Microsoft SC-200 · Security Operations Analyst · Updated 2026
Free SC-200 Security Operations Analyst Practice Exam (2026)
Full-length SC-200 mock exams with a realistic number of questions and the real exam time. Defender XDR, Microsoft Sentinel, incident response and KQL threat hunting scenarios, answers explained, and your score by domain.
1. Choose a set
2. Choose a mode
50 questions · 1 hour 40 min · same as the real exam
You have an unfinished attempt on this set.
Questions 1–10Page 1 of 5
🏆
Question 1Security Operations Setup
Contoso uses a third-party IT management tool that triggers a recurring low-severity Microsoft Defender XDR alert on the same set of servers. The SOC has confirmed the activity is benign. You need these alerts to stop appearing in the queue while all other alerts of the same type still raise normally. What should you configure?
Correct answer: C. An alert tuning rule
An alert tuning rule (formerly alert suppression) can hide or auto-resolve alerts that match specific conditions, such as a file, process or device, while leaving other alerts of the same type untouched. An email notification filter only changes who gets emailed and does not keep the alerts out of the queue.
An alert tuning rule (formerly alert suppression) can hide or auto-resolve alerts that match specific conditions, such as a file, process or device, while leaving other alerts of the same type untouched. An email notification filter only changes who gets emailed and does not keep the alerts out of the queue.
Question 2Incident Response
Adatum users received a phishing email that Microsoft Defender for Office 365 delivered to 300 mailboxes before the URL was weaponized. You need to remove the message from all mailboxes quickly from the Defender portal. What should you use?
Correct answer: B. Threat Explorer soft delete
Threat Explorer lets you select the delivered messages and take remediation actions, such as soft delete, on mailboxes that already received them. A Tenant Allow/Block List entry blocks future mail but does not remove messages already delivered.
Threat Explorer lets you select the delivered messages and take remediation actions, such as soft delete, on mailboxes that already received them. A Tenant Allow/Block List entry blocks future mail but does not remove messages already delivered.
Question 3Threat Hunting
An Adatum analyst wants to hunt for powershell.exe launched with an encoded command line on onboarded devices in advanced hunting. Which table should the analyst query?
Correct answer: D. DeviceProcessEvents
DeviceProcessEvents records process creation, including file name and command line. DeviceNetworkEvents records connections and does not hold process command lines as the primary event.
DeviceProcessEvents records process creation, including file name and command line. DeviceNetworkEvents records connections and does not hold process command lines as the primary event.
Question 4Security Operations Setup
Fabrikam has a small on-call team that does not watch the Microsoft Defender portal at night. The team wants an email only when a high-severity incident is created for devices in the Finance device group. Administrative effort must be minimal. What should you configure?
Correct answer: A. An incident email notification rule
Incident email notification rules in Defender XDR settings let you choose recipients and filter by severity and device group with no code. A Sentinel playbook could send mail, but it adds a Logic App to build and maintain, which fails the minimal effort requirement.
Incident email notification rules in Defender XDR settings let you choose recipients and filter by severity and device group with no code. A Sentinel playbook could send mail, but it adds a Logic App to build and maintain, which fails the minimal effort requirement.
Question 5Incident Response
Automatic attack disruption in Microsoft Defender XDR contained a Tailwind Traders laptop during a ransomware incident. After investigation, analysts confirm the laptop is clean and want normal network communication restored. What should they do?
Correct answer: B. Undo the action in the Action center
Containment applied by attack disruption is recorded in the Action center, where an analyst can undo it to release the device. Running an antivirus scan does not lift containment, so the device would stay cut off.
Containment applied by attack disruption is recorded in the Action center, where an analyst can undo it to release the device. Running an antivirus scan does not lift containment, so the device would stay cut off.
Question 6Security Operations Setup
Litware wants Microsoft Defender for Endpoint to remediate threats found by automated investigations on its kiosk devices without waiting for analyst approval. Workstations used by executives must still require approval. What should you configure for the kiosk device group?
