CertArea
All Microsoft exams

Free SC-200 practice test: 30 questions with answers

30 original questions for Microsoft Security Operations Analyst, drawn from every topic area. Answer each one to see whether you got it right and why. No sign-up.

Free questions
30
Full bank
100 questions

SC-200 exam guide: topics, cost and format

All 30 SC-200 questions with answers

The same questions as the test above, grouped by exam topic. Open any question to see the answer and explanation.

Configure protections and detections (5 questions)

  1. Question 1

    Defender for Endpoint must block a known malicious file hash across all managed devices. Which feature provides this?

    1. ACustom indicators for file hashes with a block action
    2. BA monthly manual review of quarantined files
    3. CA device tag on each computer used for reporting
    4. DA change to the desktop background on sign-in
    Show answer and explanation
    Correct answer: A

    Custom indicators for file hashes can block files across devices. Tags, backgrounds and monthly reviews do not block malicious files.

  2. Question 2

    A Defender for Endpoint customer wants to ensure that a suspicious process is contained on one device while investigation continues. Which response action fits?

    1. AIsolating the device from the network while keeping the security platform connection
    2. BShutting down the entire network segment that hosts the affected devices
    3. CDeleting the device from Entra ID and clearing its Intune enrollment
    4. DUninstalling Windows from the device before reimaging it from a clean ISO image
    Show answer and explanation
    Correct answer: A

    Device isolation contains threats while preserving the connection to Defender for investigation. Shutting down networks, deleting identities and uninstalling Windows are disproportionate.

  3. Question 3

    Defender for Office 365 needs to protect users from phishing links that become malicious after an email is delivered. Which feature addresses this?

    1. AAnti-spam quarantine for flagged mail
    2. BMail forwarding rules in Exchange
    3. CCalendar sharing policies for resources
    4. DSafe Links with time-of-click URL checking
    Show answer and explanation
    Correct answer: D

    Safe Links checks URLs at click time, which catches links that change after delivery. Quarantine alone and forwarding or calendar policies do not provide click-time protection.

  4. Question 4

    Microsoft Defender for Cloud must surface misconfigurations in Azure resources and recommend fixes. Which feature provides this?

    1. AAzure Lighthouse delegations for managed service partners
    2. BStorage account metrics in blob transactions per hour
    3. CAzure Bastion sessions for remote RDP and SSH access to virtual machines
    4. DSecure score and security recommendations in Defender for Cloud
    Show answer and explanation
    Correct answer: D

    Defender for Cloud secure score and recommendations identify misconfigurations and suggest fixes. Bastion, Lighthouse and storage metrics do not assess posture.

  5. Question 5

    Defender for Cloud must detect threats against a Windows VM, such as suspicious process activity, by using an endpoint protection agent. Which plan should be enabled?

    1. ADefender for Servers
    2. BDefender for DNS only
    3. CDefender for Storage only
    4. DDefender for Key Vault only
    Show answer and explanation
    Correct answer: A

    Defender for Servers provides endpoint protection and threat detection for server workloads. The other plans cover storage, key vaults or DNS specifically.

Mitigate threats using Defender XDR (5 questions)

  1. Question 6

    Which two actions help reduce the impact of a malicious email attachment? (Choose two.)

    1. ABlocking executable attachments from external senders
    2. BOpening all attachments in production to check them
    3. CForwarding attachments to all staff
    4. DDisabling email filtering for speed
    5. ESandboxing attachments before delivery
    Show answer and explanation
    Correct answer: A, E

    Sandboxing and blocking risky attachment types reduce exposure to malware. Opening attachments in production, mass forwarding and disabling filtering increase risk.

  2. Question 7

    A user account shows many failed sign-ins followed by a successful one from an unusual country. Which Defender capability identifies this as a risky sign-in?

    1. APrinter quota reports in the print server that track page counts
    2. BStorage analytics for images stored in the blob container archive tier
    3. CCalendar sharing alerts for shared meeting invitations in Exchange
    4. DIdentity Protection risk detections in Microsoft Entra ID
    Show answer and explanation
    Correct answer: D

    Identity Protection detects risky sign-ins and user risk, including unusual locations and patterns. Printer, calendar and storage tools do not evaluate sign-in risk.

  3. Question 8

    An attacker used a phished credential to sign in and create mailbox forwarding rules. Which response should the analyst take first?

