SC-200: Microsoft Security Operations Analyst — Questions and Answers

Question 1: Which Microsoft Defender for Identity feature proactively identifies and scores sensitive accounts and devices to prioritize investigation of lateral movement alerts?

Hunting queries
Entity tags (Sensitive account tagging) (Correct answer)
Custom detection rules
Advanced audit policies

Correct answer: Entity tags (Sensitive account tagging)

Sensitive entity tagging in Defender for Identity marks high-value accounts and devices, so lateral movement paths targeting them generate higher-priority alerts.

Question 2: An attacker uses a pass-the-hash attack against NTLM authentication. Which characteristic of NTLM hashes makes this attack possible?

NTLM hashes are salted per session
NTLM hashes expire after 24 hours
NTLM hashes can be used directly as authentication credentials without knowing the plaintext (Correct answer)
NTLM uses asymmetric keys for authentication

Correct answer: NTLM hashes can be used directly as authentication credentials without knowing the plaintext

NTLM hashes function as authentication tokens, so possessing the hash alone allows an attacker to authenticate without cracking it.

Question 3: Which skill is most important for success in Threat Intelligence & Analysis within Microsoft Security Operations Analyst?

Continuous learning and adaptation (Correct answer)
Working without any training
Resisting change
Avoiding feedback

Correct answer: Continuous learning and adaptation

Continuous learning ensures professionals stay current with evolving practices in Threat Intelligence & Analysis.

Question 4: When configuring User and Entity Behavior Analytics (UEBA) in Microsoft Sentinel, which data source provides the baseline for anomaly scoring of Azure AD sign-in behavior?

Office 365 audit logs
Azure AD sign-in and audit logs (Correct answer)
Microsoft Defender for Endpoint logs
Azure Activity logs

Correct answer: Azure AD sign-in and audit logs

UEBA baselines Azure AD sign-in and audit logs to establish normal user behavior patterns and score deviations.

Question 5: An SOC analyst is investigating a potential GDPR breach involving Microsoft Teams messages. Which Microsoft Purview capability allows searching Teams content for the investigation?

Azure Active Directory sign-in logs
Microsoft Sentinel Teams connector
Microsoft Defender for Cloud Apps activity log
Microsoft Purview eDiscovery (Standard or Premium) (Correct answer)

Correct answer: Microsoft Purview eDiscovery (Standard or Premium)

Microsoft Purview eDiscovery allows investigators to search, hold, and export Teams messages and other Microsoft 365 content for legal and compliance investigations.

Question 6: In a Microsoft Sentinel playbook, an analyst needs to parse a JSON field returned from an HTTP action before using its values. Which Logic Apps action should they use?

Compose
Select
Parse JSON (Correct answer)
Filter array

Correct answer: Parse JSON

The 'Parse JSON' action deserializes a JSON string into a structured object whose fields can be referenced in subsequent steps.

Question 7: An analyst wants Microsoft Sentinel to automatically assign a severity of High to any incident involving a watchlist match. Which feature enables this?

Playbook
Analytics Rule
Automation Rule (Correct answer)
Fusion Rule

Correct answer: Automation Rule

Automation rules in Microsoft Sentinel can modify incident properties such as severity, owner, and status based on trigger conditions.

Question 8: A threat hunter writes a KQL query to find processes that load known cryptomining libraries. Which table in Microsoft Defender for Endpoint (via advanced hunting) should they query?

EmailAttachmentInfo
DeviceImageLoadEvents (Correct answer)
SecurityAlert
DeviceNetworkEvents

Correct answer: DeviceImageLoadEvents

DeviceImageLoadEvents records DLL and library load events, making it ideal for detecting cryptomining or suspicious module loads.

Question 9: Which of the following is an example of an automated security response?

Sending security reports to management
Manually reviewing security alerts
Blocking malicious IP addresses (Correct answer)
Scheduling security audits

Correct answer: Blocking malicious IP addresses

An automated security response involves systems taking predefined actions without human intervention when a specific security event or threat is detected. Blocking malicious IP addresses is a prime example, as a security system can automatically configure firewalls or network access controls to deny traffic from known threat sources as soon as they are identified, preventing further malicious activity.

Question 10: Which Microsoft tool is primarily used for security analytics and automation?

