SC-200 Practice Questions

The Security Administrator role is the appropriate choice as it grants the necessary permissions to manage security configurations across Microsoft 365 services. This role allows a user to manage security policies and settings in both Microsoft Defender XDR and Microsoft Intune. Specifically, it provides the required access to create and manage custom detection rules in advanced hunting and to configure Endpoint security policies (such as antivirus, firewall, and EDR) in the Intune admin center. Among the given options, this is the role that meets all requirements while adhering to the principle of least privilege, as the other roles are either too restrictive or irrelevant.

A. Desktop Analytics Administrator: This role is specific to managing the Desktop Analytics service for Windows client deployment insights and is unrelated to security policy management.

B. Security Operator: This role is focused on security operations, such as managing alerts and incidents. It has read-only permissions for policies and cannot create or modify them.

D. Cloud Device Administrator: This role manages the lifecycle of devices in Azure AD and Intune (e.g., enrolling, disabling, deleting) but lacks the specific permissions to manage security policies.

---

1. Microsoft Learn. (2024). Azure AD built-in roles. Microsoft Docs.

Section: Security Administrator.

Content: "Users with this role have permissions to manage security-related features in Microsoft 365 services. This includes... managing policies in Microsoft Defender XDR and Microsoft Intune." This directly confirms the role's capability to manage both required areas.

2. Microsoft Learn. (2024). Permissions in the Microsoft Defender portal. Microsoft Docs.

Section: Microsoft Defender XDR Unified role-based access control (RBAC) > Security settings (manage).

Content: The documentation specifies that permissions to manage security settings

which include custom detections

are granted to roles like Security Administrator. In contrast

the Security Operator role has "View-only" permissions for these settings.

3. Microsoft Learn. (2023). Role-based access control (RBAC) with Microsoft Intune. Microsoft Docs.

Section: Azure Active Directory roles with Intune access.

Content: This document clarifies that the Azure AD "Security Administrator" role has the same permissions as the Intune "Endpoint Security Manager" built-in role

which grants full permissions to manage all features under the Endpoint security node in the Intune admin center.

<img src="https://kxbjsyuhceggsyvxdkof.supabase.co/storage/v1/object/public/file-images/SC-200/page_32_img_2.jpg">

https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/microsoft-defender-atpremediate-apps-using-mem/ba-p/1599271

<img src="https://kxbjsyuhceggsyvxdkof.supabase.co/storage/v1/object/public/file-images/SC-200/page_185_img_2.jpg">

The most appropriate and formal method to escalate an incident in Azure Sentinel to another administrator is by assigning it. Assigning an incident officially transfers ownership and responsibility for the investigation and remediation. This action updates the incident's Owner property, which is crucial for tracking, workflow management, and ensuring clear accountability. While you can share a link, assigning is the built-in, procedural mechanism for escalation within the Sentinel platform. The new owner will then be responsible for investigating the entire incident, including the eight specific alerts you identified.

A. Create a Microsoft incident creation rule: This is an automation setting used to automatically create incidents from Microsoft security service alerts; it is not used to manage or escalate existing incidents.

B. Share the incident URL: This is an informal way to notify someone. It does not formally transfer ownership or responsibility, making it difficult to track the escalation process.

C. Create a scheduled query rule: This is a type of analytics rule used to generate new alerts and incidents based on a KQL query, not for managing or escalating existing ones.

1. Microsoft Learn. (2023). Investigate incidents with Microsoft Sentinel.

Section: "Assigning incidents and changing status and severity"

Quote/Content: "Assign an incident to an owner to take responsibility for its remediation. You can also assign incidents to a group... When you assign an incident to an owner

the owner's name appears in the incident details in the Owner field." This document explicitly describes assigning an incident as the method for transferring responsibility.

2. Microsoft Learn. (2023). Automatically create incidents from Microsoft security alerts.

Section: "Introduction"

Quote/Content: "Microsoft Sentinel allows you to automatically create incidents each time an alert is triggered in a connected Microsoft security service." This confirms that incident creation rules are for generating new incidents

not managing existing ones.

3. Microsoft Learn. (2023). Create custom analytics rules to detect threats.

Section: "Rule settings in the Analytics rule wizard - General tab"

Quote/Content: "Scheduled query rules run queries on a schedule

looking for events that might indicate a threat." This shows that scheduled query rules are for threat detection and alert creation

not incident management.

To review the tasks and actions performed during an incident investigation in Microsoft Defender XDR, an analyst can use multiple features on the Incident page. The Tasks tab allows for the creation and tracking of specific investigation or remediation steps, showing their status (e.g., completed). The Activity log provides a comprehensive, auditable record of all actions and comments made by analysts on the incident itself, such as status changes or assignments. The Alert timeline, found within the Alerts tab, presents a chronological view of the alerts that constitute the incident, providing context for the actions taken. Together, these three components offer a complete picture of the investigation's progress and history.

A. Tasks only: This is incorrect because the Activity log and Alert timeline are also essential for a complete review of all actions performed, not just the formally defined tasks.

B. Tasks and Activity log only: This is incorrect as it omits the Alert timeline, which provides the crucial chronological context of the alerts and the actions taken on them.

C. Tasks and Alert timeline only: This is incorrect because it excludes the Activity log, which is the primary audit trail for all manual actions and comments on the incident object itself.

---

1. Microsoft Learn. "Manage incidents in Microsoft Defender XDR." Microsoft Docs. This document describes the components of the incident page

explicitly mentioning the Activity log: "The Activity log displays all the actions and comments on the incident

providing a record of all changes." This confirms its use for reviewing performed actions.

2. Microsoft Learn. "Use incident tasks in Microsoft Defender XDR to coordinate incident response." Microsoft Docs. This source details the purpose of the Tasks feature: "Microsoft Defender XDR includes incident tasks to help you automate and/or manually track tasks

processes

and workflows... Tasks can be added to an incident and are used to track the progress of investigation and remediation activities."

3. Microsoft Learn. "Investigate incidents in Microsoft Defender XDR." Microsoft Docs. In the section "Triage alerts

" this document explains the function of the Alerts tab

which contains the Alert timeline. It states

"The Alerts tab lists all the alerts related to the incident... This allows you to view and manage the alerts." Reviewing this timeline is a key part of understanding the investigation's flow.