SC-200: Microsoft Security Operations Analyst Practice Exam

What the SC-200 exam covers

• Manage a security operations environment493 questions
• Respond to security incidents412 questions
• Perform threat hunting229 questions

Free SC-200 practice test questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 1,134.

1. Question 1Manage a security operations environment

   Your organization has multiple Azure subscriptions across several regions. You need to centralize security event collection using Microsoft Sentinel. What is the recommended workspace architecture?

   • ACreate a separate Sentinel workspace for each Azure subscription
   • BUse Azure Monitor without Sentinel for centralized collection
   • CCreate a single centralized Log Analytics workspace with Sentinel enabledCorrect
   • DCreate a workspace per region with no cross-workspace queries
   ✓ Correct answer: C

   Microsoft's recommended Sentinel architecture for multi-subscription, multi-region organizations is a single centralized Log Analytics workspace with Microsoft Sentinel enabled on top of it. A single workspace gives you one place to run cross-source analytics rules, correlate incidents, and apply RBAC, and Azure Monitor Agent data collection rules can route logs from any subscription or region into it. This avoids the operational overhead and query gaps of fragmented workspaces while keeping cross-source correlation intact.

   Why the other options are wrong

   • ACreating a separate Sentinel workspace per subscription fragments your data, forces you to use slower cross-workspace queries for correlation, and multiplies management and cost overhead, which is the opposite of centralization.
   • BUsing Azure Monitor without Sentinel gives you log collection but none of the SIEM/SOAR capabilities (analytics rules, incidents, UEBA, hunting, playbooks) that the requirement to use Microsoft Sentinel demands.
   • DCreating a workspace per region with no cross-workspace queries actively prevents the centralized correlation and investigation that Sentinel requires, leaving each region in an isolated silo.
2. Question 2Manage a security operations environment

   Your Microsoft Sentinel deployment uses several playbooks that call external REST APIs for threat intelligence enrichment. The APIs require authentication with API keys. Where should you store these API keys securely?

   • AStore the API keys as entries in a Sentinel watchlist that the playbook looks up before each call
   • BStore the keys in Azure Key Vault and reference them from the Logic App via managed identityCorrect
   • CPlace the API keys in the Logic App's application settings as plain-text parameters read at runtime
   • DEmbed the API keys directly in the Logic App workflow definition JSON as literal string values
   ✓ Correct answer: B

   Azure Key Vault is the purpose-built service for securely storing and managing secrets such as API keys, keeping them encrypted at rest. Using a Logic App managed identity with the Key Vault connector ensures the keys are never exposed in the workflow definition, supports the principle of least privilege, simplifies key rotation, and provides audit trails for secret access.

   Why the other options are wrong

   • AWatchlists are readable by anyone with workspace access and are meant for reference data, not secrets; storing API keys there exposes them broadly with no secret-management controls.
   • CApplication settings are visible to anyone with contributor access to the Logic App and are not designed as a secure secret store; Key Vault with managed identity keeps keys out of the app entirely.
   • DHardcoding keys in the workflow definition exposes them in the resource JSON, version history, and export files, and rotating them requires editing the workflow, unlike a Key Vault reference.
3. Question 3Manage a security operations environment

   You are configuring email authentication in Microsoft Defender for Office 365. The organization needs to implement DMARC with a reject policy. Before setting the policy to reject, what should you verify?

   • AVerify that every legitimate sending application is configured to use TLS 1.2 for outbound message transport so that mail is encrypted before the reject policy is enforced
   • BVerify that the accepted domains and mail connectors in Exchange Online are all set to authoritative routing so that inbound and outbound flow continues after enabling reject
   • CVerify that Enhanced Filtering for Connectors is enabled so that the original source IP is preserved and DMARC alignment is evaluated against the correct sending host
   • Dverify that SPF and DKIM are properly configured for all legitimate sending sources and that DMARC reports in monitor mode (p=none) show no legitimate emails failing authenticationCorrect
   ✓ Correct answer: D

   Before moving DMARC to p=reject you must confirm that every legitimate sending source passes SPF and/or DKIM with alignment, and you do that by first publishing p=none (monitor mode) and reviewing the aggregate DMARC reports to ensure no legitimate mail is failing. Moving to reject prematurely would bounce valid mail from misconfigured senders. This staged approach (none then quarantine then reject) is the standard, safe rollout.