Correct answer: A. Full - remediate threats automatically
The Full automation level lets automated investigation and response apply remediation actions on its own, and automation levels are set per device group so executives can keep a Semi level. Any of the Semi levels would leave at least some remediation actions waiting in the Action center for approval.
The Full automation level lets automated investigation and response apply remediation actions on its own, and automation levels are set per device group so executives can keep a Semi level. Any of the Semi levels would leave at least some remediation actions waiting in the Action center for approval.
Question 7Threat Hunting
Tailwind Traders uses Microsoft Defender for Identity. A hunter wants to find NTLM and Kerberos authentication attempts against on-premises domain controllers for a specific account. Which advanced hunting table should the hunter use?
Correct answer: D. IdentityLogonEvents
IdentityLogonEvents holds authentication activity captured by Defender for Identity on domain controllers, including NTLM and Kerberos. IdentityInfo holds account details, not logon events.
IdentityLogonEvents holds authentication activity captured by Defender for Identity on domain controllers, including NTLM and Kerberos. IdentityInfo holds account details, not logon events.
Question 8Incident Response
Northwind Traders receives an alert that a workstation requested directory replication from a domain controller using the replication protocol. Only domain controllers should do this. Which Microsoft security service most likely generated the alert?
Correct answer: A. Microsoft Defender for Identity
Defender for Identity sensors on domain controllers watch replication traffic and alert on suspected DCSync activity from non-domain controllers. Entra ID Protection evaluates cloud sign-in and user risk and does not see on-premises replication.
Defender for Identity sensors on domain controllers watch replication traffic and alert on suspected DCSync activity from non-domain controllers. Entra ID Protection evaluates cloud sign-in and user risk and does not see on-premises replication.
Question 9Security Operations Setup
Adatum has two Microsoft Defender for Endpoint device groups. Servers-EU is ranked 1 and matches devices whose names start with SRV. Servers-All is ranked 2 and matches all server operating systems. A new device named SRV-DB01 runs Windows Server. Which group settings apply to SRV-DB01?
Correct answer: C. Servers-EU, because it has the higher rank
A device can belong to only one device group, and it joins the highest-ranked group whose rules it matches. Settings are not merged across groups, so Servers-All does not apply even though the operating system also matches.
A device can belong to only one device group, and it joins the highest-ranked group whose rules it matches. Settings are not merged across groups, so Servers-All does not apply even though the operating system also matches.
Question 10Incident Response
An attacker at Contoso stole a user's refresh token through an adversary-in-the-middle phishing page. You have already reset the user's password. You need to make sure existing tokens can no longer be used to get new access tokens. What should you do next?
Correct answer: A. Revoke the user's sessions in Entra ID
Revoking sessions invalidates refresh tokens and session cookies, forcing the user and the attacker to sign in again. Enabling MFA registration affects future sign-ins but does not cancel tokens the attacker already holds.
Revoking sessions invalidates refresh tokens and session cookies, forcing the user and the attacker to sign in again. Enabling MFA registration affects future sign-ins but does not cancel tokens the attacker already holds.
Question 11Security Operations Setup
Tailwind Traders plans to enable the attack surface reduction rule that blocks Office applications from creating child processes. The security team is worried that some business macros will break. You need to measure the impact before any process is blocked. What should you do first?
Correct answer: D. Deploy the rule in Audit mode
Audit mode logs what the rule would have blocked, so you can review the events in reports or advanced hunting with no user impact. Warn mode still interrupts users with a block prompt, so it does not meet the requirement to measure impact first.
Audit mode logs what the rule would have blocked, so you can review the events in reports or advanced hunting with no user impact. Warn mode still interrupts users with a block prompt, so it does not meet the requirement to measure impact first.
Question 12Threat Hunting
A Northwind Traders hunter needs to find all messages sent from the domain contoso-billing.com and see whether each was delivered or blocked. Which advanced hunting table should the hunter query?
Correct answer: B. EmailEvents
EmailEvents holds one row per message with sender details and delivery action. EmailPostDeliveryEvents only covers actions taken after delivery, such as ZAP, so it would miss blocked messages.
