Microsoft certification practice
Practise Microsoft Security Operations Analyst SC-200 practice test — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps. Microsoft certification exams often test whether you can choose the right Azure, Microsoft 365, identity, security or monitoring action for a realistic administrative scenario. Courseiva helps you practise with structured questions and explanations.
New here? Start with this
Recommended: 10-question diagnostic
Covers all 6 domains · takes ~5 min · no account needed · shows your weak areas immediately
Key facts for the Microsoft Security Operations Analyst SC-200 exam.
Exam cost
$165 USD / ~£135
Duration
120 minutes
Question count
40–60 questions
Passing score
700 / 1000
Validity
Annual renewal (free online assessment on Microsoft Learn)
Delivered by
Pearson VUE
Online proctored
Yes — available
Retake policy
100% free — no account required
Everything on Courseiva for SC-200 is free — no subscription, no trial, no email wall.
Courseiva provides free Microsoft Security Operations Analyst SC-200 (SC-200) practice questions with original exam-style questions, detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics. Courseiva is an independent platform and is not affiliated with Microsoft.
24 hours after first failure; 14 days after second
Question formats
Microsoft Security Operations Analyst (SC-200) validates skills in managing a security operations environment, responding to security incidents using Microsoft Sentinel and Microsoft Defender XDR, and performing threat hunting. It is aimed at SOC analysts and security engineers in Microsoft-heavy environments.
Official prerequisite
None
Recommended experience
SC-900 and hands-on experience with Microsoft Sentinel and Defender XDR
Hands-on experience in a Microsoft security operations environment. Should be comfortable with KQL (Kusto Query Language) for Sentinel queries.
Should you skip this exam?
If you do not work with Microsoft Sentinel or Defender XDR, a vendor-neutral cert like Security+ or CySA+ is more broadly applicable.
Courseiva study tip
KQL (Kusto Query Language) is tested directly — you need to read and write queries against Azure Monitor and Sentinel logs. This is a hands-on skill that cannot be crammed from flashcards. Use Microsoft's free Sentinel training environment.
UK salary range
£50,000–£80,000
US salary range
$85,000–$130,000
Job roles that cite SC-200
$165 USD.
700 out of 1000.
SC-200 is a hard exam. KQL query writing is tested practically, and the Sentinel/Defender XDR configuration scenarios require real hands-on experience — not just conceptual knowledge.
SC-200 requires annual renewal via a free online assessment on Microsoft Learn.
AZ-500 focuses on securing Azure infrastructure (configuring security controls). SC-200 focuses on detecting and responding to threats (using Sentinel and Defender XDR to investigate and remediate incidents).
Yes. KQL (Kusto Query Language) is used in Microsoft Sentinel for log analysis and threat hunting. SC-200 tests the ability to write and interpret KQL queries — this is one of the most technically demanding aspects of the exam.
See how SC-200 stacks up against related certifications.
Practice modes
Choose a mode that matches your current study phase. Use topic practice early on and mock exams closer to your exam date.
All SC-200 Questions
Browse the full question bank organised by domain and difficulty.
Practice Test
Start a session with detailed answer explanations after each question.
Mock Exam
Simulate the real exam with a timed, full-length question set.
Quick 10
A 10-question warm-up — ideal for a short daily study session.
Flashcards
Reinforce key terms, commands, and protocol facts with flashcards.
Domain Practice
Focus exclusively on one exam domain to target your weakest area.
50-Question Set
Mid-length practice set covering all domains.
Full-length Simulation
Full exam simulation matching the real question count.
Exam guide
Start with a short practice session, review each missed answer, then return to the topics that caused mistakes.
Microsoft Security Operations Analyst SC-200 questions test whether you can apply the concept in context, not just recognise a definition.
How the topic appears in realistic exam-style scenarios.
Which detail in the question changes the correct answer.
How to eliminate plausible but wrong options.
How to connect the question back to the wider exam objective.
Related practice questions
Use these internal links to move from the exam guide into focused topic practice pages.
Practise SC-200 questions linked to Manage a security operations environment.
Practise SC-200 questions linked to Respond to security incidents.
Practise SC-200 questions linked to Perform threat hunting.
Practise SC-200 questions linked to Mitigate threats using Microsoft Defender XDR.
Practise SC-200 questions linked to Mitigate threats using Microsoft Defender for Cloud.
Practise SC-200 questions linked to Mitigate threats using Microsoft Sentinel.
Practise SC-200 questions linked to SC-200 fundamentals.
Practise SC-200 questions linked to SC-200 scenario.
Practise SC-200 questions linked to SC-200 troubleshooting.
Practice directory
Every practice set is a unique selection of questions — numbered tests, domain-focused sessions, and topic-specific quizzes.
Showing 30 of 91 tests. See all 91 SC-200 practice tests →
Timed mode
Official blueprint
Target weak areas by practising questions from a single domain. Each domain page shows all questions, difficulty breakdown, and a focused practice session.
Practise SC-200 questions in this domain →
Practise SC-200 questions in this domain →
Practise SC-200 questions in this domain →
Practise SC-200 questions in this domain →
Practise SC-200 questions in this domain →
Practise SC-200 questions in this domain →
Term reference
These terms appear frequently in SC-200 questions. Understanding them precisely reduces guessing and improves scores.
Unauthenticated scan
An unauthenticated scan is a vulnerability assessment performed without providing valid login credentials, simulating an outside attacker's perspective.
SSO
Single Sign-On (SSO) is an authentication process that allows a user to access multiple applications or systems with one set of login credentials.
