Microsoft SC-200 Practice Exam

Microsoft Security Operations Analyst SC-200

The Microsoft Security Operations Analyst SC-200 exam validates the skills to triage and respond to incidents, hunt for threats and engineer detections with Microsoft Defender XDR, Microsoft Sentinel and related Microsoft security products. It is weighted across three domains: manage a security operations environment at 40 to 45 percent, respond to security incidents at 35 to 40 percent, and perform threat hunting at 20 to 25 percent. Questions test data connectors, analytics and custom detection rules, automation, incident investigation and Kusto Query Language. This practice exam mirrors that scope with scenario-based single-answer and multiple-answer questions and drag-and-drop matching, each with a worked explanation.

Question bank updated : questions, answers, explanations and chapters.

Certification Overview

  • Exam name: SC-200
  • Vendor: Microsoft
  • Exam code: SC-200
  • Duration: 100 minutes
  • Total questions: about 50
  • Official passing score: 700 on a scale of 1 to 1,000 (source)
  • Our practice exam pass mark: 70%

Who Should Take This Exam?

Security Operations Analyst, SOC Analyst, Threat Hunter, Incident Responder, Security Engineer, Detection Engineer, Cybersecurity Analyst, Security Administrator

Prerequisites

No formal prerequisite. Microsoft expects familiarity with Microsoft security, compliance and identity solutions, Microsoft 365, Azure cloud services, AI agents and Copilots, and Windows, Linux and mobile operating systems.

Topics Covered

  • Manage a security operations environment
  • Respond to security incidents
  • Perform threat hunting

Question Types

  • Multiple Choice (Single Answer)
  • Multiple Choice (Multiple Answers)
  • Drag and Drop

SC-200 Practice Questions

Our question bank contains 650+ practice questions for this certification. Sample questions from each exam chapter. Expand a question to see the answer choices. With a subscription, you get unlimited practice exams with randomised questions from our full question bank.

Manage a security operations environment

Microsoft Sentinel playbooks are built on which Azure service?
  • A. Azure Functions
  • B. Azure Logic Apps Correct answer
  • C. Power Automate flows
  • D. Azure Automation runbooks

Option B is correct because Microsoft Sentinel playbooks are Azure Logic Apps workflows that use the Sentinel connector and triggers. Power Automate, Azure Functions and Automation runbooks can be called from a playbook but are not what playbooks are built on.

A SOC wants Defender for Endpoint to remediate threats on employee laptops without waiting for an analyst, while remediation on production servers must wait for approval. What should the analyst configure?
  • A. One device group set to Semi automation, with laptop actions approved in bulk from the Action center
  • B. Two device groups, with laptops set to Full automation and servers set to Semi automation Correct answer
  • C. Attack surface reduction rules in block mode for laptops and audit mode for servers
  • D. Two device groups, with a different RBAC role for analysts assigned to each group

Option B is correct because Defender for Endpoint sets the automation level per device group, so laptops can be Full automation (remediate without approval) while servers stay on Semi automation (approval required). A single group applies one level to every device, ASR rules prevent attacks rather than control remediation approval, and RBAC roles do not change the automation level.

During a two-week maintenance window, a scheduled analytics rule will raise incidents for expected patching activity. The SOC still wants those incidents recorded, but closed without analyst effort. Which configuration meets this?
  • A. A watchlist of patching hosts that the rule's query excludes from its results
  • B. Disable the analytics rule now and re-enable it when the maintenance window ends
  • C. An automation rule that closes this rule's incidents and expires in two weeks Correct answer
  • D. Alert suppression on the analytics rule set to the maximum suppression period

Option C is correct because an automation rule can close incidents from a specific analytics rule and be given an expiration date, so it stops by itself after the maintenance window while the incidents are still recorded. Excluding hosts or disabling the rule would stop the incidents being created, and alert suppression only stops further alerts for a limited period (up to 24 hours) instead of closing them.

An automation rule in Microsoft Sentinel runs a playbook when an incident is created. The playbook sits in a different resource group from the workspace, runs successfully when started manually from an incident, yet its run history stays empty for new incidents. What should the analyst do?
  • A. Reauthorize the playbook's Microsoft Sentinel API connection with a signed-in analyst account
  • B. Assign the playbook's managed identity the Microsoft Sentinel Responder role on the workspace
  • C. Grant the SOC analysts the Logic App Contributor role on the playbook's resource group
  • D. Give Microsoft Sentinel the Automation Contributor role on the playbook's resource group Correct answer

Option D is correct because automation rules run playbooks using Microsoft Sentinel's own service identity, which needs the Microsoft Sentinel Automation Contributor role on the resource group holding the playbook. Manual runs work because they use the analyst's permissions, which is why only the automated trigger fails. The other options change analyst or playbook permissions, not the permission Sentinel itself uses.

