Microsoft - SC-200: Microsoft Security Operations Analyst

Sample Questions

Explanation:

Microsoft Entra multifactor authentication helps safeguard access to data and applications, providing another layer of security by using a second form of authentication. Organizations can enable multifactor authentication with Conditional Access to make the solution fit their specific needs. Because App1 uses Active Directory Domain Services (AD DS) authentication the Microsoft Entra application proxy must be configured to use Passthrough authentication in this case.

Microsoft Defender for Cloud Apps session policies provide granular visibility into cloud apps with real-time, session-level monitoring. Use session policies to take various actions, depending on the policy you set for a user session.

For example, you may want to allow users to access an app from unmanaged devices, or from specific locations. However, you may want to limit the download of sensitive files during those sessions or require that specific documents are protected from downloading, uploading, or copying when exiting the app.

References:

Create Microsoft Defender for Cloud Apps session policies

Plan a Microsoft Entra multifactor authentication deployment

Add an on-premises application for remote access through application proxy in Microsoft Entra ID

Explanation:

Custom detection rules are rules you can design and tweak using advanced hunting queries. These rules let you proactively monitor various events and system states, including suspected breach activity and misconfigured endpoints. You can set them to run at regular intervals, generating alerts and taking response actions whenever there are matches.

When you save a new rule, it runs and checks for matches from the past 30 days of data. The rule then runs again at fixed intervals, applying a lookback duration based on the frequency you choose:

• Every 24 hours - Runs every 24 hours, checking data from the past 30 days.
• Every 12 hours - Runs every 12 hours, checking data from the past 48 hours.
• Every 3 hours - Runs every 3 hours, checking data from the past 12 hours.
• Every hour - Runs hourly, checking data from the past 4 hours.
• Continuous (NRT) - Runs continuously, checking data from events as they're collected and processed in near real-time (NRT).

Setting a custom detection to run in Continuous (NRT) frequency allows you to increase your organization's ability to identify threats faster. Using the Continuous (NRT) frequency has minimal to no impact to your resource usage and should thus be considered for any qualified custom detection rule in your organization.

Reference: Create and manage custom detections rules

Explanation:

File indicators prevent further propagation of an attack in your organization by banning potentially malicious files or suspected malware. If you know a potentially malicious portable executable (PE) file, you can block it. This operation will prevent it from being read, written, or executed on devices in your organization.

When your security team creates a new indicator (IoC), the following actions are available:

• Allow: the IoC is allowed to run on your devices.
• Audit: an alert is triggered when the IoC runs.
• Warn: the IoC prompts a warning that the user can bypass
• Block execution: the IoC won't be allowed to run.
• Block and remediate: the IoC won't be allowed to run and a remediation action will be applied to the IoC.

If multiple indicator rules apply to a single file, a block action always takes precedence over an allow action.

References:

Overview of indicators in Microsoft Defender for Endpoint

Create indicators for files

Explanation:

Live response gives security operations teams instantaneous access to a device (also referred to as a machine) using a remote shell connection. Live response gives you the power to do in-depth investigative work and take immediate response actions to promptly contain identified threats in real time.

The following commands are available for user roles that are granted the ability to run advanced live response commands.

With live response, analysts can do all of the following tasks:

• Run basic and advanced commands to do investigative work on a device.
• Download files such as malware samples and outcomes of PowerShell scripts.
• Download files in the background (new!).
• Upload a PowerShell script or executable to the library and run it on a device from a tenant level.
• Take or undo remediation actions.

Note: For Windows devices you can collect a Defender for Endpoint investigation package directly from the Microsoft Defender portal.

Reference: Investigate entities on devices using live response

Explanation:

Kusto Query Language is the language you use to work with and manipulate data in Microsoft Sentinel.

The 4624 event generates when a logon session is created (on destination machine). It generates on the computer that was accessed, where the session was created.

The arg_max() aggregation function finds a row in the table that maximizes the specified expression (TimeGenerated). It returns all columns of the input table or specified columns.

For performance reasons we should first filter the rowset and then aggregate the resultset to find the last record for each account.

References:

Kusto Query Language in Microsoft Sentinel

arg_max() (aggregation function)

Queries for the SecurityEvent table