Configure Detections SC-200 Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A SOC analyst in Microsoft Sentinel needs to create a detection that alerts when a user account is created and then used within 10 minutes, which is a sign of a potential backdoor. The analyst wants to map this to the MITRE ATT&CK technique T1136 (Create Account) and use threat intelligence to prioritize alerts. What should they do?

   • ACreate a scheduled analytics rule with a KQL query that joins account creation events with logon events, set the run frequency to 5 minutes, and map to T1136.
   • BCreate an anomaly rule for account creation.
   • CUse a built-in Microsoft security rule for account creation.
   • DCreate an NRT rule with a query for account creation events only.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   In Microsoft Defender XDR, what is the primary purpose of an Advanced Hunting query when used to create a custom detection rule?

   • ATo define the detection logic by specifying the events and conditions that indicate a threat
   • BTo manage the permissions of users who can access the detection rule
   • CTo schedule the frequency at which the detection rule runs
   • DTo automate the response actions that are taken when a threat is detected
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   In Microsoft Sentinel, what is the primary purpose of the MITRE ATT&CK matrix view in the analytics rules blade?

   • ATo provide a list of all known malware families
   • BTo visualize which attack techniques are covered by existing analytics rules
   • CTo automatically remediate attacks based on the matrix
   • DTo store threat intelligence indicators
   Reveal Solution Discussion Select an answer first
5. 29expert · medium

   A security team at Contoso has a scheduled analytics rule in Microsoft Sentinel that detects a specific attack technique. The rule is generating a high number of false positives because it is using a broad query. The team wants to reduce false positives without losing detection of true positives. They also want to ensure that the rule continues to run without interruption. What should they do?

   • AEdit the scheduled analytics rule to add more specific filters to the query, and then test the rule in the Sentinel portal before enabling it.
   • BIncrease the frequency of the rule to run more often, so that alerts are generated more quickly and can be triaged sooner.
   • CDisable the scheduled analytics rule and create a new one from scratch with a completely different query.
   • DChange the rule's severity to Informational so that false positives are less visible in the queue.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   In Microsoft Sentinel, what is the purpose of the Anomalies feature?

   • ATo use machine learning to detect unusual behavior that may indicate a threat
   • BTo automate incident response actions
   • CTo store threat intelligence indicators
   • DTo manually create custom detection rules
   Reveal Solution Discussion Select an answer first