Microsoft · Free Practice Questions · Last reviewed May 2026
18real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
41% of exam · 6 sample questions below
Your SOC team needs to ensure that all high-severity Microsoft Sentinel incidents are automatically assigned to the senior analyst on call. The team uses Microsoft Teams for communication. Which configuration should you implement?
Configure an analytics rule to set the incident owner to the senior analyst and enable Teams integration in Sentinel settings.
Create a playbook that reassigns incidents and posts to Teams, and attach it to an automation rule triggered by high-severity incidents.
Create a workbook that filters high-severity incidents and configure a Teams webhook in the workbook settings.
Create an automation rule that runs when an incident is created with severity High, sets the owner to the senior analyst, and then runs a playbook to post a message to Teams.
Automation rules can assign owners and trigger playbooks that post to Teams.
You are a security analyst at a company that uses Microsoft 365 Defender. You receive an automated email indicating that a user has been flagged for possible credential theft. The email includes a link to investigate the alert in the Microsoft 365 Defender portal. Which role is responsible for sending this email?
A mail flow rule in Exchange Online configured to forward alerts.
Microsoft 365 Defender email notification settings.
Microsoft 365 Defender can send email alerts for incidents and alerts.
Microsoft Defender for Cloud Apps notification settings.
A Microsoft Sentinel analytics rule configured to send email notifications.
Your organization uses Microsoft Sentinel and Microsoft Defender for Office 365. You have configured incident creation from Microsoft Defender for Office 365 alerts in Microsoft Sentinel. However, you notice that some alerts are not creating incidents. Which step should you take to troubleshoot this issue?
Examine the analytics rule that creates incidents from Microsoft Defender for Office 365 alerts and verify the severity threshold.
The analytics rule filters alerts; a severity threshold may be too high.
Check the Microsoft 365 Defender portal to confirm that the alerts are being generated.
Review the Microsoft Sentinel workbooks for any visualization errors.
Verify that the Microsoft Defender for Office 365 data connector in Microsoft Sentinel is connected and data is ingested.
Your organization is implementing Microsoft Sentinel. You need to design a solution to automatically disable a user account in Microsoft Entra ID when a high-severity incident is triggered in Microsoft Sentinel related to that user. Which component should you use?
A playbook that uses the Microsoft Graph API to disable the user.
Playbooks can automate response actions like disabling a user.
An analytics rule that includes a query to disable the user.
An automation rule that runs a PowerShell script on a hybrid worker.
A workbook that triggers a webhook to disable the user.
Your company uses Microsoft Defender for Cloud to monitor multi-cloud resources. You want to ensure that all critical security recommendations are automatically assigned to the appropriate team leads based on the resource's tags. Which feature should you configure?
Configure a regulatory compliance standard to send email notifications.
Create a workbook that lists recommendations and manually assign them.
Use the 'Assign ownership' feature in Microsoft Defender for Cloud to map tags to owners.
This feature assigns recommendations to owners based on tags.
Create a governance rule that automatically applies a compliance standard.
Your SOC uses Microsoft Sentinel and Microsoft Defender for Cloud Apps. You need to configure a policy that triggers when a user downloads a large number of files from SharePoint Online within a short period. Which policy type should you use?
Session policy
File policy
Anomaly detection policy
Activity policy
Activity policies allow custom detection of specific activities like mass downloads.
Want more Manage a security operations environment practice?
Practice this domain37% of exam · 6 sample questions below
You are investigating a security incident in Microsoft Sentinel where a user received a phishing email containing a link to a malicious domain. The link was clicked, but no further actions were observed. Which playbook action should you take immediately to prevent potential lateral movement?
Disable the user's account
Revoke the user's active sessions
Reset the user's password
Block the malicious domain on the firewall
Blocking the domain prevents further access to the malicious site, containing the threat.
During a ransomware incident, Microsoft Defender for Cloud Apps alerts indicate that a user is uploading large volumes of data to an external cloud storage provider not approved by your organization. Which two actions should you take first? (Choose two.)
Block the unapproved cloud storage app
Blocking the app prevents further uploads.
Suspend the user's account
Suspending the account stops the user from accessing resources.
Notify the user about the policy violation
Initiate a legal hold on the user's data
Your security team uses Microsoft Sentinel analytics rules to detect brute-force attacks. A rule triggers when more than 10 failed logins occur within 5 minutes from a single IP. An incident is generated. Which first step should the analyst take?
Block the source IP address on the firewall
Investigate the incident details
Investigation confirms the attack and provides context.
Notify the users of the failed login attempts
Reset passwords for all affected accounts
An incident in Microsoft Defender XDR involves a device that is suspected to be infected with ransomware. The device is online and actively encrypting files. Which action should you take to contain the threat?
Isolate the device from the network
Isolation prevents further spread and encryption.
