Microsoft · Free Practice Questions · Last reviewed May 2026
18real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
41% of exam · 6 sample questions below
Your organization is implementing Microsoft Sentinel. You need to design a solution to automatically disable a user account in Microsoft Entra ID when a high-severity incident is triggered in Microsoft Sentinel related to that user. Which component should you use?
A playbook that uses the Microsoft Graph API to disable the user.
Playbooks can automate response actions like disabling a user.
An analytics rule that includes a query to disable the user.
An automation rule that runs a PowerShell script on a hybrid worker.
A workbook that triggers a webhook to disable the user.
Your SOC uses Microsoft Sentinel and Microsoft Defender for Cloud Apps. You need to configure a policy that triggers when a user downloads a large number of files from SharePoint Online within a short period. Which policy type should you use?
Session policy
File policy
Anomaly detection policy
Activity policy
Activity policies allow custom detection of specific activities like mass downloads.
Which TWO actions can be performed using automation rules in Microsoft Sentinel? (Select TWO.)
Create a new incident from an alert.
Modify the query of an existing analytics rule.
Assign an incident to a specific owner.
Assignment is a supported action in automation rules.
Delete an incident automatically.
Trigger a playbook when an incident is created.
Automation rules can trigger playbooks as an action.
Your SOC team uses Microsoft Sentinel with multiple workspaces across regions. You need to implement a solution that allows analysts to query all workspaces from a single location without moving data. Which feature should you configure?
Use cross-workspace queries with workspace() expressions in KQL.
Cross-workspace queries allow querying multiple workspaces without moving data.
Export data to Azure Data Explorer and query there.
Create a single Log Analytics workspace and have all data sources send logs there.
Configure Azure Lighthouse to manage all workspaces.
Your Microsoft Sentinel environment is not generating incidents from a custom KQL detection rule. The rule runs successfully in the Log Analytics query editor but no incidents appear. What is the most likely cause?
The rule's alert grouping settings are misconfigured
The rule is set to create alerts but not incidents
Correct. The rule is set to create alerts but not incidents, meaning the 'Create incident' toggle is off. This is the most common reason for missing incidents despite successful query execution.
The rule's query schedule is too long
The rule does not have entity mapping configured
Refer to the exhibit. You are analyzing a KQL query for a Microsoft Sentinel scheduled rule. The query is intended to detect devices that have both a high number of process executions and network connections to a single IP within an hour. However, the query returns no results even though there are devices meeting the criteria. What is the most likely cause?
The threshold variable is not used correctly
The join condition does not include a time window, causing mismatches
Without a time window, the join may not align events from the same time period.
The DeviceProcessEvents and DeviceNetworkEvents tables are from different data sources
The summarize function cannot count process executions
Want more Manage a security operations environment practice?
Practice this domain37% of exam · 6 sample questions below
Which TWO Microsoft 365 Defender portals provide automated investigation and response capabilities? (Choose two.)
Microsoft Purview compliance portal
Microsoft Sentinel (portal.azure.com)
Microsoft Intune admin center
Microsoft Defender for Endpoint (security.microsoft.com)
Defender for Endpoint has automated investigation and response for endpoint threats.
Microsoft 365 Defender (security.microsoft.com)
Microsoft 365 Defender includes automated investigation and response for incidents.
Which Microsoft Sentinel feature allows you to automatically respond to incidents by running a playbook when an incident is created?
Analytics rules
Playbooks
Watchlists
Workbooks
Automation rules
Automation rules can trigger playbooks on incident creation.
Your organization uses Microsoft Sentinel. You receive an incident that involves a potential lateral movement detected by Microsoft Defender for Identity. You need to investigate the timeline of the attack. Which Microsoft Sentinel feature should you use?
Workbooks
Automation rules
Investigation graph
Visual timeline for investigation.
Analytics rules
Refer to the exhibit. You are reviewing an alert in Microsoft Defender for Endpoint. The alert details are shown. Which of the following actions should you take first?
Investigate the device and the alert details
Investigation is the first step.
Mark the alert as a false positive
Initiate device isolation to contain the threat
Run a full antivirus scan on the device
You are investigating an incident where a user reported receiving a suspicious email with a malicious attachment. Microsoft Defender for Office 365 did not block it. The email originated from a known malicious sender domain. What configuration should you check first?
