Pass the Microsoft Certified: Security Operations Analyst Associate SC-200 Questions and answers with ValidTests

Enabling User and Entity Behavior Analytics (UEBA) in Microsoft Sentinel requires specific permissions in both Microsoft Entra ID (Azure AD) and the Azure Sentinel workspace. The goal is to grant the least privilege necessary for the user (User1) to enable UEBA and manage entity behavior analytics.

Microsoft’s documentation for UEBA setup specifies that to enable UEBA for an Entra tenant, the user must have access to identity-related signals and security settings within the Microsoft Entra environment. Specifically:

“To enable UEBA and connect Microsoft Entra ID data, the user must be assigned the Security Administrator role in Microsoft Entra ID. This role allows management of security-related features without granting full directory or global admin privileges.”

The Security Administrator role provides just enough access to security configurations, alerts, and risk data, aligning with the principle of least privilege.

Other roles:

Global Administrator is overly privileged.

Security Operator can only view alerts, not configure settings.

Identity Governance Administrator focuses on access reviews and entitlement management, not UEBA setup.

Hence, the correct Entra role is Security Administrator.

For the Azure side, Microsoft’s official Sentinel RBAC guidance states:

“To enable or configure UEBA in a Sentinel workspace, the user must have the Microsoft Sentinel Contributor role. This role allows enabling and configuring UEBA, managing analytics, and viewing data within Sentinel.”

The Sentinel Contributor role grants permissions to configure data connectors, UEBA settings, and entity analytics features but not workspace-wide administrative rights.

Other options:

Microsoft Sentinel Automation Contributor is limited to playbook and automation configurations.

Security Admin and Security Assessment Contributor roles apply to Microsoft Defender for Cloud and general Azure security posture, not UEBA configuration.

✅ Final Correct Roles:

Microsoft Entra role: Security Administrator

Azure role: Microsoft Sentinel Contributor

In Microsoft Sentinel, playbooks are Azure Logic Apps that automate responses to alerts or incidents. To use an existing Logic App as a playbook in Sentinel, it must start with the “Microsoft Sentinel alert” trigger. This trigger allows Sentinel to call and pass alert details to the Logic App automatically.

When an existing Logic App has a manual trigger, it cannot be invoked directly by Sentinel. Therefore, the first step is to modify the trigger to replace the manual trigger with the “When a response to an Azure Sentinel alert is triggered” trigger. After that, you can link it within Sentinel incidents or automation rules.

This process is detailed in Microsoft Defender XDR and Sentinel documentation under “Connect a Logic App to Sentinel as a playbook.”

Hence, the correct answer is D. Modify the trigger in the logic app.

Step 1: From Logic App Designer, create a logic app.

Create a logic app and define when it should automatically run

1. From Defender for Cloud's sidebar, select Workflow automation.

2. To define a new workflow, click Add workflow automation. The options pane for your new automation opens.

Here you can enter:

A name and description for the automation.

The triggers that will initiate this automatic workflow. For example, you might want your Logic App to run when a security alert that contains "SQL" is generated.

The Logic App that will run when your trigger conditions are met.

3. From the Actions section, select visit the Logic Apps page to begin the Logic App creation process.

4. Etc.

Step 2: From Logic App Designer, run a trigger.

Manually trigger a Logic App

You can also run Logic Apps manually when viewing any security alert or recommendation.

Step 3: From Workflow automation in Defender for cloud, add a workflow automation.

Configure workflow automation at scale using the supplied policies

Automating your organization's monitoring and incident response processes can greatly improve the time it takes to investigate and mitigate security incidents.

In Microsoft Sentinel workbooks, a query visualization is used to retrieve and display data from tables (like SecurityEvent) using Kusto Query Language (KQL).

To meet the requirements:

Identify the number of security events ingested in the past week.

Display the count of events by day in a timechart.

You would add a KQL query control to the workbook, for example:

SecurityEvent

| where TimeGenerated > ago(7d)

| summarize Count = count() by bin(TimeGenerated, 1d)

| render timechart

Metric is used for a single numeric value, not a chart.

Group and Links or tabs are for workbook organization, not visualization.

✅ Correct answer: A. a query

In Microsoft Defender for Cloud, exporting alert data (for example, to Event Hubs, Log Analytics, or external SIEM tools like Microsoft Sentinel) does not require modification of resources or configurations—only read access to security data.

According to Microsoft’s official documentation, the “Reader” role provides view-only access to all Defender for Cloud data, including security alerts, recommendations, regulatory compliance, and inventory.

This role allows users to export alert data, use APIs, and view findings, without granting permissions to make changes in the Defender for Cloud configuration.

Other roles explained:

Owner – Full access to all resources, including assigning roles (too high privilege).

Contributor – Can make configuration changes, such as enabling plans or modifying policies (unnecessary for exporting).

User Access Administrator – Manages role assignments only, not security data.

✅ Therefore, the Reader role follows the principle of least privilege and allows exporting Defender for Cloud alert data.

Table: MicrosoftGraphActivityLogs

ResponseStatusCode: 401

In Microsoft Sentinel or Log Analytics workspaces, when analyzing logs for Microsoft Entra ID (formerly Azure AD) or Microsoft Graph API requests, authorization failures (requests denied due to invalid credentials or insufficient permissions) are typically represented by HTTP status code 401 (Unauthorized).

