SC-200: Microsoft Security Operations Analyst Practice Exam

What the SC-200 exam covers

• Manage a security operations environment481 questions
• Respond to security incidents401 questions
• Perform threat hunting223 questions

Free SC-200 sample questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 1,105.

1. Question 1Manage a security operations environment

   Your organization has multiple Azure subscriptions across several regions. You need to centralize security event collection using Microsoft Sentinel. What is the recommended workspace architecture?

   • ACreate a separate Sentinel workspace for each Azure subscription
   • BUse Azure Monitor without Sentinel for centralized collection
   • CCreate a single centralized Log Analytics workspace with Sentinel enabledCorrect
   • DCreate a workspace per region with no cross-workspace queries
   ✓ Correct answer: C

   Microsoft's recommended Sentinel architecture for multi-subscription, multi-region organizations is a single centralized Log Analytics workspace with Microsoft Sentinel enabled on top of it. A single workspace gives you one place to run cross-source analytics rules, correlate incidents, and apply RBAC, and Azure Monitor Agent data collection rules can route logs from any subscription or region into it. This avoids the operational overhead and query gaps of fragmented workspaces while keeping cross-source correlation intact.

   Why the other options are wrong

   • ACreating a separate Sentinel workspace per subscription fragments your data, forces you to use slower cross-workspace queries for correlation, and multiplies management and cost overhead, which is the opposite of centralization.
   • BUsing Azure Monitor without Sentinel gives you log collection but none of the SIEM/SOAR capabilities (analytics rules, incidents, UEBA, hunting, playbooks) that the requirement to use Microsoft Sentinel demands.
   • DCreating a workspace per region with no cross-workspace queries actively prevents the centralized correlation and investigation that Sentinel requires, leaving each region in an isolated silo.
2. Question 2Manage a security operations environment

   A compliance auditor asks you to demonstrate that your Microsoft Sentinel deployment has proper access controls. They specifically want to verify that only authorized personnel can modify analytics rules and playbooks. Which Azure feature should you show the auditor?

   • AThe Azure Key Vault access policies governing the workspace data-encryption keys, showing which principals can use those keys
   • BThe network security group and private endpoint rules that restrict which networks can reach the Log Analytics workspace
   • CThe Microsoft Entra ID Conditional Access policies that gate sign-in to the Azure portal, showing the MFA and device conditions enforced
   • DThe Azure RBAC role assignments on the Microsoft Sentinel workspace, showing which users have the Sentinel Contributor roleCorrect
   ✓ Correct answer: D

   Access controls for Sentinel are managed through Azure Role-Based Access Control (RBAC). The Sentinel Contributor role grants permissions to modify analytics rules, playbooks, and other Sentinel content. Auditors verify proper access controls by reviewing RBAC role assignments at the workspace level, ensuring that only authorized personnel have contributor or higher privileges.

   Why the other options are wrong

   • AKey Vault access policies control who can use encryption keys, not who can edit analytics rules or playbooks; they do not demonstrate authorization over Sentinel content.
   • BNSGs filter network traffic and do not govern who has permission to modify Sentinel rules or playbooks, so they prove nothing about content-level access control.
   • CConditional Access enforces conditions on how users sign in (MFA, device state) but does not define which users hold the roles that permit modifying analytics rules and playbooks; that is RBAC.
3. Question 3Manage a security operations environment

   Your organization is using Microsoft Defender for Cloud Apps to protect SaaS applications. A policy detects that a user is downloading an unusual number of files from a sanctioned cloud storage application. Which policy type generated this detection?

   • AA file policy that continuously scans stored files for sensitive content and applies governance actions
   • BAn access policy that allows or blocks user sign-ins to the application based on real-time conditions
   • CAn anomaly detection policy that uses UEBA to detect departures from normal user behavior patternsCorrect
   • DA session policy that monitors and controls activities within a live user session in real time
   ✓ Correct answer: C

   Detecting that a user is downloading an unusually high number of files compared to their normal behavior is the job of Defender for Cloud Apps anomaly detection policies, which build behavioral baselines (UEBA) per user and flag deviations such as unusual download volumes, impossible travel, and mass activity. These policies fire automatically based on learned behavior rather than static thresholds. That behavioral, deviation-based detection is what the scenario describes.