EmailEvents holds one row per message with sender details and delivery action. EmailPostDeliveryEvents only covers actions taken after delivery, such as ZAP, so it would miss blocked messages.
Question 13Incident Response
A Fabrikam analyst opens a Microsoft Defender for Cloud alert about suspicious process execution on an Azure virtual machine. The analyst wants Microsoft's recommended steps to stop the current threat and prevent similar attacks. Where should the analyst look?
Correct answer: C. The Take action tab of the alert
The Take action tab in a Defender for Cloud alert lists steps to mitigate the threat, recommendations to prevent future attacks, and options for automated response. Secure Score shows overall posture but not alert-specific response steps.
The Take action tab in a Defender for Cloud alert lists steps to mitigate the threat, recommendations to prevent future attacks, and options for automated response. Secure Score shows overall posture but not alert-specific response steps.
Question 14Security Operations Setup
Northwind Traders wants analysts to create file hash indicators in Microsoft Defender for Endpoint that block a known malicious executable on all devices. When an analyst opens the indicator page, the option to block files is not available. What should you turn on first?
Correct answer: B. Allow or block file
File hash indicators that allow or block files require the Allow or block file advanced feature to be turned on. Custom network indicators only control IP addresses, URLs and domains, so they do not enable file blocking.
File hash indicators that allow or block files require the Allow or block file advanced feature to be turned on. Custom network indicators only control IP addresses, URLs and domains, so they do not enable file blocking.
Question 15Incident Response
Litware discovers that 50 users granted consent to a third-party OAuth app that requests full mailbox access and sends data to an unknown domain. You need to stop the app from accessing data across the tenant using Microsoft Defender for Cloud Apps. What should you do?
Correct answer: D. Ban the app on the OAuth apps page
Banning an OAuth app revokes its permissions and prevents users from granting consent again. Tagging an app as unsanctioned applies to discovered cloud apps and does not revoke an OAuth app's existing tenant permissions.
Banning an OAuth app revokes its permissions and prevents users from granting consent again. Tagging an app as unsanctioned applies to discovered cloud apps and does not revoke an OAuth app's existing tenant permissions.
Question 16Security Operations Setup
Contoso uses automatic attack disruption in Microsoft Defender XDR. Policy requires that any account disable actions in on-premises Active Directory run under a dedicated group managed service account instead of the sensor's local system identity. What should you configure?
Correct answer: B. A Defender for Identity action account
Defender for Identity performs remediation such as disabling an on-premises account, and its Manage action accounts setting lets you replace the default local system identity with a gMSA. An Entra ID Protection policy acts on cloud identities and cannot run actions in on-premises Active Directory.
Defender for Identity performs remediation such as disabling an on-premises account, and its Manage action accounts setting lets you replace the default local system identity with a gMSA. An Entra ID Protection policy acts on cloud identities and cannot run actions in on-premises Active Directory.
Question 17Threat Hunting
A Contoso analyst wants to know how many different devices ran each file name in DeviceProcessEvents. Which KQL fragment should the analyst add?
Correct answer: C. | summarize dcount(DeviceName) by FileName
The summarize operator with dcount() returns the number of distinct devices for each file name. The project operator only selects columns and does not aggregate rows.
The summarize operator with dcount() returns the number of distinct devices for each file name. The project operator only selects columns and does not aggregate rows.
Question 18Security Operations Setup
Fabrikam operates in the United States and Germany. German regulations require that security logs from German resources stay in a European region, while US logs may stay in the US. The company will deploy Microsoft Sentinel. Which workspace design should you recommend?
Correct answer: A. One workspace in each required region
Log Analytics workspaces store data in the region where they are created, so separate workspaces in the US and in Europe meet the data residency rule. A single US workspace would move German logs out of Europe.
Log Analytics workspaces store data in the region where they are created, so separate workspaces in the US and in Europe meet the data residency rule. A single US workspace would move German logs out of Europe.
Question 19Incident Response
A Microsoft Purview Insider Risk Management analyst at Adatum reviews an alert showing a departing employee copied many sensitive files to USB. The analyst decides the activity needs a full investigation with notes and content review. What should the analyst do with the alert?
