Microsoft - SC-200: Microsoft Security Operations Analyst

Sample Questions

Explanation:

As part of the investigation or response process, you can collect an investigation package from a device. By collecting the investigation package, you can identify the current state of the device and further understand the tools and techniques used by the attacker.

For Windows devices, the package contains numerous information including a .CSV file that contains the list of installed programs.

Reference: Investigation package contents for Windows devices

• Every hour, check the Administrators group membership of each endpoint.
• When a change to the Administrators group membership is detected, create an incident in Microsoft Defender XDR.

Explanation:

To detect changes in the Administrators group membership across your endpoints, you first need a KQL-based advanced hunting query that identifies those changes. This query will serve as the foundation for your detection logic.

Once the query is validated and reliably detects the changes you're concerned about, you can then use it to create a custom detection rule that runs hourly and generates alerts or incidents in Microsoft Defender XDR.

Reference: Create custom detection rules

Explanation:

To group the failed sign-ins (ResultType != 0) into daily bins (1d) and count how many occurred each day, we need to complete the KQL query as shown below:

SigninLogs
| where TimeGenerated > ago(7d)
| where ResultType != 0
| summarize Count=count() as by bin(TimeGenerated, 1d)
| render timechart

References:

summarize operator

count() (aggregation function)

bin()

Explanation:

You can use the Content search eDiscovery tool in the Microsoft Purview portal to search for in-place content such as email, documents, and instant messaging conversations in your organization. Use this tool to search for content in these cloud-based Microsoft 365 data sources:

• Exchange Online mailboxes
• SharePoint Online sites and OneDrive for Business accounts
• Microsoft Teams
• Microsoft 365 Groups
• Viva Engage

After you run a search, the number of content locations and an estimated number of search results are displayed on the search flyout page. You can quickly view statistics, such as the content locations that have the most items that match the search query. After you run a search, you can preview the results or export them to a local computer.

Content search in Microsoft Purview is designed for targeted queries across Exchange Online mailboxes, SharePoint sites, and OneDrive accounts. It allows you to:

• Search for emails with specific attachment types (like PDFs).
• Filter by sender domain (e.g., @contoso.com).
• Specify a date range (e.g., past month).
• Export results for review or compliance purposes.

Reference: Get started with Content search

Explanation:

The Security operations efficiency template is intended for security operations center (SOC) managers to view overall efficiency metrics and measures regarding the performance of their team.

As a Security Operations Center (SOC) manager, you need to have overall efficiency metrics and measures at your fingertips to gauge the performance of your team. You'll want to see incident operations over time by many different criteria, like severity, MITRE tactics, mean time to triage, mean time to resolve, and more. Microsoft Sentinel now makes this data available to you with the new SecurityIncident table and schema in Log Analytics and the accompanying Security operations efficiency workbook. You'll be able to visualize your team's performance over time and use this insight to improve efficiency. You can also write and use your own KQL queries against the incident table to create customized workbooks that fit your specific auditing needs and KPIs.

The SecurityIncident table is built into Microsoft Sentinel. You'll find it with the other tables in the SecurityInsights collection under Logs. You can query it like any other table in Log Analytics.

References:

Commonly used Microsoft Sentinel workbooks

Manage your SOC better with incident metrics