How many Refer to the Exhibit Practice Questions questions are on this page?

This page has 5 Refer to the Exhibit Practice Questions scenario questions for the SC-200 exam, each with detailed explanations and wrong-answer analysis.

How should I approach SC-200 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Microsoft Security Operations Analyst SC-200 questions

Scenario-based practice

Refer to the Exhibit Practice Questions

Practise Microsoft Security Operations Analyst SC-200 practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

SC-200

exam code

Microsoft

vendor

Scenario guide

How to approach refer to the exhibit practice questions

Practise exhibit-style questions that ask you to read a topology, table, command output or diagram before choosing the best answer.

Quick answer

Exhibit-style questions test whether you can read a topology, command output, diagram or table before choosing the best answer.

How to extract the relevant detail from an exhibit.

How topology, command output or routing information affects the answer.

How to avoid answering from memory before reading the evidence.

How to map the exhibit back to the exam objective.

Practice scenarios

Question 1easymultiple choice

Full question →

Refer to the exhibit. You are reviewing an alert in Microsoft Defender for Endpoint. The alert details are shown. Which of the following actions should you take first?

Exhibit

Refer to the exhibit.
```
DeviceName: DESKTOP-ABC123
AlertTime: 2025-03-01T14:32:00Z
AlertTitle: Malware detected
Severity: High
Status: Active
```

A
Investigate the device and the alert details
Investigation is the first step.
B
Mark the alert as a false positive
Why wrong: False positive requires investigation first.
C
Initiate device isolation to contain the threat
Why wrong: Isolation should follow investigation.
D
Run a full antivirus scan on the device
Why wrong: Scan is a later step.

Full breakdown with real-world context →

Question 2hardmultiple choice

Full question →

Refer to the exhibit. You are analyzing a KQL query for a Microsoft Sentinel scheduled rule. The query is intended to detect devices that have both a high number of process executions and network connections to a single IP within an hour. However, the query returns no results even though there are devices meeting the criteria. What is the most likely cause?

Exhibit

Refer to the exhibit.

```kusto
// KQL query in Microsoft Sentinel
let threshold = 10;
DeviceProcessEvents
| where Timestamp > ago(1h)
| summarize ProcessCount = count() by DeviceName, InitiatingProcessFileName
| where ProcessCount > threshold
| join kind=inner (DeviceNetworkEvents
| where Timestamp > ago(1h)
| summarize NetworkCount = count() by DeviceName, RemoteIP
| where NetworkCount > threshold
) on DeviceName
| project DeviceName, InitiatingProcessFileName, RemoteIP, ProcessCount, NetworkCount
```

A
The threshold variable is not used correctly
Why wrong: The threshold is used correctly to filter.
B
The join condition does not include a time window, causing mismatches
Without a time window, the join may not align events from the same time period.
C
The DeviceProcessEvents and DeviceNetworkEvents tables are from different data sources
Why wrong: Both are from Microsoft Defender for Endpoint and are compatible.
D
The summarize function cannot count process executions
Why wrong: Summarize count() is valid.

Full breakdown with real-world context →

Question 3mediummultiple choice

Full question →

Refer to the exhibit. You have created a scheduled analytics rule in Microsoft Sentinel as shown. The rule is not generating any incidents, even though you know Copilot for Microsoft 365 is accessing sensitive files. What is the most likely cause?

Exhibit

Refer to the exhibit.

```json
{
  "properties": {
    "displayName": "Sensitive Data Access Alert",
    "severity": "Medium",
    "query": "OfficeActivity | where Operation == 'FileAccessed' and UserAgent contains 'Microsoft.Copilot' | project TimeGenerated, UserId, FileName",
    "queryFrequency": "PT1H",
    "queryPeriod": "PT1H",
    "triggerOperator": "GreaterThan",
    "triggerThreshold": 5
  }
}
```

A
The triggerThreshold is too high
Why wrong: Threshold might be fine, but data is missing.
B
The table being queried does not contain Copilot events
Copilot events are in CloudAppEvents.
C
The severity is set to Medium, which suppresses incidents
Why wrong: Severity does not suppress incidents.
D
The queryFrequency is too short
Why wrong: Frequency is reasonable; the issue is the data source.

Full breakdown with real-world context →

Question 4hardmultiple choice

Full question →

You are a security analyst for a company that uses Azure Firewall. You are reviewing a custom rule deployed via Azure Firewall Manager. The exhibit shows the rule configuration. The rule is intended to block inbound traffic from known Tor exit nodes. However, a recent incident involved an attacker using a Tor exit node with IP 138.197.5.5 to access an internal web server on port 8080. The log shows the traffic was ALLOWED. What is the most likely reason the rule did not block the traffic?

