Microsoft SC-200: Microsoft Security Operations Analyst

Last checked October 22, 2026 against the official Microsoft exam page.

1. Question 1Configure protections and detections

   Defender for Endpoint must block a known malicious file hash across all managed devices. Which feature provides this?

   1. ACustom indicators for file hashes with a block action
   2. BA monthly manual review of quarantined files
   3. CA device tag on each computer used for reporting
   4. DA change to the desktop background on sign-in
   Show answer and explanationHide answer

   Correct answer: A

   Custom indicators for file hashes can block files across devices. Tags, backgrounds and monthly reviews do not block malicious files.

2. Question 2Mitigate threats using Defender XDR

   Which two actions help reduce the impact of a malicious email attachment? (Choose two.)

   1. ABlocking executable attachments from external senders
   2. BOpening all attachments in production to check them
   3. CForwarding attachments to all staff
   4. DDisabling email filtering for speed
   5. ESandboxing attachments before delivery
   Show answer and explanationHide answer

   Correct answer: A, E

   Sandboxing and blocking risky attachment types reduce exposure to malware. Opening attachments in production, mass forwarding and disabling filtering increase risk.

3. Question 3Manage a security operations environment

   A security analyst must correlate alerts from endpoints, email, identity, and cloud apps into a single incident. Which Microsoft product provides this unified view?

   1. AMicrosoft Bookings suite
   2. BMicrosoft Defender XDR
   3. CMicrosoft Lists app
   4. DMicrosoft Forms survey tool
   Show answer and explanationHide answer

   Correct answer: B

   Defender XDR correlates alerts across Defender products into unified incidents. Lists, Forms and Bookings are productivity tools, not security correlation platforms.

4. Question 4Manage incident response

   An analyst needs to see all alerts that belong to the same attack campaign in Defender XDR. Which view should be used?

   1. AA list of user birthdays stored in the HR system
   2. BThe incident view that groups related alerts and entities
   3. CA single email per alert sent to the on-duty analyst
   4. DA wallpaper gallery of Windows themes and colors
   Show answer and explanationHide answer

   Correct answer: B

   Incidents group related alerts and entities for a unified investigation. Email per alert, wallpapers and birthdays do not group campaign activity.

5. Question 5Manage cloud security posture

   A subscription has a storage account that allows public blob access, flagged by Defender for Cloud. What is the best remediation?

   1. AIgnoring the recommendation because the portal labels it as informational and deferring the review
   2. BDisabling public blob access on the storage account after confirming no legitimate need
   3. CMaking the storage account public to test the alert and confirm that anonymous clients can read blobs
   4. DDeleting the subscription along with its resource groups, storage accounts, and role assignments in production
   Show answer and explanationHide answer

   Correct answer: B

   Disabling public access after confirming need resolves the exposure. Making it public, ignoring a valid risk and deleting the subscription are wrong responses.