Correct answer: D. Confirm the alert and create a case
Confirming an alert and creating a case opens a case where analysts can review activity, content and notes and decide on actions. Dismissing the alert would close it without the investigation the analyst needs.
Confirming an alert and creating a case opens a case where analysts can review activity, content and notes and decide on actions. Dismissing the alert would close it without the investigation the analyst needs.
Question 20Threat Hunting
A Fabrikam hunter needs a query to return only events from the last seven days in an advanced hunting table. Which KQL fragment should the hunter use?
Correct answer: A. | where Timestamp > ago(7d)
ago(7d) returns the time seven days before now, so Timestamp > ago(7d) keeps recent events. Using less than would return only events older than seven days.
ago(7d) returns the time seven days before now, so Timestamp > ago(7d) keeps recent events. Using less than would return only events older than seven days.
Question 21Security Operations Setup
Litware hires a tier 1 analyst who must assign, change the status of and close Microsoft Sentinel incidents. The analyst must not be able to create or edit analytics rules. You need to follow the principle of least privilege. Which role should you assign?
Correct answer: C. Microsoft Sentinel Responder
The Responder role adds incident management, such as assigning and closing incidents, on top of read access. Contributor would also allow creating and editing analytics rules, which is more access than required.
The Responder role adds incident management, such as assigning and closing incidents, on top of read access. Contributor would also allow creating and editing analytics rules, which is more access than required.
Question 22Incident Response
Tailwind Traders wants analysts to see Microsoft Purview data loss prevention alerts next to related endpoint and identity alerts so that one attack shows up as one incident. Where should analysts triage DLP alerts?
Correct answer: D. The Defender XDR incident queue
DLP alerts flow into Defender XDR, where they are correlated with alerts from other products into incidents. Content explorer shows where sensitive items are stored but does not correlate alerts into incidents.
DLP alerts flow into Defender XDR, where they are correlated with alerts from other products into incidents. Content explorer shows where sensitive items are stored but does not correlate alerts into incidents.
Question 23Security Operations Setup
Adatum wants every new Microsoft Sentinel incident from a firewall analytics rule to be assigned to the network security team lead and set to High severity. The team does not want to build or maintain any Logic Apps. What should you create?
Correct answer: D. An automation rule
Automation rules can change owner, severity, status and tags on incidents directly with no code. A playbook could do the same, but it is a Logic App, which the team does not want to build or maintain.
Automation rules can change owner, severity, status and tags on incidents directly with no code. A playbook could do the same, but it is a Logic App, which the team does not want to build or maintain.
Question 24Incident Response
An analyst at Northwind Traders is investigating an alert on a device at 14:05. The analyst wants to see every process, file, registry and network event on that device in the ten minutes before and after the alert, in order. What should the analyst use?
Correct answer: B. The device timeline
The device timeline shows events on a device in time order and can be filtered to a time range around an alert. The incident graph shows relationships between entities but not a full, ordered event history.
The device timeline shows events on a device in time order and can be filtered to a time range around an alert. The incident graph shows relationships between entities but not a full, ordered event history.
Question 25Threat Hunting
Litware wants to chart failed Microsoft Entra sign-ins per hour over the past day in Microsoft Sentinel. Which KQL fragment groups the results into hourly buckets?
Correct answer: C. | summarize count() by bin(TimeGenerated, 1h)
bin() rounds each timestamp down to an hourly bucket, and summarize count() then counts events per bucket for charting. A where filter with ago(1h) only keeps the last hour rather than grouping by hour.
bin() rounds each timestamp down to an hourly bucket, and summarize count() then counts events per bucket for charting. A where filter with ago(1h) only keeps the last hour rather than grouping by hour.
Question 26Security Operations Setup
The CISO at Tailwind Traders wants to know which MITRE ATT&CK techniques are covered by the company's active Microsoft Sentinel analytics rules and which techniques have no coverage. Administrative effort must be minimal. What should you use?