Azure DevOps
Windows Defender Firewall
Microsoft Sentinel (Correct answer)
Microsoft Excel

Correct answer: Microsoft Sentinel

Microsoft Sentinel is a cloud-native SIEM (Security Information and Event Management) and SOAR (Security Orchestration, Automation, and Response) solution that excels in security analytics and automation. It collects security data from across an organization, uses AI and machine learning for advanced threat detection, and provides built-in automation capabilities (playbooks) to orchestrate and automate responses to security incidents, making it the primary tool for these functions.

Question 11: A security analyst configures a Defender for Endpoint custom indicator to block a file hash associated with a penetration testing tool used legitimately by the internal red team. What is the recommended approach to allow the red team's use while keeping the block for all other users?

Create an exclusion path for the red team's devices
Disable real-time protection on red team machines
Create a device group for red team devices and set the indicator to 'Allowed' scoped to that group (Correct answer)
Submit the hash as a false positive to Microsoft

Correct answer: Create a device group for red team devices and set the indicator to 'Allowed' scoped to that group

Custom indicators support 'Allowed' actions scoped to specific device groups, enabling you to permit a tool on red team devices while blocking it everywhere else.

Question 12: A red team operator uses PowerShell to download and execute a second-stage payload from a remote URL using IEX (Invoke-Expression). Which Microsoft Defender for Endpoint capability is specifically designed to detect and block this AMSI-bypassing technique?

Script scanning via AMSI integration (Correct answer)
Network protection
Controlled folder access
Behavior monitoring

Correct answer: Script scanning via AMSI integration

AMSI (Antimalware Scan Interface) integration allows Defender to scan in-memory PowerShell content at runtime, catching obfuscated or dynamically constructed scripts before execution.

Question 13: A SOC team wants to track mean time to respond (MTTR) across all incidents in Microsoft Sentinel. Which built-in feature provides this metric without writing custom KQL?

Microsoft Sentinel workspace analytics workbook (SOC Efficiency workbook) (Correct answer)
Entity behavior analytics dashboard
Fusion alert page
Threat Intelligence workbook

Correct answer: Microsoft Sentinel workspace analytics workbook (SOC Efficiency workbook)

The SOC Efficiency workbook in Microsoft Sentinel includes pre-built MTTR, MTTA, and incident closure metrics.

Question 14: Which skill is most important for success in Network Security Fundamentals within Microsoft Security Operations Analyst?

Resisting change
Continuous learning and adaptation (Correct answer)
Avoiding feedback
Working without any training

Correct answer: Continuous learning and adaptation

Continuous learning ensures professionals stay current with evolving practices in Network Security Fundamentals.

Question 15: A security engineer wants to suppress repeated alerts from the same source IP for 1 hour after the first alert fires. Which Microsoft Sentinel feature handles this?

Alert grouping settings
Automation rule with condition on alert count
Analytic rule query scheduling
Alert suppression (also called 'Stop running query after alert is generated') (Correct answer)

Correct answer: Alert suppression (also called 'Stop running query after alert is generated')

Alert suppression in analytic rules prevents re-triggering the same rule for a configurable period after an alert is generated.

Question 16: What is a major benefit of automated incident response?

Disables all security alerts
Reduces response time and increases efficiency (Correct answer)
Allows incidents to resolve themselves
Eliminates the need for cybersecurity professionals

Correct answer: Reduces response time and increases efficiency

Automated incident response leverages technology to perform repetitive or time-sensitive tasks, such as blocking malicious IPs or isolating compromised hosts, without human intervention. This significantly reduces the time it takes to detect and respond to incidents, thereby increasing the overall efficiency of security operations and minimizing potential damage from cyber threats.

Question 17: What is the primary purpose of the NIST SP 800-61 framework in the context of security operations?

Providing guidelines for computer security incident handling (Correct answer)
Describing risk assessment methodologies
Defining encryption standards for data at rest
Establishing access control requirements for federal systems

Correct answer: Providing guidelines for computer security incident handling

NIST SP 800-61 provides guidelines for establishing and operating an incident response program, covering preparation, detection, containment, eradication, and recovery phases.

Question 18: Which Microsoft Purview feature uses encryption to restrict who can access sensitive documents even after they are downloaded outside the organization?

