyst at Contoso wants to detect unusual behavior in their Azure AD sign-in logs, such as sign-ins from unusual locations or at unusual times. The analyst wants to use a Microsoft Sentinel rule that can automatically learn the baseline of normal behavior and alert on deviations. Which rule type should they configure?
Select an answer first
17foundation · easy
In Microsoft Sentinel, which rule type is best suited for detecting a security event that requires immediate attention, such as a single failed login from a critical account?
Select an answer first
18foundation · easy
When configuring an anomaly detection rule in Microsoft Sentinel, what is typically required?
Select an answer first
19application · medium
A security team at Fabrikam wants to assess their current detection coverage against the MITRE ATT&CK framework. They have several analytics rules in Microsoft Sentinel and want to identify which attack techniques are not covered by any rule. What should they do?
Select an answer first
20foundation · easy
When analyzing attack vector coverage using the MITRE ATT&CK matrix in Microsoft Sentinel, what does an uncovered technique indicate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-200

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-200” is a trademark of its owner, used for identification only.