Correct answer: D. The MITRE ATT&CK page in Microsoft Sentinel
The MITRE ATT&CK page maps active and available rules and hunting queries to tactics and techniques, showing where coverage exists and where gaps remain. Secure Score measures configuration posture, not detection coverage by technique.
The MITRE ATT&CK page maps active and available rules and hunting queries to tactics and techniques, showing where coverage exists and where gaps remain. Secure Score measures configuration posture, not detection coverage by technique.
Question 27Incident Response
During an investigation, a Contoso analyst needs to download a suspicious DLL from a device for offline analysis. The device is online and onboarded to Microsoft Defender for Endpoint. What should the analyst use?
Correct answer: C. Live response getfile command
The getfile command in live response downloads a specific file from the device to the analyst. Collect investigation package gathers forensic data such as processes and autoruns, but it does not retrieve an arbitrary file.
The getfile command in live response downloads a specific file from the device to the analyst. Collect investigation package gathers forensic data such as processes and autoruns, but it does not retrieve an arbitrary file.
Question 28Security Operations Setup
Northwind Traders managers want a dashboard in Microsoft Sentinel that shows sign-in failures by location and app over the last 30 days. They want to start from Microsoft content rather than write queries from scratch. What should you use?
Correct answer: B. A workbook template from the content hub
Workbooks provide interactive dashboards, and solutions in the content hub include ready-made workbook templates such as sign-in analysis. A hunting query returns results for investigation but does not provide a reusable visual dashboard.
Workbooks provide interactive dashboards, and solutions in the content hub include ready-made workbook templates such as sign-in analysis. A hunting query returns results for investigation but does not provide a reusable visual dashboard.
Question 29Incident Response
A Fabrikam device may be compromised. The analyst needs a single package with running processes, scheduled tasks, autoruns, network connections and installed programs for forensic review, without opening an interactive session. What should the analyst do?
Correct answer: C. Collect investigation package
Collect investigation package gathers forensic artifacts, including processes, scheduled tasks, autoruns and network connections, into a downloadable zip. Live response would work but requires an interactive session, which the requirement excludes.
Collect investigation package gathers forensic artifacts, including processes, scheduled tasks, autoruns and network connections, into a downloadable zip. Live response would work but requires an interactive session, which the requirement excludes.
Question 30Threat Hunting
Adatum analysts need to hunt across raw Microsoft Defender for Endpoint process data from the past 180 days. Advanced hunting in the Defender portal only returns 30 days of this data. What should you do?
Correct answer: A. Stream the tables to Sentinel and hunt there
Defender XDR advanced hunting keeps about 30 days of raw data, so streaming the tables to a Sentinel workspace with longer retention allows hunting further back. A custom detection rule cannot look back beyond the data that advanced hunting keeps.
Defender XDR advanced hunting keeps about 30 days of raw data, so streaming the tables to a Sentinel workspace with longer retention allows hunting further back. A custom detection rule cannot look back beyond the data that advanced hunting keeps.
Question 31Security Operations Setup
Contoso ingests several terabytes of network flow logs each month. The logs are not used by any analytics rule but must be kept for two years for occasional investigations and hunting. You need to minimize cost. Where should you send these logs?
Correct answer: B. The Microsoft Sentinel data lake tier
The data lake tier is designed for high-volume, low-touch data at low cost with long retention, and it can still be queried with KQL for hunting and investigations. Keeping the logs in the analytics tier would work but costs far more for data that no rule uses.
The data lake tier is designed for high-volume, low-touch data at low cost with long retention, and it can still be queried with KQL for hunting and investigations. Keeping the logs in the analytics tier would work but costs far more for data that no rule uses.
Question 32Incident Response
A Litware executive's laptop shows signs of command-and-control traffic. You must cut the device off from the network, but the executive must keep using Outlook and Microsoft Teams while the investigation continues. What should you do?
Correct answer: A. Use selective isolation
Selective isolation blocks network traffic except for Outlook, Teams and Skype for Business, so the user can keep communicating. Full isolation would also block Outlook and Teams.
Selective isolation blocks network traffic except for Outlook, Teams and Skype for Business, so the user can keep communicating. Full isolation would also block Outlook and Teams.