Free study guide
The Courseiva SC-200 study guide covers exam format, the official domain blueprint with weights, a structured study plan, and domain-specific tips for each section. Use it alongside practice questions to build both conceptual depth and exam confidence.
Sample questions
Select your answer before revealing the explanation. These questions are original exam-style — not copied from any exam or dump site.
Trap 1: Run antivirus scan
This scans for malware but does not isolate the device from the network.
Trap 2: Contain device
Containment restricts the device's ability to communicate with other devices but does not support a custom list of allowed IPs like full isolation.
Trap 3: Restrict app execution
This allows only a set of applications to run but does not control network connectivity.
Run antivirus scan
Why wrong: This scans for malware but does not isolate the device from the network.
Isolate device
Correct: Isolation can be configured with an allowed list of IPs, such as update servers, while blocking all other traffic.
Contain device
Why wrong: Containment restricts the device's ability to communicate with other devices but does not support a custom list of allowed IPs like full isolation.
Restrict app execution
Why wrong: This allows only a set of applications to run but does not control network connectivity.
Trap 1: Clone Sentinel notebooks → Provision compute → Connect to workspace…
Cloning before provisioning compute may cause issues as the compute environment is needed to run the notebook.
Trap 2: Connect to workspace → Provision compute → Clone Sentinel notebooks…
Connecting to workspace before provisioning compute is not possible because the compute instance is required.
Trap 3: Provision compute → Connect to workspace → Clone Sentinel notebooks…
Cloning notebooks before connecting to workspace is acceptable, but connecting before cloning is not required; however, cloning after connect is still functional, but the recommended order is clone before connect. Option A is the most accurate.
Provision compute → Clone Sentinel notebooks → Connect to workspace → Execute cells
This order follows the recommended setup: compute first, then notebooks, then workspace connection, then execution.
Clone Sentinel notebooks → Provision compute → Connect to workspace → Execute cells
Why wrong: Cloning before provisioning compute may cause issues as the compute environment is needed to run the notebook.
Connect to workspace → Provision compute → Clone Sentinel notebooks → Execute cells
Why wrong: Connecting to workspace before provisioning compute is not possible because the compute instance is required.
Provision compute → Connect to workspace → Clone Sentinel notebooks → Execute cells
Why wrong: Cloning notebooks before connecting to workspace is acceptable, but connecting before cloning is not required; however, cloning after connect is still functional, but the recommended order is clone before connect. Option A is the most accurate.
Trap 1: Defender for Servers
Defender for Servers protects VMs but not specifically SQL databases.
Trap 2: Defender for Databases
This is not an official plan name; the correct plan is Defender for SQL.
Trap 3: Defender for Storage
Defender for Storage protects Azure Storage accounts, not SQL workloads.
Defender for Servers
Why wrong: Defender for Servers protects VMs but not specifically SQL databases.
Defender for SQL
Defender for SQL provides threat detection for SQL Server workloads including on-premises and Azure SQL Database.
Defender for Databases
Why wrong: This is not an official plan name; the correct plan is Defender for SQL.
Defender for Storage
Why wrong: Defender for Storage protects Azure Storage accounts, not SQL workloads.
Trap 1: Microsoft Secure Score.
Secure Score measures security posture, not individual phishing campaign investigation.
Trap 2: Azure Activity log.
Azure Activity records Azure control-plane operations, not email campaign details.
Trap 3: Microsoft Defender Vulnerability Management software inventory.
Software inventory is endpoint-focused, not email investigation.
Threat Explorer.
Threat Explorer is designed for email threat investigation and remediation.
Microsoft Secure Score.
Why wrong: Secure Score measures security posture, not individual phishing campaign investigation.
Azure Activity log.
Why wrong: Azure Activity records Azure control-plane operations, not email campaign details.
Microsoft Defender Vulnerability Management software inventory.
Why wrong: Software inventory is endpoint-focused, not email investigation.
Trap 1: Security policies
Security policies set overall compliance standards but do not enforce configurations inside VMs themselves.
Trap 2: Just-In-Time VM access
Just-In-Time VM access controls network access to VMs, not internal configuration.
Trap 3: Adaptive application controls
Adaptive application controls recommend allowed applications to run on VMs, not general security baselines.
Security policies
Why wrong: Security policies set overall compliance standards but do not enforce configurations inside VMs themselves.
Azure Policy Guest Configuration
Correct: Guest Configuration can audit and deploy configurations inside VMs, automating baseline enforcement.
Just-In-Time VM access
Why wrong: Just-In-Time VM access controls network access to VMs, not internal configuration.
Adaptive application controls
Why wrong: Adaptive application controls recommend allowed applications to run on VMs, not general security baselines.
Trap 1: Just-In-Time VM access
JIT controls network access to VMs, not deployment of missing resource settings.
Trap 2: Adaptive network hardening
Adaptive network hardening provides recommendations for tightening NSG rules, not automatic deployment of baseline configurations.
Trap 3: File integrity monitoring
File integrity monitoring tracks changes to files on VMs, not resource compliance.
Azure Policy's DeployIfNotExists effect
Correct: DeployIfNotExists automatically deploys required configurations when a resource is non-compliant, enabling auto-remediation.
Just-In-Time VM access
Why wrong: JIT controls network access to VMs, not deployment of missing resource settings.
Adaptive network hardening
Why wrong: Adaptive network hardening provides recommendations for tightening NSG rules, not automatic deployment of baseline configurations.
File integrity monitoring
Why wrong: File integrity monitoring tracks changes to files on VMs, not resource compliance.
Official booking and top-rated study resources for the SC-200.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.