SC-200 Practice Questions

Question 1

Match each Microsoft Sentinel data connector on the left with the table name it populates on the right.

Accepted Answer

Microsoft Entra ID → SigninLogs; Windows Security Events via AMA → SecurityEvent; Cisco ASA via Syslog → CommonSecurityLog; Azure Activity → AzureActivity. It accurately maps each Microsoft Sentinel data connector to its corresponding log table. Microsoft Entra ID populates the SigninLogs table, Windows Security Events via AMA populates the SecurityEvent table, Cisco ASA via Syslog populates the CommonSecurityLog table (which is the standard schema for syslog-based security appliances), and Azure Activity populates the AzureActivity table. These mappings are defined by the data connectors themselves and are fundamental to querying the correct data in Sentinel.

Answer

The first and last mappings are swapped.

Answer

Every item maps to the same log table or feature category.

Answer

Only identity-related items are mapped; workload and network items are omitted.

Question 2

A security analyst is investigating a suspicious process on an endpoint and needs to see all network connections initiated by that process. The analyst knows the ProcessId and DeviceName. Which advanced hunting table in Microsoft 365 Defender should the analyst query to retrieve network connection details associated with this process?

Accepted Answer

DeviceNetworkEvents. The DeviceNetworkEvents table in Microsoft 365 Defender is specifically designed to capture network connection events, including source and destination IP addresses, ports, protocols, and the initiating process ID (ProcessId). By querying this table with the known ProcessId and DeviceName, the analyst can retrieve all network connections initiated by that process, making it the correct choice for this investigation.

Answer

DeviceProcessEvents

Answer

DeviceEvents

Answer

IdentityLogonEvents

Question 3

A SOC team wants to use Microsoft Sentinel to detect when a user logs in from a new country not previously seen for that user. They have the SigninLogs table. Which KQL function is most appropriate to build this anomaly detection?

Accepted Answer

make_set() with lookup. The `make_set()` function creates a dynamic array of distinct values (e.g., countries) per user over a specified time window. By using `lookup` to compare the current sign-in's country against the historical set, you can flag logins from countries not previously seen. This directly implements the 'new country' anomaly detection pattern in KQL.

Answer

timechart()

Answer

dcount()

Answer

startofday()

Question 4

Your security team uses Microsoft Defender XDR (formerly Microsoft 365 Defender) to investigate incidents. You notice that some alerts from Microsoft Defender for Endpoint are not being automatically correlated into incidents as expected. You have confirmed that the relevant alert sources are enabled in the Microsoft Defender XDR portal. What is the most likely cause?

Accepted Answer

Incident correlation rules are not enabled for the relevant alert sources.. Microsoft Defender XDR uses built-in correlation logic to automatically group related alerts from different sources (e.g., Defender for Endpoint, Defender for Office 365) into incidents. If alerts from a specific source, such as Defender for Endpoint, are not being correlated, the most likely cause is that the incident correlation rules for that source are not enabled in the Microsoft Defender XDR portal. Enabling the alert source alone is insufficient; the correlation engine must be explicitly activated for each source to aggregate alerts into incidents.

Answer

Alert tuning rules are causing the alerts to be excluded.

Answer

Automation rules in Microsoft Sentinel are deleting the alerts.

Answer

Alert suppression rules are blocking the alerts.

Question 5

You are investigating an incident where a user reported receiving a suspicious email with a malicious attachment. Microsoft Defender for Office 365 did not block it. The email originated from a known malicious sender domain. What configuration should you check first?

Accepted Answer

Anti-phishing policy in Microsoft Defender for Office 365. The anti-phishing policy in Microsoft Defender for Office 365 is the primary configuration that evaluates sender reputation, impersonation attempts, and spoof intelligence. Since the email originated from a known malicious sender domain and was not blocked, the anti-phishing policy's spoof settings or impersonation protection may be misconfigured or not applied to the affected user. This policy directly controls how Defender handles emails from malicious domains, making it the first place to check.

Answer

User-reported message settings

Answer

SPF record for the sender domain

Answer

Safe Attachments policy

Question 6

A security analyst is investigating a phishing campaign using Microsoft 365 Defender advanced hunting. The analyst needs to find all emails sent from a specific sender address in the last 7 days. Which table should be queried?

Accepted Answer

EmailEvents. The EmailEvents table in Microsoft 365 Defender advanced hunting stores metadata about email messages, including sender addresses, recipients, timestamps, and delivery actions. To find all emails from a specific sender in the last 7 days, you query EmailEvents because it contains the 'SenderFromAddress' or 'SenderMailFromAddress' fields needed to filter by sender. The other tables focus on attachments, URLs, or device-level events, which are not relevant for identifying emails by sender address.

Answer

EmailAttachmentInfo

Answer

EmailUrlInfo

Answer

DeviceEvents

Question 7

You are configuring Microsoft Sentinel to ingest logs from Azure Active Directory (now Microsoft Entra ID). Which of the following connectors should you use to collect sign-in logs and audit logs?

Accepted Answer

Microsoft Entra ID connector.. The Microsoft Entra ID connector (formerly Azure AD connector) is the correct choice because it is specifically designed to ingest sign-in logs, audit logs, and provisioning logs from Microsoft Entra ID into Microsoft Sentinel. This connector uses the Microsoft Graph API to pull these logs, enabling security monitoring of user authentication and administrative activities.

Answer

Microsoft Defender for Cloud connector.

Answer

Office 365 connector.

Answer

Azure Activity connector.

Question 8

Your SOC uses Microsoft Sentinel and Microsoft Defender for Cloud Apps. You need to configure a policy that triggers when a user downloads a large number of files from SharePoint Online within a short period. Which policy type should you use?