Which Azure resource must exist before Microsoft Sentinel can be enabled?
  • A. An Azure Data Explorer cluster
  • B. A Log Analytics workspace Correct answer
  • C. An Azure Event Hubs namespace
  • D. An Azure Storage account

Option B is correct because Microsoft Sentinel is enabled on a Log Analytics workspace, which stores all of its data. Data Explorer, Event Hubs and Storage can be integration or export targets but are not prerequisites.

Which three trigger types does the Microsoft Sentinel connector in Azure Logic Apps offer for building a playbook? (Choose three)
  • A. Data connector health trigger
  • B. Hunting bookmark trigger
  • C. Entity trigger Correct answer
  • D. Watchlist trigger
  • E. Alert trigger Correct answer
  • F. Incident trigger Correct answer

Options C, E and F are correct because the Microsoft Sentinel connector in Logic Apps offers three triggers: when an incident is created, when an alert is created, and when an entity is selected (entity trigger). Data connector health, hunting bookmarks and watchlists are not playbook triggers, so options A, B and D do not apply.

An analyst wants a ready-made playbook that blocks a compromised Microsoft Entra ID user, instead of building one from scratch. Where in Microsoft Sentinel can playbook templates be found? (Choose two)
  • A. Defender portal, Action center
  • B. Hunting, Queries tab
  • C. Automation, Playbook templates tab Correct answer
  • D. Content hub solutions Correct answer
  • E. Workbooks, Templates tab

Options C and D are correct because playbook templates are listed on the Playbook templates tab under Automation and are also delivered inside Content hub solutions, where they can be installed and turned into playbooks. The Action center, hunting queries and workbook templates hold response actions, queries and dashboards, not playbook templates.

Respond to security incidents

Which page in the Microsoft Defender portal correlates alerts from several Defender products into a single case for an analyst to work?
  • A. Threat analytics
  • B. Alerts queue
  • C. Incidents queue Correct answer
  • D. Advanced hunting

Option C is correct because the Incidents queue groups correlated alerts from Defender for Endpoint, Office 365, Identity and Cloud Apps into one case for the analyst to work. The Alerts queue lists individual alerts, Threat analytics covers threat reports, and Advanced hunting is a query tool rather than a case page.

An incident in the Microsoft Defender portal holds four alerts about a phishing campaign and one alert about an unrelated user's laptop. The analyst wants the incident to describe only the campaign. What should the analyst do?
  • A. Suppress the unrelated alert with an alert tuning rule
  • B. Classify the incident as informational, expected activity
  • C. Merge the incident into the one for the laptop's owner
  • D. Link the unrelated alert to a different incident Correct answer

Option D is correct because an alert can be linked to a different incident, which removes it from the campaign incident and keeps that incident focused. Suppressing it with a tuning rule hides future alerts, classifying the incident as informational mislabels the campaign, and merging would pull the campaign into an unrelated incident.

A scheduled red team exercise triggered several alerts that were rolled into one incident, and the SOC lead confirmed the testing was authorized. How should the analyst classify the incident when resolving it?
  • A. True positive: Compromised account
  • B. Informational, expected activity: Security test Correct answer
  • C. True positive: Malicious user activity
  • D. False positive: Not malicious

Option B is correct because Defender uses the Informational, expected activity classification, with the Security test determination, for authorized testing such as red team exercises. The true positive options imply real malicious activity, and False positive means the detection was wrong, which is not the case here.

A vulnerability scanner triggers the same low-severity alert on dozens of servers every night. The SOC wants matching alerts resolved automatically in future without being deleted. What should the analyst create?
  • A. A custom detection rule that excludes the scanner
  • B. An indicator that allows the scanner's IP address
  • C. A device group with No automated response
  • D. An alert tuning rule that resolves matching alerts Correct answer

Option D is correct because an alert tuning rule can automatically resolve matching alerts while keeping them recorded. A custom detection rule creates alerts rather than excluding them, an IP allow indicator only affects network blocking, and a No automated response device group only changes remediation behavior.

An incident shows a user signing in to Exchange Online and SharePoint from an unfamiliar country minutes after approving an adversary-in-the-middle phishing page. Defender for Endpoint reports no alerts on the user's laptop. The SOC must stop the attacker's access right now. What should the analyst do first?
  • A. Isolate the user's laptop from the network
  • B. Block the sender's domain in the Tenant Allow/Block List
  • C. Reset the user's password and revoke the active sessions Correct answer
  • D. Soft-delete the phishing message from every mailbox

Option C is correct because the attacker is using a stolen identity session in cloud apps, so the fastest way to cut access is to reset the password and revoke active sessions. Isolating the laptop does nothing since it is not compromised, and blocking the sender or deleting the email does not end an already established session.

