Sample Questions from Azure Security Operations Analyst (SC-200)

Preview a few questions below — answers are revealed when you take the exam.

1. A security team is investigating a potential breach in their Azure environment. They suspect that an attacker has used a compromised identity to access sensitive data. What approach should they take to identify the compromised identity and mitigate the breach?

   • Utilize Azure Security Center to perform a comprehensive security assessment, identify the compromised identity, and implement multi-factor authentication (MFA) for all users.
   • Deploy Azure Sentinel to collect and analyze security logs, use the Entity Behavior analytics to identify the compromised identity, and isolate the affected accounts immediately.
   • Implement Azure Active Directory (Azure AD) Identity Protection to detect risky sign-ins, investigate the suspicious activities, and enforce conditional access policies to block the compromised identity.
   • Use Azure Monitor to track resource performance, identify unusual activity patterns, and apply network security groups (NSGs) to restrict access to sensitive resources.

2. Identify the Azure service that provides a unified security management and advanced threat protection across hybrid cloud workloads.

   • Azure Security Center
   • Azure Sentinel
   • Azure Active Directory
   • Azure Monitor

3. Consider the situation where an organization needs to ensure that all Azure resources comply with their security policies. Which method solves it best?

   • Utilize Azure Policy to define, assign, and manage policies that enforce compliance across all Azure resources.
   • Deploy Azure Security Center to continuously assess the security state of Azure resources and provide recommendations for improvement.
   • Implement Azure Sentinel to collect and analyze security data, detect threats, and respond to security incidents.
   • Use Azure Monitor to track the performance and availability of Azure resources, and set up alerts for any deviations from expected behavior.

4. What command should be used to enable Azure Security Center on a subscription?

   • az security center enable --subscription <subscription_id>
   • az security enable --subscription <subscription_id>
   • az securitycenter enable --subscription <subscription_id>
   • az security-center enable --subscription <subscription_id>

5. Which architecture supports the requirements of integrating Azure Sentinel with Azure Active Directory for enhanced security monitoring and threat detection?

   • Deploy Azure Sentinel and connect it to Azure AD using the built-in connector to stream sign-in logs and audit logs for analysis.
   • Implement Azure Security Center to monitor Azure AD activities and use Azure Monitor to collect and analyze security data.
   • Use Azure Active Directory Identity Protection to detect risky sign-ins and Azure Sentinel for advanced threat hunting.
   • Configure Azure AD to send security logs to Azure Event Hubs and use Azure Stream Analytics to process and analyze the data.