Your Microsoft Sentinel workspace is ingesting high volumes of data, and you need to reduce costs. You have identified that a large portion of the data comes from verbose firewall logs that are rarely used for security investigations. What is the most cost-effective way to handle this data?

Disable the firewall log connector entirely.

Move the firewall logs to a separate workspace with basic logs tier.

Use the Analytics tier for the firewall logs.

Increase the retention period for the firewall logs to keep them longer.

You have an existing Microsoft Sentinel workbook that uses a KQL query to display the top 10 alert rule names. You need to modify it to display the top 10 alert rule severities instead. The workbook is shared with multiple teams, and you want to avoid affecting their current view. What should you do?

Create a new workbook from scratch

Edit the existing query in the workbook to group by Severity

Create a copy of the workbook and edit the copy

Change the workbook's parameters to filter by severity

You are creating a Microsoft Sentinel workbook to visualize sign-in failures by user and location. You have written a KQL query that returns the required data. What is the next step to add this visualization to the workbook?

Save the query as a saved search and reference it in the workbook.

Export the query to a Power BI dataset and import it into the workbook.

Create a new analytics rule that runs the query and outputs to the workbook.

Add a query step in the workbook editor and paste the KQL query.

You have an existing Microsoft Sentinel workbook that displays the top 10 alert rule names. You need to modify it to show the top 10 alert rule severities instead. What is the most efficient way to make this change?

Duplicate the workbook and then edit the copy

Create a new workbook from scratch and add a new query

Change the workbook's parameters to filter by severity

Edit the existing query in the workbook's step to group by Severity instead of AlertRuleName

Your organization is required to retain security event logs for 180 days for compliance. You have enabled Microsoft Sentinel and are ingesting Windows Security Events into the SecurityEvent table. Currently, the table's retention is set to the workspace default of 90 days. You need to ensure the SecurityEvent data is available for queries for at least 180 days while minimizing additional cost. What should you configure?

Create a data collection rule to duplicate SecurityEvent data to a storage account

Set the SecurityEvent table's retention to 180 days

Set the workspace retention to 180 days for all tables

Enable long-term retention on the SecurityEvent table

Microsoft Certified:Security Operations Analyst Associate

Domain 1Objective 2

Configure the Microsoft Sentinel SIEM and Platform SC-200 Practice Questions (Page 2)

Part of the Manage a security operations environment domain, which accounts for 40–45% of the SC-200 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~16–29 in this domain), expect 4–7 from this objective — we provide 17 practice questions to prepare you well beyond it. (estimate)

17questions here

4free pages

5concepts

40–45%of the exam

Questions 6–10

6application · medium
Your Microsoft Sentinel workspace is ingesting high volumes of data, and you need to reduce costs. You have identified that a large portion of the data comes from verbose firewall logs that are rarely used for security investigations. What is the most cost-effective way to handle this data?
Select an answer first
7expert · medium
You have an existing Microsoft Sentinel workbook that uses a KQL query to display the top 10 alert rule names. You need to modify it to display the top 10 alert rule severities instead. The workbook is shared with multiple teams, and you want to avoid affecting their current view. What should you do?
Select an answer first
8application · medium
You are creating a Microsoft Sentinel workbook to visualize sign-in failures by user and location. You have written a KQL query that returns the required data. What is the next step to add this visualization to the workbook?
Select an answer first
9application · medium
You have an existing Microsoft Sentinel workbook that displays the top 10 alert rule names. You need to modify it to show the top 10 alert rule severities instead. What is the most efficient way to make this change?
Select an answer first
10application · medium
Your organization is required to retain security event logs for 180 days for compliance. You have enabled Microsoft Sentinel and are ingesting Windows Security Events into the SecurityEvent table. Currently, the table's retention is set to the workspace default of 90 days. You need to ensure the SecurityEvent data is available for queries for at least 180 days while minimizing additional cost. What should you configure?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-200

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-200” is a trademark of its owner, used for identification only.

Configure the Microsoft Sentinel SIEM and Platform SC-200 Practice Questions (Page 2)

Questions 6–10

Your Microsoft Sentinel workspace is ingesting high volumes of data, and you need to reduce costs. You have identified that a large portion of the data comes from verbose firewall logs that are rarely used for security investigations. What is the most cost-effective way to handle this data?

You are creating a Microsoft Sentinel workbook to visualize sign-in failures by user and location. You have written a KQL query that returns the required data. What is the next step to add this visualization to the workbook?

You have an existing Microsoft Sentinel workbook that displays the top 10 alert rule names. You need to modify it to show the top 10 alert rule severities instead. What is the most efficient way to make this change?

Keep studying — Manage a security operations environment