   Why the other options are wrong

   • AA file policy inspects the content and classification of files at rest to enforce DLP-style governance; it does not model per-user download volume over time, so it would not raise an alert about an unusual quantity of downloads by a specific user.
   • BAn access policy governs whether a sign-in to the app is permitted based on conditions like device or location; it acts at authentication time and has no awareness of anomalous post-sign-in download volume, so it is not the detecting policy here.
   • DA session policy inspects and can block specific actions during a proxied live session, such as blocking a download, but it enforces rules in real time rather than learning a behavioral baseline; the volume anomaly is flagged by UEBA-based anomaly detection.
4. Question 4Respond to security incidents

   You need to merge two Microsoft Sentinel incidents that were initially created separately but are determined to be part of the same attack. How should you handle this?

   • ASelect one incident as the primary and use the 'Merge incidents' feature to combine the alerts from the secondary incident into the primary oneCorrect
   • BLink the two incidents with a shared tag and a comment so analysts treat the tagged set as one investigation
   • CConfigure an automation rule that reassigns both incidents to the same owner and marks them as related
   • DAdjust the analytics rule's alert grouping so future alerts land in one incident, then close the older one
   ✓ Correct answer: A

   Sentinel's Merge incidents feature lets you choose a primary incident and merge others into it, consolidating their alerts and entities under the primary while closing the merged ones with a reference. This is the supported way to unify separately created incidents that are part of the same attack. It preserves the alerts and creates a single case to work.

   Why the other options are wrong

   • BA shared tag and comment provide only a visual cross-reference; the alerts and entities remain in two separate incidents, so this does not actually merge them into one investigation.
   • CReassigning ownership via automation coordinates who works the incidents but leaves them as two distinct incidents with separate alert sets, which is not merging.
   • DAlert grouping controls how future alerts are consolidated at creation time; it cannot combine two incidents that already exist, and closing one loses its alert linkage rather than merging it.
5. Question 5Manage a security operations environment

   Which best practice should be followed when managing Operations within Manage a Security Operations Environment?

   • ATune each alert individually in the portal rather than building reusable automation rules
   • BRun response playbooks from a script on an analyst's workstation
   • CKeep automation logic in an undocumented Logic App known only to its author
   • DAutomate repeatable processes using infrastructure as codeCorrect
   ✓ Correct answer: D

   The recommended approach is to automate repeatable processes using infrastructure as code, because doing so makes the configuration repeatable, version-controlled, and auditable, reducing human error and configuration drift across the security operations environment. This aligns with Microsoft's guidance for building and running a Microsoft Sentinel and Defender-based security operations environment, where consistency, least privilege, and proactive monitoring are core principles. The remaining options describe anti-patterns that increase risk or operational fragility.

   Why the other options are wrong

   • APer-alert tuning in the portal is not repeatable or scalable; Sentinel automation rules apply consistent handling to matching incidents.
   • BA workstation script is fragile and unauditable; playbooks should run as managed Logic Apps triggered by automation rules.
   • CA Logic App only its author understands is a single point of failure; automation should be documented and managed as versioned code.
6. Question 6Respond to security incidentsSelect all that apply

   You configure a Microsoft Sentinel automation rule to run automatically when a high-severity incident is created. Which TWO actions can the automation rule perform without a separate playbook?

   • AAssign the incident to a specific ownerCorrect
   • BChange the incident severity or status and add a tagCorrect
   • CExecute arbitrary custom Python code inline
   • DDeploy a new data connector
   • ERewrite the KQL of the triggering analytics rule
   ✓ Correct answer: A, B

   A Microsoft Sentinel automation rule performs built-in actions directly, such as assigning an owner, changing severity or status, adding tags, and closing incidents with a classification. For anything more complex (calling external APIs, enrichment, notifications), the automation rule invokes a Logic Apps playbook. The native actions require no separate playbook.

   Why the other options are wrong

   • CAutomation rules cannot run arbitrary inline code; custom logic must live in a Logic Apps playbook.
   • DDeploying data connectors is a configuration task, not an automation rule action.
   • EAutomation rules act on incidents; they do not edit the query of the analytics rule that produced them.
7. Question 7Perform threat hunting

   An analyst converts a bookmark from a hunt into evidence and wants the bookmarked entities (such as the account and host) to appear and be navigable in the resulting Microsoft Sentinel incident's investigation graph. What must have been configured on the hunting query or bookmark for this to work?

   • AEntity mapping must define entity identifiers (such as Account and Host) on the query/bookmark so those entities carry into the incidentCorrect
   • BAlert grouping must be enabled on the query so the bookmarked account and host entities are correlated into the incident graph
   • CThe bookmark must be tagged with the MITRE ATT&CK tactics so its account and host entities are recognized in the incident graph
   • DThe query must be saved as a scheduled analytics rule first so the account and host entities are populated in the incident graph
   ✓ Correct answer: A

   When you create a hunting query or save a bookmark, you can map result columns to entity types such as Account, Host, IP, and others. These mappings are what allow the bookmark to be promoted to (or added to) an incident with the entities intact, so they appear as nodes in the investigation graph and support entity-behavior pivots. Without entity mapping the bookmark is just raw rows and the incident graph cannot render the related accounts or hosts. Therefore configuring entity mapping is the prerequisite for graph-navigable promotion.

