SC-200 Sentinel Incident Investigation

1. In Sentinel, what is the primary role of the 'Investigation' feature?

To explore relationships between entities and understand incident scope

To delete suspicious log entries

To prevent data ingestion from sources

To limit analyst access to sensitive data

2. When documenting a Sentinel investigation, what critical information should always be recorded?

Evidence timeline, root cause analysis, and remediation steps taken

Only the analyst's personal observations

Nothing, as all actions are automatically logged

Only the final severity rating

3. What is the primary purpose of 'Incident Correlation' in Sentinel?

Grouping related alerts into single incidents to reduce analyst workload

Deleting duplicate alerts automatically

Preventing all false positives

Archiving historical incident data

4. Which Sentinel feature enables analysts to automate responses to specific alert conditions?

Workbooks

Playbooks and automation rules

Data connectors

Analytics rules only

5. In a Sentinel incident, what does the 'Kill Chain' concept help analysts understand?

The sequence of attacker actions from initial access to objective

The cost of resolving a security incident

The number of affected users

The network bandwidth consumed

6. What is the primary function of Sentinel's 'Hunting' feature?

Proactively searching for undetected threats using custom queries

Automatically deleting malicious files

Preventing all network traffic

Backing up log data to external storage

7. During incident response, what action should be taken after identifying a compromised asset?

Immediately disconnect it from the network and begin forensic analysis

Allow the attack to continue to gather more intelligence

Notify the attacker of the detection

Archive all related logs without review

8. What is the primary benefit of integrating threat intelligence feeds into Sentinel?

Automatically identifying known malicious indicators in your environment

Reducing the need for security analysts

Eliminating all false positive alerts

Slowing down incident response processes

9. When investigating a compromised user account, which data source is most critical to review?

Network firewall logs

Sign-in logs and access events

Hardware inventory data

Email marketing campaigns

10. What is the purpose of creating custom detection rules in Sentinel?

To identify organization-specific threats tailored to your environment

To increase storage capacity for logs

To automatically shut down compromised systems

To replace all built-in detection rules

11. What is the primary function of Microsoft Sentinel in a security operations center?

Centralized threat detection and incident response across cloud and on-premises environments

Managing user access and identity verification only

Storing and archiving historical log data

Automating network firewall rule updates

12. What does the MITRE ATT&CK framework help analysts accomplish in Sentinel investigations?

Map observed attacker tactics and techniques to known threat behaviors

Automatically patch vulnerable systems

Encrypt all log data in transit

Remove malware from infected devices

13. Which Sentinel component allows analysts to visualize and investigate data through interactive dashboards?

Playbooks

Workbooks

Analytics rules

Data connectors

14. During incident triage, what is the primary purpose of assigning a severity level?

To prioritize investigation efforts based on potential impact

To determine the cost of the incident

To automatically block all related network traffic

To notify external vendors about the incident

15. What is UEBA (User and Entity Behavior Analytics) primarily used for in Sentinel?

Detecting anomalous behavior that deviates from normal user and entity patterns

Managing database backups

Storing historical audit logs

Configuring network firewall rules

16. In incident investigation, what does 'threat intelligence' provide to Sentinel analysts?

Real-time context about known malicious IPs, domains, and file hashes

Detailed logs of all user activities

Automated incident closure procedures

Network bandwidth usage metrics

17. Which Sentinel feature helps correlate events across multiple data sources to identify complex attack patterns?

Workbooks

Fusion correlation engine

User and entity behavior analytics (UEBA)

Data connectors

18. What is a key advantage of using playbooks in Sentinel incident response?

They automatically respond to incidents without analyst review

They automate repetitive tasks and accelerate incident response workflows

They eliminate the need for SIEM solutions

They prevent all security threats from occurring

19. In Sentinel, what is the purpose of creating analytics rules?

To generate alerts based on detected suspicious patterns and behaviors

To back up all ingested log data

To encrypt sensitive information in workbooks

To restrict user access to specific data sources

20. Which data connector type allows Sentinel to ingest logs from non-Microsoft sources?

Native connectors

CEF and Syslog connectors

Azure service connectors

Windows Event Log connectors

SC-200 Microsoft Sentinel Incident Investigation Quiz

1. In Sentinel, what is the primary role of the 'Investigation' feature?

2.

What first name or nickname would you like us to use?

2. When documenting a Sentinel investigation, what critical information should always be recorded?

3. What is the primary purpose of 'Incident Correlation' in Sentinel?

4. Which Sentinel feature enables analysts to automate responses to specific alert conditions?

5. In a Sentinel incident, what does the 'Kill Chain' concept help analysts understand?

6. What is the primary function of Sentinel's 'Hunting' feature?

7. During incident response, what action should be taken after identifying a compromised asset?

8. What is the primary benefit of integrating threat intelligence feeds into Sentinel?

9. When investigating a compromised user account, which data source is most critical to review?

10. What is the purpose of creating custom detection rules in Sentinel?

11. What is the primary function of Microsoft Sentinel in a security operations center?

12. What does the MITRE ATT&CK framework help analysts accomplish in Sentinel investigations?

13. Which Sentinel component allows analysts to visualize and investigate data through interactive dashboards?

14. During incident triage, what is the primary purpose of assigning a severity level?

15. What is UEBA (User and Entity Behavior Analytics) primarily used for in Sentinel?

16. In incident investigation, what does 'threat intelligence' provide to Sentinel analysts?

17. Which Sentinel feature helps correlate events across multiple data sources to identify complex attack patterns?

18. What is a key advantage of using playbooks in Sentinel incident response?

19. In Sentinel, what is the purpose of creating analytics rules?

20. Which data connector type allows Sentinel to ingest logs from non-Microsoft sources?