    1. AReset the user's credentials, revoke sessions, and remove the malicious forwarding rules
    2. BDelete the user's mailbox immediately, which removes the forwarding setting
    3. CIgnore the rules because they are normal mailbox settings set by a client
    4. DEmail the attacker through the phishing message's reply address to ask them to stop
    Show answer and explanation
    Correct answer: A

    Resetting credentials, revoking sessions and removing forwarding rules contain the compromise and remove exfiltration. Ignoring rules, deleting mailboxes and contacting attackers are inappropriate.

  4. Question 9

    Defender for Office 365 has detected a campaign of malicious attachments delivered to many mailboxes. Which action removes the emails from all mailboxes?

    1. AForwarding the emails to the security team's shared mailbox so analysts can review each attachment
    2. BPrinting the emails and keeping the paper copies in the office filing cabinet
    3. CUsing the Zero-hour auto purge or the admin action to soft delete the malicious messages
    4. DAsking each user to delete the email manually from their inbox and trash folder
    Show answer and explanation
    Correct answer: C

    Admin actions such as soft delete or ZAP remove malicious messages from all mailboxes centrally. Manual deletion is slow and inconsistent, forwarding spreads the threat and printing does not remove it.

  5. Question 10

    A user clicked a link in a phishing message that later showed as malicious. Which Defender feature helps the SOC see which users clicked malicious links?

    1. AThe printer's ink and toner usage report
    2. BThreat Explorer or the Safe Links click reports
    3. CThe user's personal social media feed and saved photos
    4. DThe wallpaper history of the device desktop settings
    Show answer and explanation
    Correct answer: B

    Threat Explorer and Safe Links click reports show which users clicked malicious URLs. Personal feeds, wallpaper history and printer reports do not show click activity.

Manage a security operations environment (5 questions)

  1. Question 11

    A security analyst must correlate alerts from endpoints, email, identity, and cloud apps into a single incident. Which Microsoft product provides this unified view?

    1. AMicrosoft Bookings suite
    2. BMicrosoft Defender XDR
    3. CMicrosoft Lists app
    4. DMicrosoft Forms survey tool
    Show answer and explanation
    Correct answer: B

    Defender XDR correlates alerts across Defender products into unified incidents. Lists, Forms and Bookings are productivity tools, not security correlation platforms.

  2. Question 12

    Microsoft Sentinel must receive Microsoft Entra ID sign-in logs for detection. Which configuration is required?

    1. AA tag on the Sentinel workspace for ownership and cost tracking
    2. BA resource lock on the subscription to prevent accidental deletion of the workspace
    3. CA data connector for Microsoft Entra ID enabled in the Sentinel workspace
    4. DA budget alert for the security team when Log Analytics ingestion costs rise
    Show answer and explanation
    Correct answer: C

    Data connectors bring source logs such as Entra ID sign-ins into the Sentinel workspace. Tags, locks and budgets do not ingest logs.

  3. Question 13

    A SOC wants to store Sentinel data for two years for compliance while keeping recent data for active hunting. Which configuration supports this?

    1. ADeleting data after 30 days with no retention settings configured in the workspace
    2. BExporting logs to a text file on a laptop nightly with manual copies kept locally
    3. CWorkspace retention with archive or long-term retention tiers for older data
    4. DTurning off logging for six months during the audit period to reduce Sentinel ingestion costs
    Show answer and explanation
    Correct answer: C

    Sentinel supports interactive retention plus archive or long-term tiers for compliance periods. Deleting after 30 days, laptop exports and disabled logging do not meet the requirement.

  4. Question 14

    Which Sentinel component runs scheduled queries and creates incidents when their results meet defined conditions?

    1. AWatchlists
    2. BAnalytics rules
    3. CWorkbooks
    4. DData connectors only
    Show answer and explanation
    Correct answer: B

    Analytics rules run queries on a schedule and create incidents when conditions are met. Workbooks visualize data, watchlists store reference lists, and connectors bring data in.

  5. Question 15

    An analyst needs to enrich Sentinel incidents with a list of approved IP addresses that should be treated as trusted. Which feature should be used?

    1. AA playbook that removes the listed IP addresses from the table
    2. BA watchlist containing the approved IP addresses referenced in queries
    3. CA workbook showing the IP addresses as charts and summary tiles
    4. DA resource tag on each IP address to mark its trust status in reports
    Show answer and explanation
    Correct answer: B

    Watchlists hold reference data such as trusted IPs that queries can join for enrichment. Workbooks display data, tags are not used for this, and deleting addresses is unrelated.

