SC-200 Security Operations Analyst Practice Questions with Explanations
Free SC-200 Microsoft Security Operations Analyst practice questions with an explanation for every answer. Covers Microsoft Sentinel, KQL queries, Microsoft Defender threat response, and incident investigation.
Questions
Where do you set up email notifications for new Microsoft Defender XDR incidents?
- Settings in the Microsoft Defender portal
- The Microsoft Entra admin center
- Data connectors in the Microsoft Purview portal
- Azure Policy assignments in the Azure portal
A benign IT script triggers the same Defender alert every day. What cuts the noise without turning off the detection everywhere?
- An alert tuning rule scoped to that script
- Turning off Microsoft Defender Antivirus on the affected devices
- Deleting the device group that the devices belong to
- Setting every device group to no automated response
A device matches the rules of two device groups in Defender for Endpoint. Which group does it join?
- The highest-ranked matching group
- Both groups at the same time
- The most recently created group
- The group that has the most devices in it
Devices that match no device group rules are placed in:
- Ungrouped devices (default)
- The Tier 0 device group
- A quarantine device group
- No group, so they aren't managed
Device groups in Defender for Endpoint are mainly used to:
- Set automation levels and scope analyst access
- Encrypt device disks with BitLocker on enrollment
- Assign Microsoft 365 licenses
- Join devices to Microsoft Entra ID
Which automation level remediates threats with no analyst approval?
- Full - remediate threats automatically
- Semi - require approval for any remediation
- Semi - require approval for core folders remediation
- No automated response
Which automation level does Microsoft recommend for most device groups?
- Full - remediate threats automatically
- Semi - require approval for non-temp folders
- No automated response
- Semi - require approval for any remediation
Where do analysts approve pending remediation actions from automated investigations?
- Action center
- Content hub
- Threat analytics
- Secure Score
Which attack surface reduction (ASR) rule mode logs what would have been blocked, without blocking it?
- Audit
- Block
- Warn
- Enforce
Which ASR rule mode blocks the action but lets the user choose to continue?
- Warn
- Audit
- Block
- Monitor
Which ASR rule helps stop Mimikatz-style credential theft?
- Block credential stealing from lsass.exe
- Block executable content from email and webmail
- Block Office applications from creating child processes
- Block untrusted, unsigned processes that run from USB
A Word macro launches PowerShell to download malware. Which ASR rule stops this?
- Block all Office applications from creating child processes
- Block credential stealing from lsass.exe
- Block persistence through WMI event subscriptions
- Block executable content from email clients and webmail sites
ASR rules require Microsoft Defender Antivirus to be:
- The primary antivirus, in active mode
- In passive mode alongside another antivirus
- Disabled so ASR can run alone
- Installed on domain controllers only
Which advanced feature must be on before analysts can open a remote shell on a device?
- Live Response
- Tamper protection
- Web content filtering
- Custom network indicators
Which setting stops an attacker from turning off Defender Antivirus on a device?
- Tamper protection
- Live Response
- Automated investigation
- Device discovery
Custom network indicators that block IPs and URLs require:
- Network protection in block mode
- Tamper protection in audit mode
- Live Response for unsigned scripts
- EDR in block mode on servers
When is EDR in block mode most useful?
- When a third-party AV is primary and Defender AV is passive
- When Defender Antivirus is already the active, primary antivirus
- When a device has no internet connection
- When ASR rules are set to Warn mode
Automatic attack disruption can automatically:
- Contain compromised devices and disable compromised users
- Delete all mailboxes in the tenant
- Reimage infected devices from a clean image automatically
- Change the tenant's default domain
What does automated investigation and response (AIR) do?
- Investigates alerts and remediates or recommends fixes
- Writes new analytics rules from Microsoft threat reports
- Moves raw logs into the data lake tier
- Builds workbooks for SOC managers
Which Microsoft Sentinel role lets an analyst manage incidents, such as assigning or closing them, but not create rules?
- Microsoft Sentinel Responder
- Microsoft Sentinel Reader
- Microsoft Sentinel Contributor
- Microsoft Sentinel Automation Contributor
Which Sentinel role lets a user create and edit analytics rules and workbooks?
- Microsoft Sentinel Contributor
- Microsoft Sentinel Responder
- Microsoft Sentinel Reader
- Microsoft Sentinel Playbook Operator
For automation rules to run playbooks, which role does Sentinel need on the playbooks' resource group?
- Microsoft Sentinel Automation Contributor
- Microsoft Sentinel Responder
- Logic App Contributor
- Security Reader
Which role lets an analyst run playbooks manually but not create them?