Exhibit

Refer to the exhibit.

```json
{
  "properties": {
    "displayName": "Block Tor IPs",
    "description": "Blocks traffic from known Tor exit nodes.",
    "ruleType": "Prevention",
    "action": "Block",
    "priority": 100,
    "sourceAddress": ["138.197.0.0/16", "104.131.0.0/16"],
    "destinationAddress": ["*"],
    "sourcePorts": ["*"],
    "destinationPorts": ["443", "80"],
    "protocol": "TCP",
    "direction": "Inbound"
  }
}
```

A
The destination port 8080 is not listed in the rule.
The application rule's destination port list is the crux: it only specifies 443 (HTTPS) and 80 (HTTP), so any outbound connection to port 8080 does not match the rule's conditions, even when the destination FQDN or IP is otherwise covered. A matching source and destination are not enough; for an Azure Firewall application rule to apply, the protocol:port must also be present in the rule. Because 8080 is absent, the traffic bypasses this deny action, which explains why the connection was allowed.
B
The source address range does not include 138.197.5.5.
Why wrong: The source IP 138.197.5.5 is within the CIDR range 138.197.0.0/16, which encompasses all addresses from 138.197.0.0 through 138.197.255.255. Therefore the source IP condition is satisfied, not violated, so this explanation for the failure is incorrect. The problem must instead be found in the destination port or another rule property.
C
The rule type is 'Prevention' but should be 'Detection'.
Why wrong: In Azure Firewall, a rule collection action that says 'Prevention' corresponds to a Deny action that actively drops or blocks matching traffic, whereas 'Detection' only produces an alert/log entry without interrupting the connection. For a blocking rule, Prevention is the appropriate and correct action, and changing it to Detection would guarantee the traffic is allowed, not blocked. Thus the rule type as described is not the cause of the issue.
D
The rule priority is too low and is overridden by a higher priority rule.
Why wrong: Rule priority in Azure Firewall uses a lower numeric value to mean higher precedence: priority 100 is evaluated very early, not suppressed by most other rules, and it is only bypassed if a numerically lower (higher-priority) rule matches the traffic and explicitly allows or denies it. Since no such matching higher-priority rule is described, the deny rule is not overridden, and priority 100 cannot explain the failure. The real gap is the missing port 8080 in the destination list.

Full breakdown with real-world context →

Question 5easymultiple choice

Full question →

Refer to the exhibit. An admin creates this activity policy in Microsoft Defender for Cloud Apps. What will happen when a user fails to log in from 3 different IP addresses within 10 minutes?

Exhibit

Refer to the exhibit.
```json
// Microsoft Defender for Cloud Apps policy snippet
{
  "policyType": "Activity policy",
  "severity": "High",
  "description": "Detect multiple failed logins from different IPs",
  "filters": {
    "activity": "Failed login",
    "ip": {
      "differentCount": 3,
      "timeWindow": 10
    }
  },
  "actions": [
    {
      "type": "Block",
      "target": "User"
    }
  ]
}
```

A
The policy will generate an alert but not block the user.
Why wrong: The actions include 'Block', so it will block.
B
The user will be blocked immediately after the third failed login from any IP.
Why wrong: The condition is based on different IPs, not total attempts. If all attempts are from the same IP, it won't trigger.
C
The user will be blocked after 10 minutes regardless of the number of IPs.
Why wrong: The time window is 10 minutes, but the condition requires 3 different IPs within that window.
D
The user will be blocked only if the third IP is different from the first two.
The policy requires 3 distinct IP addresses; after the third distinct IP, the user is blocked.

Full breakdown with real-world context →

These SC-200 practice questions are part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style SC-200 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Refer to the Exhibit Practice Questions

How to approach refer to the exhibit practice questions

Quick answer

Related SC-200 topic practice pages

Manage a security operations environment practice questions

Respond to security incidents practice questions

Perform threat hunting practice questions

SC-200 fundamentals practice questions

SC-200 scenario practice questions

SC-200 troubleshooting practice questions

Practice scenarios

Refer to the exhibit. You are reviewing an alert in Microsoft Defender for Endpoint. The alert details are shown. Which of the following actions should you take first?

Exhibit

Exhibit

Refer to the exhibit. You have created a scheduled analytics rule in Microsoft Sentinel as shown. The rule is not generating any incidents, even though you know Copilot for Microsoft 365 is accessing sensitive files. What is the most likely cause?

Exhibit

Exhibit

Refer to the exhibit. An admin creates this activity policy in Microsoft Defender for Cloud Apps. What will happen when a user fails to log in from 3 different IP addresses within 10 minutes?

Exhibit