Which two message verdicts are quarantined with the AdminOnlyAccessPolicy quarantine policy by default in Exchange Online Protection? (Choose two.)
  • A. High confidence spam
  • B. Malware Correct answer
  • C. High confidence phishing Correct answer
  • D. Phishing
  • E. Bulk

Options B and C are correct because by default Exchange Online Protection applies AdminOnlyAccessPolicy to malware and high confidence phishing verdicts, so only admins can release those messages. Spam, high confidence spam, phishing and bulk use the default full-access style quarantine policy, which lets users see and act on their own messages.

The SOC wants each new high-severity incident that Microsoft Sentinel creates in the Defender portal to be assigned to the tier-2 queue owner and to carry a checklist of triage steps. Which two automation rule actions meet this requirement? (Choose two.)
  • A. Add task Correct answer
  • B. Change status
  • C. Change severity
  • D. Add tags
  • E. Assign owner Correct answer

Options A and E are correct because a Microsoft Sentinel automation rule can use the Assign owner action to route the incident to the tier-2 queue owner and the Add task action to attach a triage checklist. Change status, Change severity and Add tags modify other properties and neither assign ownership nor create a checklist.

Perform threat hunting

Process creation events from devices onboarded to Defender for Endpoint are stored in which advanced hunting table?
  • A. DeviceFileEvents
  • B. DeviceLogonEvents
  • C. DeviceNetworkEvents
  • D. DeviceProcessEvents Correct answer

Option D, DeviceProcessEvents, is correct because it records process creation events from onboarded devices. DeviceFileEvents covers file activity, DeviceLogonEvents covers sign-ins, and DeviceNetworkEvents covers network connections.

Which Microsoft Sentinel feature preserves a row from a hunting query result so it can later be linked to an incident?
  • A. Workbook
  • B. Watchlist
  • C. Bookmark Correct answer
  • D. Playbook

Option C, Bookmark, is correct because bookmarks save rows from hunting query results and can be attached to an incident. Workbooks visualize data, watchlists are reference lists, and playbooks automate responses.

An analyst wants an advanced hunting query to run on a schedule and raise alerts whenever it returns results. What should the analyst create?
  • A. A device group
  • B. A shared query
  • C. A custom detection rule Correct answer
  • D. An alert tuning rule

Option C, a custom detection rule, is correct because it runs an advanced hunting query on a schedule and generates alerts on matches. Device groups, shared queries and alert tuning rules do not turn a query into scheduled alerting.

Sign-in activity ingested through the Microsoft Entra ID data connector lands in which Log Analytics table?
  • A. OfficeActivity
  • B. SecurityEvent
  • C. AuditLogs
  • D. SigninLogs Correct answer

Option D, SigninLogs, is correct because the Microsoft Entra ID connector writes interactive sign-in activity to that table. AuditLogs holds directory changes, SecurityEvent holds Windows events and OfficeActivity holds Microsoft 365 audit data.

Contoso's SOC suspects attackers are running obfuscated PowerShell on endpoints. Which advanced hunting query lists the devices that launched PowerShell with an encoded command?
  • A. DeviceRegistryEvents | where RegistryValueData has 'powershell' and ActionType == 'RegistryValueSet'
  • B. DeviceFileEvents | where FileName endswith '.ps1' and ActionType == 'FileCreated'
  • C. DeviceProcessEvents | where FileName =~ 'powershell.exe' and ProcessCommandLine has '-enc' Correct answer
  • D. DeviceNetworkEvents | where InitiatingProcessFileName =~ 'powershell.exe' and RemotePort == 443

Option C is correct because DeviceProcessEvents records process launches and ProcessCommandLine exposes the -enc encoded command argument. The other queries look at registry values, .ps1 file creation or port 443 traffic, none of which show an encoded command being run.

Investigators suspect a hybrid user account is compromised and need three data sets from Defender XDR advanced hunting: Microsoft Entra sign-in events, changes to on-premises Active Directory objects, and activity in Exchange Online mailboxes. Which three tables should they query? (Choose three.)
  • A. DeviceLogonEvents
  • B. UrlClickEvents
  • C. EntraIdSignInEvents Correct answer
  • D. IdentityDirectoryEvents Correct answer
  • E. EmailEvents
  • F. CloudAppEvents Correct answer

Options C, D and F are correct. EntraIdSignInEvents holds Microsoft Entra sign-in events, IdentityDirectoryEvents records changes to on-premises Active Directory objects, and CloudAppEvents carries Exchange Online mailbox activity. DeviceLogonEvents covers sign-ins to endpoints, UrlClickEvents covers link clicks in email and Office apps, and EmailEvents covers mail flow metadata rather than mailbox activity.

Free Study Guide

Read the free Microsoft SC-200 study guide: every exam topic explained in plain English, with diagrams, exam tips and the mistakes to avoid.

More Microsoft Practice Exams

All Microsoft practice exams →

Practise with realistic mock exams to prepare for your Microsoft certification.