User-reported message settings
SPF record for the sender domain
Safe Attachments policy
Anti-phishing policy in Microsoft Defender for Office 365
Anti-phishing policy in Microsoft Defender for Office 365 is the correct control because it provides domain impersonation protection and spoof intelligence that can identify and block messages from known malicious domains or those mimicking protected senders. It leverages threat intelligence and real-time reputation to enforce blocking, quarantine, or redirect to Junk before delivery to the user's inbox. This policy is specifically designed to combat phishing and impersonation, which aligns with the reported incident involving a suspicious email.
Your organization uses Microsoft Sentinel. A security analyst reports that an incident was automatically closed by a playbook before the investigation was complete. What should you do to prevent automatic closure in the future?
Disable the playbook
Remove the playbook from the automation rule
Modify the analytics rule to not automatically close incidents
This prevents the playbook from closing incidents automatically.
Disable the automation rule that triggers the playbook
Want more Respond to security incidents practice?
Practice this domain22% of exam · 6 sample questions below
A security team uses Microsoft Sentinel to hunt for signs of credential theft. They want to detect when a user account has been used to log in from an unusual location and then immediately performs a password reset for another user. Which hunting approach is most effective for this scenario?
Use a Microsoft Sentinel playbook to automatically flag any password reset
Write a KQL query that joins SigninLogs with AuditLogs on user principal name and times within a short window
This correlates the two events to detect the sequence of unusual login followed by password reset.
Search the SigninLogs table for logins from unusual locations
Create a watchlist of known unusual locations and use it in a query against AuditLogs
You are threat hunting for credential dumping activity. Which Windows event ID is commonly associated with the use of tools like Mimikatz?
4624 (Successful Logon)
4768 (Kerberos Authentication Ticket Request)
4688 (Process Creation)
Process creation events can show when Mimikatz or similar tools are launched.
4672 (Special Logon)
As a threat hunter, you want to proactively search for signs of privilege escalation using the 'AzureHound' tool within your Microsoft Sentinel environment. Which data source is most relevant to ingest to detect AzureHound usage?
Azure VM Insights logs
Azure Active Directory Audit Logs (now Microsoft Entra ID Audit Logs)
AzureHound queries Microsoft Graph, and audit logs capture those API calls.
Azure Storage analytics logs
Azure Network Watcher logs
Your organization uses Microsoft Sentinel with the Microsoft 365 Defender connector. You are hunting for a threat that uses 'process hollowing' to evade detection. Which advanced hunting query in Microsoft Defender for Endpoint would be most effective?
DeviceProcessEvents | where InitiatingProcessFileName != ImageFileName | where ParentProcessFileName != ImageFileName
Process hollowing typically involves a process where the original image is replaced; this query finds mismatches between initiating, parent, and image file names.
DeviceProcessEvents | where FileName in~ ('rundll32.exe', 'regsvr32.exe', 'mshta.exe')
DeviceFileEvents | where FileName contains 'hollow'
AlertInfo | where Title contains 'Process hollowing'
During a threat hunt, a security analyst uses Microsoft Sentinel and identifies a series of failed logon attempts from a single IP address targeting multiple user accounts. The analyst wants to create a scheduled analytics rule that generates an alert when the same IP address fails to logon to more than 10 different accounts within 5 minutes. Which KQL operator should be used to count distinct accounts per IP?
count()
summarize count() by Account
distinct Account
dcount(Account)
dcount provides an approximate distinct count of accounts, suitable for performance.
A threat hunter is investigating a potential data exfiltration incident. The hunter suspects that a user is using an unauthorized cloud storage service. Which Microsoft Defender for Cloud Apps signal would be most useful to detect this activity?
Cloud Discovery
Cloud Discovery identifies shadow IT and cloud app usage.
Microsoft Defender for Endpoint Web Protection
Microsoft Defender for Identity
Microsoft Defender for Office 365 Safe Links
Want more Perform threat hunting practice?
Practice this domainThe SC-200 exam has 50 questions and must be completed in 120 minutes. The passing score is 700/1000.
Security operations scenario questions covering Microsoft Sentinel, Defender XDR, Defender for Cloud, and incident investigation and response.
The exam covers 3 domains: Manage a security operations environment, Respond to security incidents, Perform threat hunting. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official Microsoft SC-200 exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.