Question 33Security Operations Setup
Fabrikam's Microsoft Sentinel bill has grown, and the team suspects some ingested tables are never used by rules or queries. They also want suggestions for detections that would close threat coverage gaps. Which feature should they review?
Correct answer: C. SOC optimization recommendations
SOC optimization gives data value recommendations, such as moving unused tables to a cheaper tier, and threat-based recommendations for missing detections. The usage and cost view shows how much is ingested but does not suggest coverage improvements.
SOC optimization gives data value recommendations, such as moving unused tables to a cheaper tier, and threat-based recommendations for missing detections. The usage and cost view shows how much is ingested but does not suggest coverage improvements.
Question 34Threat Hunting
During a Microsoft Sentinel hunt, a Tailwind Traders analyst finds a few suspicious rows that may matter later. The analyst wants to save those rows with notes and entity mappings so they can be added to an incident. What should the analyst create?
Correct answer: D. A hunting bookmark
Hunting bookmarks save selected query results with notes, tags and entity mappings, and they can be attached to a new or existing incident. A watchlist stores reference data for queries, not preserved evidence from a hunt.
Hunting bookmarks save selected query results with notes, tags and entity mappings, and they can be attached to a new or existing incident. A watchlist stores reference data for queries, not preserved evidence from a hunt.
Question 35Security Operations Setup
Litware uses the Windows Security Events via AMA connector in Microsoft Sentinel. The team needs to collect only failed logon events (event ID 4625) from a group of servers to reduce ingestion. What should you configure in the data collection rule?
Correct answer: D. A custom XPath query
A custom XPath query in the data collection rule lets you collect exactly the event IDs you need, such as 4625. The Minimal and Common sets are predefined lists that include many other events, so they do not meet the reduced ingestion goal.
A custom XPath query in the data collection rule lets you collect exactly the event IDs you need, such as 4625. The Minimal and Common sets are predefined lists that include many other events, so they do not meet the reduced ingestion goal.
Question 36Incident Response
An analyst at Adatum confirms that a malicious executable is running on a device. The analyst needs to stop the running process and move the file to quarantine on that device right away. What action should the analyst take?
Correct answer: A. Stop and quarantine file
Stop and quarantine file ends running processes for the file and quarantines it. A block indicator prevents future execution, but it is not the immediate action that stops and removes this running instance.
Stop and quarantine file ends running processes for the file and quarantines it. A block indicator prevents future execution, but it is not the immediate action that stops and removes this running instance.
Question 37Security Operations Setup
Adatum forwards firewall logs in Common Event Format to a Linux server running the Azure Monitor Agent. The CEF via AMA connector is configured in Microsoft Sentinel. In which table should analysts expect the firewall events?
Correct answer: B. CommonSecurityLog
CEF messages parsed by the CEF via AMA connector land in the CommonSecurityLog table with mapped fields. Plain Syslog messages without CEF go to the Syslog table instead.
CEF messages parsed by the CEF via AMA connector land in the CommonSecurityLog table with mapped fields. Plain Syslog messages without CEF go to the Syslog table instead.
Question 38Incident Response
Tailwind Traders investigates an incident where an attacker moved from a help desk account to a domain admin account. Analysts want to see which sensitive accounts could be reached through credentials exposed on the computers the help desk user logs on to. What should they review?
Correct answer: D. Defender for Identity lateral movement paths
Defender for Identity maps lateral movement paths that show how a non-sensitive account could reach sensitive accounts through exposed credentials. Sign-in logs show cloud authentication events but do not map paths between accounts.
Defender for Identity maps lateral movement paths that show how a non-sensitive account could reach sensitive accounts through exposed credentials. Sign-in logs show cloud authentication events but do not map paths between accounts.
Question 39Threat Hunting
Microsoft publishes details about a new ransomware campaign. Northwind Traders wants to read the analyst write-up and see whether any of its devices are exposed or show related alerts, all in one place. What should the team use?
Correct answer: C. Threat analytics in the Defender portal
Threat analytics reports combine Microsoft expert analysis of a threat with the organization's related alerts, impacted assets and exposure. The vulnerability management dashboard shows software weaknesses but not campaign write-ups with related alerts.
