Microsoft - SC-200: Microsoft Security Operations Analyst

Sample Questions

• Scope: DevGroup1
• File hash: File1.exe
• Actions
• Devices: Collect investigation package
• User: Mark as compromised
• Files: Block

Explanation:

Custom detection rules are rules you can design and tweak using advanced hunting queries. These rules let you proactively monitor various events and system states, including suspected breach activity and misconfigured endpoints. You can set them to run at regular intervals, generating alerts and taking response actions whenever there are matches.

You can set the scope of a detection rule to specify which devices are covered by the rule. Only data from devices in the scope will be queried. Also, actions are taken only on those devices. Rule1 is scoped to DevGroup1 which contains Device1 only.

References:

Custom detections overview

Create and manage custom detections rules

Explanation:

Deception technology is a security measure that provides immediate alerts of a potential attack to security teams, allowing them to respond in real-time. Deception technology creates fake assets like devices, users, and hosts that appear to belong to your network.

The built-in deception capability in the Microsoft Defender portal uses rules to make decoys and lures that match your environment. The feature applies machine learning to suggest decoys and lures that are tailored to your network. You can also use the deception feature to manually create the decoys and lures. These decoys and lures are then automatically deployed to your network and planted to devices you specify using PowerShell.

Decoys are fake devices and accounts that appear to belong to your network. Lures are fake content planted on specific devices or accounts and are used to attract an attacker. The content can be a document, a configuration file, cached credentials, or any content that an attacker can likely read, steal, or interact with. Lures imitate important company information, settings, or credentials.

Custom lures can be any file type (except .DLL and .EXE files) and are limited to 10 MB each. The deception capability mimics the User Principal Name (UPN) in Active Directory.

References:

Manage the deception capability in Microsoft Defender XDR

Configure the deception capability in Microsoft Defender XDR

Explanation:

Only User1 and User3 have permissions to read the values of secrets. User1 has permissions for both, KV1 and KV2. User3 has permissions for KV2 only.

Azure built-in roles for Key Vault data plane operations

Reference: Provide access to Key Vault keys, certificates, and secrets with Azure role-based access control

• Update the data sharing and feedback options.
• Investigate Microsoft Sentinel incidents.

Explanation:

Data sharing is turned on by default. Global Administrators and Security Administrators with the Capacity Contributor role (for example, capacity write access) for the capacity linked to a workspace, can configure Customer Data sharing settings. Administrators can do this during the first run experience and at any time afterward. 

Microsoft Sentinel uses Azure role-based access control (Azure RBAC) to provide built-in roles that can be assigned to users, groups, and services in Azure.  A Microsoft Sentinel Reader can view data, incidents, workbooks, and other Microsoft Sentinel resources. A Microsoft Sentinel Responder can, in addition to the permissions for Microsoft Sentinel Reader, manage incidents like assign, dismiss, and change incidents.

References:

Privacy and data security in Microsoft Security Copilot

Roles and permissions in Microsoft Sentinel

Explanation:

Lures are fake content planted on specific devices or accounts and are used to attract an attacker. The content can be a document, a configuration file, cached credentials, or any content that an attacker can likely read, steal, or interact with. Lures imitate important company information, settings, or credentials.

There are two types of lures available in the deception feature:

• Basic lures – planted documents, link files, and the like that have no or minimal interaction with the customer environment.
• Advanced lures – planted content like cached credentials and interceptions that respond or interact with the customer environment. For example, attackers might interact with decoy credentials that were injected responses to Active Directory queries, which can be used to sign in.

Custom lures can be any file type (except .DLL and .EXE files) and are limited to 10 MB each. You can add custom lures such as documents, config files and link files. These lures will automatically be planted on devices in your organization.

For the planting path, you can use {HOME} as the active user's home folder or a regular Windows path. Network paths are not supported.

References:

Manage the deception capability in Microsoft Defender XDR

Configure the deception capability in Microsoft Defender XDR