Which Microsoft Sentinel built-in role provides full access to all Sentinel resources, including the ability to manage incidents, create workbooks, and configure analytics rules, but does NOT grant access to other Azure resources outside of Sentinel?

Microsoft Sentinel Automation Contributor

You have a Microsoft Sentinel workbook that uses a parameter to select a subscription. You need to add a second parameter that filters by resource group, and the resource group list should depend on the selected subscription. What should you do?

Create a separate workbook for each subscription

Add a static parameter with a list of all resource groups

Use a text parameter and instruct users to type the resource group

Add a KQL query parameter that uses the subscription parameter as a filter

A Microsoft Sentinel workbook template shows sign-in data for the last 24 hours. Your security team needs to see the same data for the last 7 days. What should you do?

Modify the data retention policy of the workspace to 7 days.

Re-run the workbook after 7 days to accumulate more data.

Create a new analytics rule with a 7-day lookback period.

Edit the workbook and change the time range parameter from 24 hours to 7 days.

Your Microsoft Sentinel workspace is experiencing slow query performance on large tables. You need to improve query performance without changing the data collection process. Which action should you take?

Reduce the number of tables in the workspace

Increase the workspace's SKU to a higher tier

Add more analytics rules to filter data

Use materialized views to pre-aggregate data

Your SOC manager needs to assign a role to a team that will manage Microsoft Sentinel workbooks, analytics rules, and data connectors, but they should NOT be able to manage Sentinel automation rules or playbooks. Which built-in role should you assign?

Custom role with Microsoft Sentinel Contributor minus automation permissions

Microsoft Certified:Security Operations Analyst Associate

Domain 1Objective 2

Configure the Microsoft Sentinel SIEM and Platform SC-200 Practice Questions (Page 1)

Part of the Manage a security operations environment domain, which accounts for 40–45% of the SC-200 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~16–29 in this domain), expect 4–7 from this objective — we provide 17 practice questions to prepare you well beyond it. (estimate)

17questions here

4free pages

5concepts

40–45%of the exam

Questions 1–5

1foundation · easy
Which Microsoft Sentinel built-in role provides full access to all Sentinel resources, including the ability to manage incidents, create workbooks, and configure analytics rules, but does NOT grant access to other Azure resources outside of Sentinel?
Select an answer first
2application · medium
You have a Microsoft Sentinel workbook that uses a parameter to select a subscription. You need to add a second parameter that filters by resource group, and the resource group list should depend on the selected subscription. What should you do?
Select an answer first
3application · medium
A Microsoft Sentinel workbook template shows sign-in data for the last 24 hours. Your security team needs to see the same data for the last 7 days. What should you do?
Select an answer first
4application · medium
Your Microsoft Sentinel workspace is experiencing slow query performance on large tables. You need to improve query performance without changing the data collection process. Which action should you take?
Select an answer first
5application · medium
Your SOC manager needs to assign a role to a team that will manage Microsoft Sentinel workbooks, analytics rules, and data connectors, but they should NOT be able to manage Sentinel automation rules or playbooks. Which built-in role should you assign?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-200

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-200” is a trademark of its owner, used for identification only.