Threat analytics reports combine Microsoft expert analysis of a threat with the organization's related alerts, impacted assets and exposure. The vulnerability management dashboard shows software weaknesses but not campaign write-ups with related alerts.
Question 40Security Operations Setup
Tailwind Traders has 40 Azure subscriptions and wants Azure activity logs from all of them sent to Microsoft Sentinel. New subscriptions must be covered automatically with minimal effort. How should you configure the Azure Activity connector?
Correct answer: B. Use the connector's Azure Policy assignment
The Azure Activity connector uses an Azure Policy assignment to create diagnostic settings at scale, including for resources and subscriptions in scope that are added later. The Azure Monitor Agent collects data from machines and does not collect subscription activity logs.
The Azure Activity connector uses an Azure Policy assignment to create diagnostic settings at scale, including for resources and subscriptions in scope that are added later. The Azure Monitor Agent collects data from machines and does not collect subscription activity logs.
Question 41Incident Response
Northwind Traders wants every phishing incident in Microsoft Sentinel to include the same checklist of steps, such as checking the sender and resetting credentials, so analysts track progress in the incident. Administrative effort must be minimal. What should you configure?
Correct answer: C. An automation rule that adds incident tasks
Automation rules can add incident tasks automatically, giving analysts a tracked checklist inside each incident. A playbook that emails the checklist does not track step completion in the incident and needs a Logic App.
Automation rules can add incident tasks automatically, giving analysts a tracked checklist inside each incident. A playbook that emails the checklist does not track step completion in the incident and needs a Logic App.
Question 42Security Operations Setup
Northwind Traders subscribes to a threat intelligence sharing community that publishes indicators from a TAXII 2.1 server. The SOC wants the indicators imported into Microsoft Sentinel on a schedule with no custom code. Which connector should you use?
Correct answer: A. Threat Intelligence - TAXII
The TAXII connector polls a TAXII 2.x server collection on a schedule and imports the indicators into Sentinel. The Upload API connector requires the provider to push indicators by calling the API, which needs code or a platform that supports it.
The TAXII connector polls a TAXII 2.x server collection on a schedule and imports the indicators into Sentinel. The Upload API connector requires the provider to push indicators by calling the API, which needs code or a platform that supports it.
Question 43Incident Response
Contoso has Microsoft Security Copilot enabled in the Microsoft Defender portal. A new analyst opens a large multi-stage incident with 40 alerts and wants a short overview of what happened, the affected assets and the attack stages. What should the analyst use?
Correct answer: B. The incident summary from Copilot
Copilot embedded in the Defender portal can generate an incident summary that describes the attack stages, affected entities and key alerts. Threat analytics reports describe threat actors and campaigns, not this specific incident.
Copilot embedded in the Defender portal can generate an incident summary that describes the attack stages, affected entities and key alerts. Threat analytics reports describe threat actors and campaigns, not this specific incident.
Question 44Threat Hunting
A Contoso hunter wants to run Python code with machine learning libraries and MSTICPy against Microsoft Sentinel data to find unusual patterns that are hard to express in KQL. What should the hunter use?
Correct answer: A. A Jupyter notebook
Sentinel notebooks run Jupyter with Python, so hunters can use MSTICPy and machine learning libraries on workspace data. Workbooks visualize KQL results but do not run Python code.
Sentinel notebooks run Jupyter with Python, so hunters can use MSTICPy and machine learning libraries on workspace data. Workbooks visualize KQL results but do not run Python code.
Question 45Security Operations Setup
Contoso runs a legacy line-of-business app on Windows servers that writes security events to a plain text log file. The SOC wants these entries in Microsoft Sentinel. What should you configure?
Correct answer: C. A custom text log DCR
A data collection rule for custom text logs lets the Azure Monitor Agent read a log file and send the entries to a custom table whose name ends in _CL. The Windows Security Events connector reads the Windows Security event log, not text files.