   Why the other options are wrong

   • BAlert grouping consolidates alerts into incidents but does not create the entity identifiers; entities appear in the graph only if entity mapping was defined on the query/bookmark.
   • CMITRE tactic tagging enriches classification and coverage tracking but does not define entities; navigable entities require entity mapping, not tactic tags.
   • DA bookmark can be promoted to an incident directly and does not need to be a scheduled rule; what makes the entities navigable is entity mapping on the query/bookmark.
8. Question 8Manage a security operations environment

   Your organization wants Microsoft Sentinel to automatically correlate low-fidelity signals from Microsoft Entra ID Protection, Microsoft Defender for Cloud Apps, and scheduled analytics rules into a single high-confidence incident describing a multistage attack, with no query authoring required. Which capability provides this?

   • AFusion advanced multistage attack detectionCorrect
   • BA threat-intelligence analytics rule
   • CA Microsoft security analytics rule
   • DEntity behavior analytics with a custom UEBA query
   ✓ Correct answer: A

   Fusion is enabled by default in Microsoft Sentinel and uses machine-learning correlation to combine alerts and anomalies from multiple products - including Microsoft Entra ID Protection, Microsoft Defender for Cloud Apps, and the output of scheduled analytics rules - into a single high-confidence incident that maps to a multistage attack chain. It requires no KQL authoring by the analyst. A threat-intelligence rule simply matches ingested indicators against logs. A Microsoft security rule only forwards alerts from a single connected Microsoft product into Sentinel as incidents. UEBA produces enrichment and anomalies but is not the multistage correlation engine.

   Why the other options are wrong

   • BA TI rule matches indicators of compromise against events; it does not correlate multistage attack signals.
   • CA Microsoft security rule converts alerts from one connected product into incidents without cross-product correlation.
   • DUEBA generates behavioral anomalies and enrichment but is not the engine that fuses multi-product signals into one incident.
9. Question 9Perform threat hunting

   You want to limit a hunting query to events from the last 7 days using the Timestamp column. Which where clause is the correct and most efficient way to express this in KQL?

   • Awhere Timestamp > ago(7d)Correct
   • Bwhere Timestamp > now() + 7d
   • Cwhere Timestamp between (7d)
   • Dwhere datediff(Timestamp) < 7
   ✓ Correct answer: A

   ago() subtracts a timespan from the current UTC time. Comparing Timestamp > ago(7d) returns events whose timestamp is more recent than 7 days ago. Putting the time filter early also lets the engine prune data efficiently.

   Why the other options are wrong

   • Bnow() + 7d points 7 days into the future, so no past events would match.
   • Cbetween requires a (start .. end) range, not a single timespan; this syntax is invalid.
   • Ddatediff is not a valid KQL scalar function for this comparison; the correct function for elapsed-time filtering uses ago().
10. Question 10Respond to security incidents

    A SOC is standardizing case management in Microsoft Sentinel (unified in the Defender portal). Analysts must attach multiple related incidents, notes, and tasks to a single investigative case that outlives any one incident. Which capability supports this?

    • AAlert grouping settings configured inside a single analytics rule, which bundle that rule's alerts into fewer incidents
    • BWatchlists, which store reference data such as VIP or asset lists used to enrich and prioritize detections in queries
    • CCase management, which links related incidents and tracks tasks and notes as one caseCorrect
    • DThe MITRE ATT&CK coverage page, which visualizes which tactics and techniques your active analytics rules currently cover
    ✓ Correct answer: C

    The unified case management experience lets SOC teams create a case, associate multiple related incidents to it, add tasks and notes, and manage the investigation lifecycle across incidents. It is broader than a single incident and is designed for coordinated, multi-incident investigations.

    Why the other options are wrong

    • AAlert grouping only bundles alerts within one rule's incidents; it does not span multiple incidents as a case.
    • BWatchlists store reference data, not case workflow.
    • DThe ATT&CK page tracks coverage, not case management.

Related Microsoft resources

• SC-200 study guideKey concepts
• Microsoft practice examsAll Microsoft
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• AZ-140 practice examRelated
• AZ-900 practice examRelated
• AZ-104 practice examRelated

SC-200 practice exam FAQ