Manage incident response (5 questions)

  1. Question 16

    An analyst needs to see all alerts that belong to the same attack campaign in Defender XDR. Which view should be used?

    1. AA list of user birthdays stored in the HR system
    2. BThe incident view that groups related alerts and entities
    3. CA single email per alert sent to the on-duty analyst
    4. DA wallpaper gallery of Windows themes and colors
    Show answer and explanation
    Correct answer: B

    Incidents group related alerts and entities for a unified investigation. Email per alert, wallpapers and birthdays do not group campaign activity.

  2. Question 17

    Which two elements are typically part of an incident in Defender XDR? (Choose two.)

    1. AThe office coffee schedule
    2. BThe public website banner
    3. CThe marketing campaign calendar
    4. DRelated alerts
    5. EAffected entities such as users and devices
    Show answer and explanation
    Correct answer: D, E

    An incident groups related alerts and the entities they affect. Coffee schedules, website banners and marketing calendars are not incident elements.

  3. Question 18

    A major incident involves multiple users and devices. The SOC lead wants one place to assign tasks, track progress, and record decisions. Which practice fits best?

    1. AWorking the Defender XDR incident with comments, assignments, and status updates in one record
    2. BWaiting until the incident ends before writing a short summary of findings to the SOC lead
    3. CSending tasks by personal text messages to analysts' phones during the response
    4. DKeeping decisions in each analyst's own notes and local files on their laptops
    Show answer and explanation
    Correct answer: A

    A single incident record with assignments, comments and status keeps the team coordinated and auditable. Personal messages, scattered notes and deferred recording reduce coordination and accountability.

  4. Question 19

    A severity-high alert must be escalated to a senior analyst after one hour without triage. Which Sentinel or Defender feature automates this?

    1. AA monthly SOC report summarizing incident counts by severity and analyst for review
    2. BA workbook titled urgent with a red banner that shows open high-severity incidents for SOC
    3. CA manual reminder on a sticky note that a shift lead checks daily
    4. DAn automation rule with a time-based condition that reassigns or notifies
    Show answer and explanation
    Correct answer: D

    Automation rules can act on incidents based on time and severity, which enforces escalation. Sticky notes, monthly reports and titled workbooks do not escalate automatically.

  5. Question 20

    An analyst needs to preserve the state of a compromised cloud VM for investigation before remediation. Which step should be taken first?

    1. ADeleting the VM and recreating it from the latest image template
    2. BTaking a disk snapshot and capturing relevant logs before changing the VM
    3. CRestarting the VM several times to clear memory and reset its network state before imaging
    4. DChanging the VM's name and resource tags so the instance no longer matches existing alerts
    Show answer and explanation
    Correct answer: B

    Snapshots and log capture preserve evidence before changes. Deleting, restarting repeatedly and renaming the VM can destroy or alter evidence.

Manage cloud security posture (5 questions)

  1. Question 21

    A subscription has a storage account that allows public blob access, flagged by Defender for Cloud. What is the best remediation?

    1. AIgnoring the recommendation because the portal labels it as informational and deferring the review
    2. BDisabling public blob access on the storage account after confirming no legitimate need
    3. CMaking the storage account public to test the alert and confirm that anonymous clients can read blobs
    4. DDeleting the subscription along with its resource groups, storage accounts, and role assignments in production
    Show answer and explanation
    Correct answer: B

    Disabling public access after confirming need resolves the exposure. Making it public, ignoring a valid risk and deleting the subscription are wrong responses.

  2. Question 22

    Defender for Cloud recommends enabling multifactor authentication for accounts with administrative rights in a subscription. Which control should the team implement?

    1. AA reminder email every month to the admins
    2. BRemoving the admin roles from the subscription
    3. CConditional access requiring MFA for administrators
    4. DA shared administrator password kept in notes
    Show answer and explanation
    Correct answer: C

    Conditional access requiring MFA for administrators enforces the recommendation. Reminder emails, shared passwords and removing admins are not valid implementations.

  3. Question 23

    Which Defender for Cloud feature shows the overall security health of a subscription as a score with prioritized actions?