A data collection rule for custom text logs lets the Azure Monitor Agent read a log file and send the entries to a custom table whose name ends in _CL. The Windows Security Events connector reads the Windows Security event log, not text files.
Question 46Incident Response
A Fabrikam department head reports that an important file disappeared from a SharePoint site yesterday. You need to find out which user deleted it and when. What should you use?
Correct answer: B. Microsoft Purview Audit search
Purview Audit search queries the unified audit log, which records SharePoint file deletions with the user and time. Content search finds items by content but does not show who deleted a file.
Purview Audit search queries the unified audit log, which records SharePoint file deletions with the user and time. Content search finds items by content but does not show who deleted a file.
Question 47Security Operations Setup
A Fabrikam analyst writes an advanced hunting query on DeviceProcessEvents and tries to save it as a custom detection rule, but the rule cannot be created. The query returns DeviceName, FileName and ProcessCommandLine. What should the analyst add to the results?
Correct answer: D. Timestamp, ReportId and DeviceId
Custom detection rules need Timestamp and ReportId to identify each event, plus an entity identifier such as DeviceId so alerts can map to an impacted asset. Severity and technique are set in the rule wizard and are not required query columns.
Custom detection rules need Timestamp and ReportId to identify each event, plus an entity identifier such as DeviceId so alerts can map to an impacted asset. Severity and technique are set in the rule wizard and are not required query columns.
Question 48Threat Hunting
Fabrikam keeps proxy logs in the Microsoft Sentinel data lake tier. Each night, the SOC wants to query the lake for connections to newly flagged domains and write the matching rows to an analytics tier table that rules can use. What should you create?
Correct answer: A. A KQL job
KQL jobs run one-time or scheduled queries against data lake data and write the results into an analytics tier table. Scheduled analytics rules run against analytics tier tables and are not used to promote lake data.
KQL jobs run one-time or scheduled queries against data lake data and write the results into an analytics tier table. Scheduled analytics rules run against analytics tier tables and are not used to promote lake data.
Question 49Incident Response
Litware suspects that a compromised service principal is calling Microsoft Graph to read many users' mail. The SOC wants a record of each Graph API request, including the app ID and requested URI, in Microsoft Sentinel. What should you send to the workspace?
Correct answer: B. Microsoft Graph activity logs
Microsoft Graph activity logs record HTTP requests made to Graph, including the calling app, the request URI and the response status. Entra audit logs record directory changes, not each API call.
Microsoft Graph activity logs record HTTP requests made to Graph, including the calling app, the request URI and the response status. Entra audit logs record directory changes, not each API call.
Question 50Security Operations Setup
Litware needs a Microsoft Sentinel detection that raises an incident within about a minute when a break-glass account signs in. Scheduled rules running every five minutes are too slow. Which rule type should you create?
Correct answer: D. Near-real-time (NRT)
NRT rules run about once a minute with a short lookback, so they suit urgent single-event detections like a break-glass sign-in. Anomaly rules use machine learning baselines and are not designed for fast single-event alerts.
NRT rules run about once a minute with a short lookback, so they suit urgent single-event detections like a break-glass sign-in. Anomaly rules use machine learning baselines and are not designed for fast single-event alerts.
The real SC-200 exam at a glance
50questions
1h 40mtime limit
MCQmultiple choice
75%+aim for here
Score 75% or more on two different sets before you book the real exam. Need a plan for your weak topics? See how we help you pass, or get a full refund.
More free Cyber Security practice tests
CEH v13 Practice Test125 questions · 312-50CISSP Practice Test150 questions · 2024 outlineCompTIA Security+ Practice Test90 questions · SY0-701 & SY0-801CompTIA CySA+ Practice Test85 questions · CS0-004CompTIA SecurityX Practice Test90 questions · CAS-005CHFI v11 Practice Test150 questions · 312-49
See all 36 free practice tests →
Original practice questions written by CertOcean in the style of the SC-200 exam. They are not real exam questions. SC-200 and Microsoft are trademarks of their owners. Real exam format: usually 40-60 questions · 100 minutes · passing score 700 on a 1-1000 scale · the real exam can include case studies.