According to Microsoft documentation for Microsoft Graph Activity Logs (part of Microsoft Entra ID logs integration with Azure Monitor and Sentinel), the ResponseStatusCode field contains the HTTP response code for API requests made to Microsoft Graph. The most relevant codes are:

401 – Unauthorized: The request could not be completed due to invalid or missing authentication credentials.

403 – Forbidden: The request was authenticated but does not have permission for the requested resource.

Since the question specifies identifying “requests that failed due to insufficient authorization,” this refers specifically to authorization failures—situations where the system could not authenticate or authorize the request at all. In Microsoft’s terminology, this most directly maps to HTTP 401 Unauthorized responses.

The MicrosoftGraphActivityLogs table stores these entries, as it captures API requests from Entra-integrated applications to Microsoft Graph endpoints, including the fields ResponseStatusCode, AppId, UserId, ServicePrincipalId, RequestUri, and RequestMethod.

The appropriate KQL query completion would therefore be:

MicrosoftGraphActivityLogs

| where ResponseStatusCode == 403 or ResponseStatusCode == 401

| project AppId, UserId, ServicePrincipalId, ResponseStatusCode, RequestUri, RequestMethod

To summarize security events over the last week and chart them by day, use KQL time binning on the event timestamp. In Sentinel/Log Analytics, bin() groups records into fixed time buckets on a datetime column—here, TimeGenerated. Pair that with a time filter for the past 7 days and render as a timechart. The key pattern is:

SecurityEvent

| where TimeGenerated >= ago(7d)

| summarize Count = count() by bin(TimeGenerated, 1d)

| render timechart

bin is the correct aggregator for time-based bucketing.

TimeGenerated is the standard timestamp column used across Sentinel tables for ingestion time.

Using a 1-day bin shows the daily counts; the where TimeGenerated >= ago(7d) limits results to the past week.

render timechart visualizes the grouped counts over time.

In the answer area shown, you select bin and TimeGenerated; (the full query would also include the where line and a 1d bin size to meet the “by day” requirement).

According to Microsoft Defender for Cloud automation documentation, Logic Apps can be integrated to automatically respond to recommendations or alerts. To test or automate remediation from Defender for Cloud, you must configure an automation workflow (Logic App) that triggers when a recommendation is created or updated.

Microsoft defines the available triggers for Defender for Cloud automation as follows:

When a Defender for Cloud Recommendation is created or triggered – This event type initiates the Logic App whenever a new security recommendation appears or an existing one changes state. It’s the proper trigger for remediation scenarios because recommendations typically indicate a detected security misconfiguration or risk requiring action.

When a Defender for Cloud Alert is created or triggered – This applies to security alerts, not recommendations.

When a response to a Defender for Cloud alert is triggered – Used for incident-response workflows, not for testing remediation logic.

In the context of the question, the goal is to test automatic remediation for detected configuration issues (security risks). Those are surfaced as recommendations within Defender for Cloud, not as alerts.

Next, the execution source should be configured under:

Trigger the execution of LA1 from: Recommendations

This ensures that Defender for Cloud will execute the Logic App (LA1) automatically when relevant recommendations are triggered, allowing immediate testing and validation of the remediation logic.

In summary:

To test the Logic App remediation workflow in Defender for Cloud, you must:

Set the trigger type to “When a Defender for Cloud Recommendation is created or triggered”.

Configure it to execute from “Recommendations”.

Thus, the verified correct answers are:

✅ Set the LA1 trigger to: When a Defender for Cloud Recommendation is created or triggered

✅ Trigger the execution of LA1 from: Recommendations

 Internal threat: Modify the access policy settings for the key vault.

 External threat: Modify the Key Vault firewall settings.

For internal threats involving a potential compromise of Fabrikam’s own Azure AD applications, the most direct and least disruptive remediation is to modify the Key Vault access policies (or RBAC assignments, if RBAC for Key Vault data-plane is in use) to immediately remove or reduce the compromised service principal’s permissions (Get/List/Decrypt/Sign/Wrap). Microsoft guidance for Key Vault access emphasizes least privilege and promptly revoking credentials or app permissions when compromise is suspected. Access policies (or data-plane RBAC) govern which identities can access secrets, keys, and certificates; adjusting these stops further data-plane actions by the compromised app. “Resource locks” protect against deletion or configuration changes at the management plane, but they do not remove a compromised identity’s ability to read or use vault objects, so they are not an appropriate first response for this scenario.

For external threats, Microsoft recommends hardening Key Vault firewall and networking: restrict public network access, allow only required IPs, use virtual network rules, and prefer private endpoints. Key Vault includes a built-in firewall for IP and VNet ACLs; tuning these controls reduces exposure to the public internet and blocks unauthorized traffic. NSGs apply to IaaS subnets/nics and don’t directly secure the public Key Vault endpoint. Azure Firewall can add perimeter control, but it is not necessary for remediating a specific Key Vault Defender alert; the most effective and immediate remediation is tightening the Key Vault firewall settings to limit external access pathways.