   Why the other options are wrong

   • AEnforcing TLS 1.2 secures the transport channel but has no bearing on DMARC alignment, which is based on SPF and DKIM results; a reject policy can still bounce legitimate mail that passes TLS but fails alignment, so TLS is not the prerequisite to check.
   • BAuthoritative accepted-domain and connector routing controls how mail flows for owned domains, not whether senders pass DMARC; moving to reject without confirming SPF and DKIM alignment can still block legitimate sources, so this misses the real risk.
   • CEnhanced Filtering for Connectors preserves the original sender IP when mail routes through a third party before Exchange Online, which aids filtering accuracy, but it does not confirm that all legitimate senders pass authentication before enforcing reject.
4. Question 4Respond to security incidents

   Your organization's Microsoft Sentinel environment has generated an incident indicating potential insider threat activity. An employee has been accessing confidential SharePoint sites that are outside their normal job responsibilities during off-hours. Which entity behavior analytics feature provides insight into this anomaly?

   • AThe Microsoft Sentinel health monitoring page, which reports connector ingestion status rather than user behavior
   • BThe SharePoint audit search in the Microsoft Purview compliance portal, which lists file access but not behavioral baselines
   • CThe UEBA anomaly timeline on the user entity page, showing deviations from the user's baseline, like unusual access and timingCorrect
   • DThe Microsoft Entra ID sign-in logs filtered by the user, which show authentication events but not resource-access anomalies
   ✓ Correct answer: C

   User and Entity Behavior Analytics (UEBA) analyzes normal behavior patterns and flags deviations. The anomaly timeline specifically highlights when a user accesses unusual resources (confidential SharePoint sites) at unusual times (off-hours), comparing against their historical baseline. This is exactly what insider threat detection requires.

   Why the other options are wrong

   • AThe health monitoring page tracks data connector and ingestion status; it has nothing to do with detecting anomalous user behavior and provides no behavioral baseline.
   • BPurview audit search can show that the user accessed the SharePoint sites, but it lists raw activity without comparing it to the user's normal behavior baseline, which is exactly what UEBA provides.
   • DEntra ID sign-in logs record authentications and their context but do not model resource-access anomalies or off-hours deviations against a learned baseline the way the UEBA anomaly timeline does.
5. Question 5Perform threat hunting

   You are writing a Microsoft Sentinel advanced hunting query to find Microsoft Entra ID interactive sign-ins that succeeded from IP addresses in a country your organization does not operate in. Which table should the query start from?

   • ASigninLogsCorrect
   • BAuditLogs
   • CAADManagedIdentitySignInLogs
   • DSecurityEvent
   ✓ Correct answer: A

   SigninLogs records interactive user sign-ins to Microsoft Entra ID and includes ResultType (success or failure) and the LocationDetails/IPAddress fields needed to filter by country. You would filter for ResultType == 0 and a LocationDetails.countryOrRegion outside your operating countries.

   Why the other options are wrong

   • BAuditLogs records directory changes (users, groups, policies), not sign-in events.
   • CAADManagedIdentitySignInLogs captures managed identity (service) sign-ins, not interactive user sign-ins.
   • DSecurityEvent contains Windows security events from hosts, not Entra ID cloud sign-ins.
6. Question 6Perform threat huntingSelect all that apply

   A hunter ingests firewall logs into a custom Microsoft Sentinel table whose field names differ from other sources. To hunt consistently across all network sources, which TWO approaches let the hunter normalize the data to a common schema?

   • AUse the built-in ASIM (Advanced Security Information Model) NetworkSession parser at query timeCorrect
   • BCreate a custom ASIM parser (a KQL function) that maps the custom fields to the ASIM schemaCorrect
   • CChange the workspace retention period to normalize the fields
   • DEnable UEBA to rename the custom table columns
   • EConvert the table to the Auxiliary logs plan to standardize field names
   ✓ Correct answer: A, B

   The Advanced Security Information Model (ASIM) provides schemas (for example, NetworkSession) and parser functions that translate source-specific fields into normalized column names. Analysts can call the built-in ASIM parsers at query time and, for a non-standard source, author a custom ASIM parser (a saved KQL function) that maps the custom table's fields to the ASIM schema. Queries written against ASIM then work across every normalized source.

   Why the other options are wrong

   • CRetention controls how long data is kept, not how fields are named or normalized.
   • DUEBA produces behavioral analytics; it does not rename columns or normalize schemas.
   • EThe Auxiliary logs plan changes cost/query capabilities, not field-name normalization.
7. Question 7Manage a security operations environment

   A SOC manager must grant an analyst the ability to triage incidents, run playbooks manually, and change incident status in Microsoft Sentinel, but the analyst must not be able to create or edit analytics rules. Which built-in Sentinel role meets the requirement with least privilege?