Disable the user's account
Run a full antivirus scan on the device
Collect a memory dump from the device
Your organization uses Microsoft Sentinel with UEBA (User and Entity Behavior Analytics). An alert indicates a user's sign-in from an unusual location, followed by a mass download of sensitive files from SharePoint. The user is a low-privilege employee. What is the most likely conclusion?
The user's account is compromised
Unusual location and anomalous data access strongly indicate compromise.
The alert is a false positive due to user travel
The user is an insider threat
The user is conducting a ransomware attack
In Microsoft Sentinel, an incident is created from a Fusion rule that correlates multiple alerts. The incident has a high severity. What should the analyst do first?
Run an automated playbook to contain the threat
Close the incident as false positive
Triage the incident by reviewing the evidence
Triage confirms the validity and urgency.
Escalate the incident to senior management
Want more Respond to security incidents practice?
Practice this domain22% of exam · 6 sample questions below
A security analyst is using KQL in Microsoft Sentinel to hunt for potential data exfiltration by a user who has been sending unusually large amounts of data to an external IP address. Which KQL operator should the analyst use to identify the top source IP addresses and total bytes sent over the last 7 days?
... | where SentBytes > 1000000 | project SourceIP, SentBytes
... | extend TotalBytes=SentBytes | summarize count() by SourceIP
... | project SourceIP, SentBytes | sort by SentBytes desc
... | summarize TotalBytes=sum(SentBytes) by SourceIP | top 10 by TotalBytes desc
Correctly uses summarize with sum and top to find top source IPs by total sent bytes.
A security team uses Microsoft Sentinel to hunt for signs of credential theft. They want to detect when a user account has been used to log in from an unusual location and then immediately performs a password reset for another user. Which hunting approach is most effective for this scenario?
Use a Microsoft Sentinel playbook to automatically flag any password reset
Write a KQL query that joins SigninLogs with AuditLogs on user principal name and times within a short window
This correlates the two events to detect the sequence of unusual login followed by password reset.
Search the SigninLogs table for logins from unusual locations
Create a watchlist of known unusual locations and use it in a query against AuditLogs
A threat hunter is investigating a potential malware outbreak in Microsoft Defender for Cloud Apps. The hunter notices that multiple users have installed a new app with high permissions that accesses their email. The app was not requested by IT. What is the most effective way to hunt for all instances of this app across the organization?
Review Conditional Access app control policies for any block rules
Check Microsoft 365 Defender alerts for malicious OAuth apps
Query the Microsoft 365 Defender advanced hunting table 'CloudAppEvents' for app installation events and then use 'AppGovernance' to list all apps
Use the Cloud App Security activity log to search for 'Install app' events and then review the 'App governance' dashboard for all instances
This allows hunting for the app installations and then investigating all instances via app governance.
A threat hunter is using Microsoft Sentinel to hunt for a potential advanced persistent threat (APT) that is using living-off-the-land binaries (LOLBins). The hunter creates a KQL query that lists all instances of certutil.exe making network connections. The query returns many legitimate results. What is the best way to reduce false positives while still detecting malicious use?
Replace the query with a Sysmon Event ID 3 (network connect) filter for certutil.exe
Remove certutil.exe from the hunting query and focus on other binaries
Expand the query to include all LOLBins that make network connections
Add additional filters to the query to detect only certutil.exe processes with suspicious command-line arguments (e.g., '-urlcache' or '-split')
Focusing on suspicious arguments reduces false positives because legitimate use typically does not involve these flags.
Your threat hunt aims to detect possible Kerberoasting attacks. Which KQL query in Microsoft Sentinel would best identify service principal name (SPN) requests from unusual accounts?
SecurityEvent | where EventID == 4768 | summarize count() by Account | where count_ > 10
SecurityEvent | where EventID == 4769 | summarize count() by Account
let knownAccounts = dynamic(['svc_sql', 'svc_adfs']); SecurityEvent | where EventID == 4768 | where Account !in (knownAccounts) | summarize cnt=count() by Account, IpAddress | where cnt > 5
This identifies unusual accounts with high TGT requests by excluding known service accounts.
SecurityEvent | where EventID == 4773 | summarize count() by Account
You are threat hunting for signs of credential dumping via LSASS access. Which Advanced Hunting schema table in Microsoft Defender XDR should you primarily query to find processes that opened a handle to LSASS?
DeviceProcessEvents
DeviceEvents
DeviceEvents includes LSASS access events (ActionType: 'LsassAccessedByProcess').
DeviceNetworkEvents
DeviceRegistryEvents
Want more Perform threat hunting practice?
Practice this domainThe SC-200 exam has 50 questions and must be completed in 120 minutes. The passing score is 700/1000.
Security operations scenario questions covering Microsoft Sentinel, Defender XDR, Defender for Cloud, and incident investigation and response.
The exam covers 3 domains: Manage a security operations environment, Respond to security incidents, Perform threat hunting. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official Microsoft SC-200 exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.