- Microsoft Sentinel Playbook Operator
- Logic App Contributor
- Microsoft Sentinel Contributor
- Microsoft Sentinel Automation Contributor
What role is needed to create or edit a Sentinel playbook?
- Logic App Contributor
- Microsoft Sentinel Reader
- Microsoft Sentinel Playbook Operator
- Microsoft Sentinel Responder
A SOC manager wants an interactive dashboard of failed sign-ins over time. What should you build in Sentinel?
- A workbook
- A playbook
- A watchlist
- An automation rule
How long is data retention included at no extra cost in a Sentinel-enabled workspace's analytics tier?
- 90 days
- 30 days
- 180 days
- 2 years
How far back can Defender XDR advanced hunting query raw event data?
- 30 days
- 7 days
- 90 days
- 1 year
Which Sentinel tier is built for low-cost, long-term storage queried by KQL jobs and notebooks?
- Data lake tier
- Analytics tier
- XDR tier
- Interactive tier
Which Sentinel tier supports real-time analytics rules and fast interactive queries?
- Analytics tier
- Data lake tier
- Archive tier
- Cold storage tier
SOC optimization in Microsoft Sentinel mainly provides:
- Recommendations to close coverage gaps and cut low-value data
- A list of analysts ranked by how fast they close their incidents
- Automatic deletion of tables nobody has queried
- A tool for buying more commitment-tier capacity
Which agent collects Windows and Linux logs into Sentinel today?
- Azure Monitor Agent (AMA)
- Log Analytics agent (MMA)
- Defender for Identity sensor
- Entra Connect Health agent
With the Azure Monitor Agent, what defines which events are collected and where they're sent?
- A data collection rule (DCR)
- An analytics rule
- An automation rule
- A device group
Windows Security Events collected through AMA land in which table?
- SecurityEvent
- WindowsEvent
- Syslog
- SigninLogs
In the Windows Security Events via AMA connector, which event set gives a standard audit trail without collecting everything?
- Common
- All events
- Minimal
- Verbose
Events collected from a Windows Event Forwarding (WEF) collector through AMA go to which table?
- WindowsEvent
- SecurityEvent
- Event
- CommonSecurityLog
CEF logs from a firewall appliance arrive in which Sentinel table?
- CommonSecurityLog
- Syslog
- SecurityEvent
- AzureDiagnostics
To collect CEF logs from network appliances that can't run an agent, you deploy:
- A Linux log forwarder running AMA
- A Windows Event Collector server
- A Defender for Identity sensor
- An Entra private network connector
Linux syslog collected through AMA lands in which table?
- Syslog
- CommonSecurityLog
- SecurityEvent
- LinuxAudit
How do you connect Azure Activity logs from many subscriptions at scale?
- Assign an Azure Policy that sets diagnostic settings
- Install the Azure Monitor Agent on every VM in each subscription
- Run a playbook each night to export logs
- Send activity logs through a CEF forwarder
Custom log tables in a Log Analytics workspace end with which suffix?
- _CL
- _CT
- _LOG
- _CUSTOM
Which is a way to bring threat indicators into Microsoft Sentinel?
- The TAXII data connector
- The Windows Security Events connector
- The Azure Activity connector
- The Syslog via AMA connector
In Defender XDR, custom detection rules are built from:
- Advanced hunting queries
- Sentinel workbooks
- Threat analytics reports
- Purview DLP policies
Which is a valid run frequency for a Defender XDR custom detection rule?
- Every 24 hours
- Every 10 seconds
- Every 30 days
- Once a quarter
A Defender XDR custom detection query must return:
- Timestamp and a column identifying the affected entity
- Only a count of matching rows
- A render statement that draws a chart
- A column named Severity and nothing else, so it can be ranked
Which Sentinel analytics rule type runs about once a minute for near-instant detection?
- Near-real-time (NRT)
- Scheduled
- Fusion
- Anomaly
In a scheduled analytics rule, 'Lookup data from the last' controls:
- How far back each query run looks
- How often the rule runs
- How long incidents stay open before they auto-close
- How many alerts are grouped
What is the longest lookback period a scheduled analytics rule can use?
- 14 days
- 1 day
- 90 days
- 2 years
Which Sentinel rule type uses machine learning to link low-fidelity alerts into multistage attack incidents?
- Fusion
- Near-real-time
- Scheduled
- Microsoft security
Which Sentinel rule type creates incidents from alerts raised by other Microsoft security products?
- Microsoft security
- Fusion
- Threat intelligence
- Anomaly
Which Sentinel rule type matches your logs against threat indicators?
- Threat intelligence
- Fusion
- Near-real-time
- Anomaly