Microsoft Security Operations Analyst Associate (SC-200)

B is correct.

Explanation: When creating a Data Collection Rule in the Azure portal, the Basics tab requires specifying a name, subscription, resource group, platform type, and region. The rule's region must be the exact same region as your destination Log Analytics workspace. Because the workspace resides in East US, the DCR must also be configured for East US.

A is incorrect: Target virtual machines can be located in various regions, but the DCR region itself must match the destination workspace.

C is incorrect: The resource group holding the target virtual machines does not determine the required region for the Data Collection Rule.

D is incorrect: Region selection is strictly constrained, as Azure Monitor requires the DCR to share the same region as the workspace.

C is correct.

Explanation: Scheduled alerts rules provide the highest level of customization in Microsoft Sentinel Analytics. You can define your own query expression using Kusto Query Language to filter security events, configure an execution schedule for the rule to run, and subsequently modify the detection logic to tune threat detection results.

A is incorrect: Fusion detection logic is hidden and non-customizable, which prevents editing the query and restricts you to only one active rule template.

B is incorrect: Built-in machine learning behavior analytics rules cannot be edited, and your SOC analysts are unable to view or customize their configuration settings.

D is incorrect: Microsoft security rules generate incidents directly from connected security services rather than allowing analysts to execute custom scheduled Kusto queries against events.

A is correct.

Explanation: In the New Parameter configuration pane for a Drop down parameter, setting Get data from to Query allows the administrator to execute a Log Analytics query, such as AzureActivity | summarize by Level. This retrieves the distinct event levels directly from ingested log telemetry to populate the dropdown choices.

B is incorrect: The Set a parameter value action belongs to links steps rather than supplying dynamic dropdown parameter values from log query results.

C is incorrect: Enabling Limit multiple selections restricts choices rather than retrieving and populating event level data dynamically from workspace activity logs.

D is incorrect: Hiding the parameter in reading mode conceals the control from viewers rather than connecting it to log data to populate values.

D is correct.

Explanation: The Getting Started notebook documentation states that the initialization code ran successfully when msticpyconfig.yaml is created in the utils folder in the left file explorer pane. Analysts should explicitly disregard warnings about the Python kernel version or other error messages. The configuration file can take another thirty seconds to appear after execution finishes.

A is incorrect: The documentation explicitly notes that the Multiple Microsoft Sentinel workspaces cell fails and should not be executed for validation.

B is incorrect: The compute instance name simply identifies the compute resource and does not indicate whether MSTICPy initialization executed successfully.

C is incorrect: The tutorial instructs users to disregard kernel version warnings, meaning warnings do not represent a failed initialization status.

B is correct.

Explanation: Microsoft Defender Vulnerability Management discovers endpoint vulnerabilities and misconfigurations in real time using the built-in agentless Defender for Endpoint sensors. Devices onboarded to Defender for Endpoint automatically report and push software inventory, patch status, and configuration posture telemetry to the dashboard. This cloud-powered architecture satisfies operational requirements by eliminating the need for auxiliary monitoring agents or cumbersome periodic network scans.

A is incorrect: Periodic network scans introduce unwanted IT overhead, which the agentless built-in sensors specifically eliminate during continuous discovery operations.

C is incorrect: Installing auxiliary endpoint agents violates organizational policy and is unnecessary because vulnerability management uses native sensors already embedded in Defender.

D is incorrect: Scheduled PowerShell scripts are not used because onboarded endpoints autonomously transmit real-time inventory and configuration data directly to the dashboard.

D is correct.

Explanation: In Microsoft Sentinel, the SecurityAlert table specifically contains alerts generated from Sentinel analytical rules. Furthermore, this table can also include security alerts that are ingested directly from a Sentinel data connector. Querying the SecurityAlert table therefore allows the analyst to view all rule-generated and connector-ingested alerts in one centralized schema.

A is incorrect: The SecurityIncident table stores incidents generated from alerts, meaning it tracks incident relations rather than containing individual raw alert records.

B is incorrect: ThreatIntelligenceIndicator holds user-created or connector-ingested indicators such as file hashes and domains, rather than security alerts generated by Sentinel rules.

C is incorrect: The Watchlist table stores imported reference data for custom collections, so it cannot provide alerts from analytical rules or connectors.

A is correct.

Explanation: Under the onboarding settings for Windows 10, Microsoft Defender for Endpoint explicitly supports a local script deployment method for up to 10 devices. Because this pilot deployment involves only seven machines and excludes centralized management infrastructure, running the local script directly on each target endpoint completely satisfies all stated project requirements.

B is incorrect: Group Policy requires Active Directory domain infrastructure, which conflicts with the requirement to deploy locally without centralized management tools.

C is incorrect: Microsoft Store package is not an available deployment option for onboarding Windows 10 devices to the Microsoft Defender for Endpoint service.

D is incorrect: Mobile Device Management relies on centralized management tools such as Microsoft Intune rather than deploying directly on standalone pilot endpoints.

C is correct.

Explanation: Selecting New Microsoft Sentinel alert on the query header toolbar directs the analyst to the next steps for creating an analytics rule. This allows the security team to translate their active investigative KQL expression directly into an automated detection without manually configuring rule logic from scratch.

A is incorrect: New Azure Monitor alert configures an alert in Azure Monitor rather than directing the analyst to create a Sentinel analytics rule.

B is incorrect: Copy link to query generates a shareable query hyperlink for collaborators but does not initiate any alert or detection rule creation.

D is incorrect: Export to Power BI generates a downloadable PowerBIQuery file rather than redirecting the analyst to create a Sentinel analytics rule.

A is correct.

Explanation: The organization requires a centralized Windows Event Collector architecture. The evidence specifies that forwarding events through a designated Windows Event Collector device requires installing the Windows Forwarded Events Content Hub solution. That dedicated collector device then streams all forwarded events directly to Microsoft Sentinel using the Windows Forwarded Events data connector.

B is incorrect: The Legacy Agent connector installs the deprecated Log Analytics agent on endpoints rather than receiving events through a collector device.

C is incorrect: The Windows Security Events via AMA connector collects logs directly from endpoints instead of ingesting forwarded events from a collector device.

D is incorrect: Azure Arc uses the Connected Machine agent to manage hybrid devices, but no dedicated Azure Connected Machine connector exists.

A is correct.

Explanation: Workspaces provide separate work environments within a single tenant, and each workspace must be powered by its own capacity. Configuring distinct workspaces enables the organization to isolate regional security operations, monitor compute costs against team budgets, and store session data locally to adhere strictly to geo-specific data protection compliance laws.

B is incorrect: Plugins supply collections of specialized capabilities for integrated data sources, but they cannot isolate departmental workspaces or track divisional compute budgets.

C is incorrect: Sessions maintain conversational context across user prompts, but they cannot enforce regional data residency boundaries or partition dedicated tenant capacities.

D is incorrect: Orchestrators compose capabilities to answer prompt requests, but they cannot partition administrative work environments or manage local data protection compliance storage.