   • AMicrosoft Sentinel ResponderCorrect
   • BMicrosoft Sentinel Reader
   • CMicrosoft Sentinel Contributor
   • DLog Analytics Contributor
   ✓ Correct answer: A

   Responder builds on Reader and adds the ability to manage incidents - assigning, changing severity and status, adding comments, and triggering playbooks. It does not allow creating or editing analytics rules, which is the line of separation requested. Creating rules requires Contributor.

   Why the other options are wrong

   • BReader can only view data and incidents and cannot change incident status or run playbooks.
   • CContributor can author analytics rules, which exceeds the least-privilege requirement.
   • DLog Analytics Contributor is a workspace-data role and does not provide Sentinel incident-management actions.
8. Question 8Manage a security operations environment

   A detection engineer wants to validate that a newly created Microsoft Sentinel scheduled rule and the team's hunting queries adequately cover the techniques an APT group is known to use, and to find untested gaps. Which Microsoft Sentinel feature provides this visualization?

   • AThe MITRE ATT&CK (Preview) blade showing simulated and active coverageCorrect
   • BThe Watchlist gallery listing reusable lookup lists used for data enrichment and filtering
   • CThe Usage and estimated costs blade summarizing data ingestion volume and billing
   • DThe Data connectors health page reporting connector ingestion status and errors
   ✓ Correct answer: A

   Microsoft Sentinel includes a MITRE ATT&CK coverage view that overlays your active analytics rules and hunting queries onto the ATT&CK matrix of tactics and techniques. Cells show current (active) coverage and simulated coverage from available templates, letting an engineer confirm which of an APT group's techniques are detected and which remain gaps to address. Watchlists hold reference data for enrichment. The Usage and estimated costs blade addresses ingestion cost. The data connectors health page reports connector status - none of these visualize ATT&CK coverage.

   Why the other options are wrong

   • BThe Watchlist gallery manages reusable reference data (VIP users, asset lists) for enrichment and filtering; it does not visualize detection coverage across ATT&CK techniques or reveal untested gaps.
   • CUsage and estimated costs reports data volume and billing; it has nothing to do with mapping analytics-rule and hunting coverage to adversary techniques.
   • DThe Data connectors health page shows whether connectors are ingesting data; it does not display which ATT&CK techniques your rules and hunting queries cover.
9. Question 9Perform threat hunting

   An analyst joins EmailEvents to EmailAttachmentInfo to trace malicious attachments. On which shared key column should the join be performed to correlate a message with its attachments?

   • ANetworkMessageIdCorrect
   • BDeviceId
   • CProcessCommandLine
   • DRegistryKey
   ✓ Correct answer: A

   Both EmailEvents and EmailAttachmentInfo carry NetworkMessageId, the identifier Microsoft assigns to a message within an organization for a given time window. Joining on it correlates the delivered message with its specific attachment records.

   Why the other options are wrong

   • BDeviceId identifies an endpoint and does not exist as a correlation key between these email tables.
   • CProcessCommandLine is a device process field unrelated to email message correlation.
   • DRegistryKey is a registry event field and has no role in linking email tables.
10. Question 10Respond to security incidents

    Defender for Cloud raises a container alert: a pod in your Azure Kubernetes Service cluster spawned a shell and began scanning the internal network from inside the container. Which action best contains the compromised workload while preserving the cluster's other services?

    • ADelete the entire AKS cluster and redeploy it from a known-good template so that you can be completely certain no compromised component remains anywhere in the environment
    • BCordon and drain or delete the affected pod/node and apply a network policy to isolate the workload, then investigate the imageCorrect
    • CScale the deployment to zero replicas across the whole namespace
    • DRestart the kubelet on every node in the cluster
    ✓ Correct answer: B

    Container response follows least-blast-radius containment: cordon/drain or delete the affected pod (and node if implicated), apply a Kubernetes network policy to block the workload's lateral scanning, then trace the malicious image back to its registry and pipeline. Other services keep running.

    Why the other options are wrong

    • ADestroying the whole cluster is disproportionate and causes an unnecessary outage.
    • CZeroing the entire namespace takes down unrelated healthy workloads.
    • DRestarting kubelets does not remove the compromised pod or stop its scanning.

Who this SC-200 practice exam is for

This practice set is for anyone preparing for the SC-200: Microsoft Security Operations Analyst exam at the intermediate level - from first-time candidates building a foundation to experienced Microsoft practitioners doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this SC-200 practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real SC-200 exam.

Related Microsoft resources

• SC-200 study guideKey concepts
• Microsoft practice examsAll Microsoft
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• How these questions are written and reviewedMethodology
• Report a problem with a questionCorrections
• SC-300 practice examRelated
• SC-401 practice examRelated
• SC-500 practice examRelated

SC-200 practice exam FAQ