Configure Detections SC-200 Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security analyst has an existing custom detection rule in Microsoft Defender XDR that was created from an Advanced Hunting query. The rule currently alerts on a specific process name, but the analyst wants to expand it to also alert on a related process and update the MITRE technique mapping. What is the most efficient way to make these changes?

   • AEdit the existing custom detection rule's query and MITRE technique settings directly.
   • BModify the query in Advanced Hunting and save it as a new bookmark.
   • CExport the rule to Microsoft Sentinel and edit it there.
   • DCreate a new custom detection rule from scratch and disable the old one.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A SOC team in Microsoft Sentinel wants to detect unusual sign-in behavior, such as a user signing in from a new country or at an unusual time, without creating a custom KQL query. They want the detection to adapt over time to the user's normal behavior. What should they configure?

   • AA scheduled analytics rule with a query for new countries
   • BAn anomaly detection rule using the built-in 'Unusual sign-in' ML model
   • CA Microsoft security rule for Azure AD Identity Protection
   • DA near-real-time rule with a threshold on sign-in frequency
   Reveal Solution Discussion Select an answer first
4. 23expert · medium

   A SOC team in Microsoft Sentinel wants to detect anomalous behavior in Azure AD sign-ins. They have configured an anomaly rule, but it is generating too many false positives. They want to reduce false positives without losing detection of true anomalies. What should they do?

   • AIncrease the run frequency of the anomaly rule to every 5 minutes.
   • BDisable the anomaly rule and create a scheduled rule with a static threshold.
   • CAdjust the anomaly rule's sensitivity settings to a higher threshold.
   • DChange the anomaly rule to an NRT rule.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security team at Fabrikam wants to enhance their Microsoft Sentinel detections by incorporating threat intelligence feeds. They have a custom threat intelligence solution that publishes indicators to a TAXII server. The team wants to use these indicators in analytics rules to detect network connections to known malicious IP addresses. What should they configure?

   • ACreate a custom detection rule in Microsoft Defender XDR using the ThreatIntelligenceIndicator table.
   • BUse a near-real-time analytics rule to query the ThreatIntelligenceIndicator table for each network connection event.
   • CConnect the TAXII server as a threat intelligence data connector in Microsoft Sentinel, and then create a scheduled analytics rule that references the ThreatIntelligenceIndicator table.
   • DCreate a scheduled analytics rule that directly queries the TAXII server using a KQL query.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is the key characteristic of a near-real-time (NRT) analytics rule in Microsoft Sentinel?

   • AIt uses machine learning models to detect anomalies
   • BIt runs only once per day
   • CIt requires a playbook to be attached
   • DIt runs continuously and alerts within a short time window, typically within a minute
   Reveal Solution Discussion Select an answer first