Accepted Answer

Activity policy. An activity policy in Microsoft Defender for Cloud Apps is designed to monitor and respond to specific user activities, such as downloading a large number of files from SharePoint Online within a short period. This policy type allows you to set thresholds and triggers based on user actions, making it the correct choice for detecting anomalous download behavior.

Answer

Session policy

Answer

File policy

Answer

Anomaly detection policy

Question 9

Your organization uses Microsoft Sentinel. An incident is created for a possible data exfiltration via an unapproved external IP address. Which type of Microsoft Sentinel automation should you use to automatically block the IP address in the firewall?

Accepted Answer

Playbook.. Playbooks in Microsoft Sentinel are automated workflows based on Azure Logic Apps that can perform response actions, such as blocking an IP address in a firewall. When an incident indicates data exfiltration via an unapproved external IP, a playbook can be triggered automatically or manually to execute the block action via integration with firewall APIs or management tools.

Answer

Data connector.

Answer

Analytics rule.

Answer

Watchlist.

Question 10

Which TWO features are available in Microsoft Sentinel to automate incident response?

Accepted Answer

Playbooks based on Azure Logic Apps.. Playbooks based on Azure Logic Apps are correct because they provide a native, low-code automation framework within Microsoft Sentinel. They allow security analysts to define and execute complex, multi-step response actions—such as isolating a compromised VM, blocking an IP address, or opening a ticket—triggered by alerts or incidents. This directly automates incident response workflows without manual intervention.

Answer

Workbooks.

Answer

Kusto Query Language (KQL) queries.

Answer

UEBA.

Question 11

Your organization uses Microsoft Sentinel and Microsoft Defender for Cloud Apps to monitor cloud application usage. You have a custom analytics rule that detects multiple failed login attempts from different IP addresses for the same user within 5 minutes. This rule generates an incident. The security team wants to automatically suspend the user in Microsoft Entra ID (formerly Azure AD) when such an incident is created, but only if the user is not a member of the 'Emergency Access' group. You need to implement this automation. You have already created the analytics rule. What should you do next?

Accepted Answer

Create a playbook that uses the Microsoft Entra ID connector to check if the user is a member of the 'Emergency Access' group. If not, suspend the user. Then create an automation rule that runs this playbook on incident creation.. A playbook can check group membership and take action. Option A is wrong because automation rules cannot conditionally run playbooks based on group membership. Option B is wrong because modifying the analytics rule is not the way to add automation. Option C is wrong because automation rules cannot directly suspend users.

Answer

Modify the analytics rule to include a condition that checks the user's group membership using KQL.

Answer

Create an automation rule that suspends the user directly using a condition on the incident.

Answer

Create an automation rule that triggers on incident creation and runs a playbook that suspends the user.

Question 12

Your organization uses Microsoft Sentinel for security operations. You need to ensure that critical alerts are automatically assigned to the appropriate SOC tier for investigation. What should you configure in Microsoft Sentinel?

Accepted Answer

Create an automation rule that sets the incident owner. Automation rules in Microsoft Sentinel allow you to automatically assign incidents to specific owners based on conditions like severity or alert type. This ensures critical alerts are routed to the appropriate SOC tier without manual intervention, directly meeting the requirement.

Answer

Create a playbook that assigns the incident to a user

Answer

Use a watchlist to map alert types to owners

Answer

Configure an analytics rule to set the owner

Question 13

Which THREE steps are part of the containment phase of incident response in Microsoft Sentinel? (Select THREE.)

Accepted Answer

Disable compromised user accounts in Microsoft Entra ID.. Disabling compromised user accounts in Microsoft Entra ID is a containment step because it immediately revokes the account's access tokens and prevents further authentication, stopping an attacker from using that identity to move laterally or access resources. This aligns with the containment phase's goal of limiting the blast radius of an incident.

Answer

Collect forensic data from affected endpoints.

Answer

Restore encrypted files from backup.

Question 14

Which THREE actions can be performed by automation rules in Microsoft Sentinel?

Accepted Answer

Assign an incident to a specific owner. Automation rules in Microsoft Sentinel can automatically assign incidents to specific owners based on conditions such as severity, entity type, or custom criteria. This action helps streamline incident response by ensuring the right personnel are notified and responsible for handling the incident without manual intervention.

Answer

Modify a data connector to ingest more logs

Answer

Create a new analytics rule

Question 15

Your SOC team uses Microsoft Sentinel with multiple workspaces across regions. You need to implement a solution that allows analysts to query all workspaces from a single location without moving data. Which feature should you configure?

Accepted Answer

Use cross-workspace queries with workspace() expressions in KQL.. Cross-workspace queries using the `workspace()` expression in KQL allow analysts to query multiple Log Analytics workspaces from a single query context without moving or centralizing the data. This is the native Microsoft Sentinel feature designed for multi-workspace environments, enabling seamless querying across regions while keeping data in its original workspace.

Answer

Export data to Azure Data Explorer and query there.

Answer

Create a single Log Analytics workspace and have all data sources send logs there.

Answer

Configure Azure Lighthouse to manage all workspaces.

Microsoft Security Operations Analyst SC-200 practice test

Three ways to study

Study SC-200 by domain

Study SC-200 by topic

Manage a security operations environment practice questions

Respond to security incidents practice questions

Perform threat hunting practice questions

SC-200 fundamentals practice questions

SC-200 scenario practice questions

SC-200 troubleshooting practice questions

Top SC-200 questions

Microsoft Security Operations Analyst SC-200 practice questions

How to use these SC-200 questions

Quick answer