    1. AAzure Bastion sessions
    2. BNetwork Watcher flow logs
    3. CAzure Lighthouse access
    4. DSecure score
    Show answer and explanation
    Correct answer: D

    Secure score summarizes security posture and lists prioritized recommendations. Bastion, Lighthouse and flow logs are not posture scores.

  4. Question 24

    A Kubernetes cluster must be protected against runtime threats such as suspicious container activity. Which Defender plan applies?

    1. ADefender for DNS Plan
    2. BDefender for Key Vault Plan
    3. CDefender for Storage Plan
    4. DDefender for Containers
    Show answer and explanation
    Correct answer: D

    Defender for Containers provides runtime and posture protection for Kubernetes and container workloads. The other plans cover different resources.

  5. Question 25

    A security team wants to define a standard set of compliance requirements for its Azure subscriptions and see compliance status. Which feature should be used?

    1. ARegulatory compliance dashboard in Defender for Cloud
    2. BAzure Front Door routing rules for HTTP traffic
    3. CStorage lifecycle policies that move blobs to archive tier
    4. DA VM image gallery for storing golden OS images
    Show answer and explanation
    Correct answer: A

    The regulatory compliance dashboard assesses resources against selected standards. Lifecycle policies, image galleries and Front Door rules are unrelated to compliance assessment.

Use Kusto Query Language in Sentinel (5 questions)

  1. Question 26

    An analyst wants a count of failed sign-ins per user over the last day in Sentinel, using KQL. Which query pattern fits best?

    1. ASigninLogs | print rows | where TimeGenerated > ago(1d) | project UserPrincipalName, ResultType | take 5
    2. BPrinting the SigninLogs table to a PDF file from the Log Analytics portal export menu for review by the security team each morning
    3. CSigninLogs | where TimeGenerated > ago(1d) | project color, UserPrincipalName, Location | take 500
    4. DSigninLogs | where TimeGenerated > ago(1d) and ResultType != 0 | summarize FailedCount = count() by UserPrincipalName
    Show answer and explanation
    Correct answer: D

    Filtering by time and failure result, then summarizing counts by user, produces the requested count. Printing and projecting colors do not compute counts.

  2. Question 27

    A KQL query returns too many rows to review. Which operator reduces the output to the most recent 20 events?

    1. Asort by TimeGenerated desc | take 20
    2. Brender as a pie chart of counts
    3. Cproject the color column values
    4. Dunion SigninLogs and AuditLogs
    Show answer and explanation
    Correct answer: A

    Sorting descending by time and taking 20 rows returns the most recent events. Projecting colors, unions without filters and pie charts do not limit the results.

  3. Question 28

    An analyst wants to join sign-in events with a watchlist of executives to focus an investigation. Which KQL operator performs this join?

    1. Aprint the watchlist name and the sign-in count per row
    2. Bjoin or lookup with the watchlist table on the matching user field
    3. Cappend with the watchlist rows added to the end of each sign-in result set
    4. Drender to show the watchlist as a table with a bar chart
    Show answer and explanation
    Correct answer: B

    Join and lookup combine rows across tables on matching fields, which connects sign-ins to the watchlist. Append adds rows, render draws charts and print displays values.

  4. Question 29

    A hunting query must detect a process that runs from a temporary folder. Which KQL approach best matches this requirement?

    1. ACounting processes across the entire tenant history without time or device filters in a single summary table
    2. BListing every file on every disk that the endpoint has touched since install
    3. CFiltering the process events where the folder path contains the temporary folder pattern
    4. DRendering a bar chart of process names grouped by device and hour over the last quarter for the SOC
    Show answer and explanation
    Correct answer: C

    Filtering by folder path pattern in process events targets the behavior. Unfiltered counts, file listings and charts do not identify the condition.

  5. Question 30

    Which two KQL operators are used to filter and limit query results? (Choose two.)

    1. Aprint
    2. Bunion only
    3. Cwhere
    4. Dtake
    5. Erender
    Show answer and explanation
    Correct answer: C, D

    where filters rows and take limits the number of rows returned. Render draws charts, print displays values, and union combines tables rather than limiting results.

Want more SC-200 questions?

The full bank has 100 questions with answers and explanations, as a PDF, an online practice exam, or both.

Full question bank · 100 questions
$75$104

Both formats together. The best value.

Instant access after payment, with 90 days of updates. Checkout is on our store, AIExamCerts.