Microsoft Defender for Cloud Apps session policies
Microsoft Purview Information Protection sensitivity labels with encryption (Correct answer)
Azure AD Conditional Access app control
Data Loss Prevention (DLP) policies

Correct answer: Microsoft Purview Information Protection sensitivity labels with encryption

Sensitivity labels in Microsoft Purview can apply AES encryption and usage rights that persist with the document regardless of where it is stored.

Question 19: What is a fundamental principle of Cryptography & Encryption in Microsoft Security Operations Analyst practice?

Following established standards and best practices (Correct answer)
Using outdated methods
Ignoring industry guidelines
Working in isolation without guidance

Correct answer: Following established standards and best practices

Following established standards and best practices ensures quality and consistency in Cryptography & Encryption.

Question 20: A SOC analyst notices repeated failed sign-in attempts followed by a successful login from an unusual country. Which Microsoft Sentinel analytics rule type is BEST suited to detect this pattern?

Microsoft Security
Fusion
Scheduled (Correct answer)
NRT (Near Real-Time)

Correct answer: Scheduled

Scheduled analytics rules use KQL queries run on a defined schedule and are ideal for detecting multi-step patterns like brute-force followed by success.

Question 21: What is the purpose of a post-incident review?

Erase all incident logs
Ignore the incident and move on
Punish the responsible team members
Analyze and improve security measures (Correct answer)

Correct answer: Analyze and improve security measures

A post-incident review, also known as a lessons learned session, is conducted after an incident has been resolved to analyze what happened, how it was handled, and what could be improved. Its purpose is to identify weaknesses in security controls, refine incident response procedures, and implement changes to prevent similar incidents in the future, thereby continuously improving security measures.

Question 22: What does accountability mean in Microsoft Security Operations Analyst team management?

Taking ownership of responsibilities and outcomes (Correct answer)
Avoiding difficult conversations
Only reporting successes
Blaming others for mistakes

Correct answer: Taking ownership of responsibilities and outcomes

Accountability means taking ownership of assigned responsibilities and being answerable for the outcomes, whether positive or negative.

Question 23: A threat actor uses RC4 encryption in a malware C2 communication protocol. Why is RC4 considered cryptographically weak?

RC4 requires a 4096-bit key minimum which is computationally expensive
RC4 is not implemented in Windows CNG and requires third-party libraries
RC4 only supports 64-bit block sizes limiting payload size
RC4 has known statistical biases in its keystream making ciphertext vulnerable to analysis (Correct answer)

Correct answer: RC4 has known statistical biases in its keystream making ciphertext vulnerable to analysis

RC4's keystream has statistical biases (especially in early bytes) that allow attackers to recover plaintext or keys through cryptanalysis.

Question 24: Which approach best supports quality outcomes in Threat Intelligence & Analysis for Microsoft Security Operations Analyst?

Avoiding quality checks
Systematic application of evidence-based methods (Correct answer)
Relying solely on intuition
Rushing through tasks

Correct answer: Systematic application of evidence-based methods

Evidence-based methods provide a reliable foundation for achieving consistent, high-quality outcomes.

Question 25: An analyst needs to remediate a compromised account in Microsoft Entra ID Protection. Which combination of actions fully remediates the risk?

Enable MFA and dismiss sign-in risk
Reset password, revoke all sessions, and confirm user is compromised (Correct answer)
Dismiss user risk and unblock the account
Delete and recreate the user account

Correct answer: Reset password, revoke all sessions, and confirm user is compromised

Full remediation requires resetting credentials to evict the attacker, revoking active sessions to terminate existing access, and confirming compromise to feed the risk engine.

Question 26: An analyst writes a KQL query using 'make-series' in Microsoft Sentinel. What is the primary purpose of this operator?

Summarize data into a single scalar value
Join two tables on a time key
Extract time components from a datetime field
Create a time-series array of values for anomaly detection (Correct answer)

Correct answer: Create a time-series array of values for anomaly detection

make-series generates a dynamic array of values over time intervals, enabling time-series analysis and ML-based anomaly detection.

Question 27: An analyst uses 'externaldata' in a KQL query. What is the primary use case for this operator in Microsoft Sentinel hunting?

Connect to on-premises SQL databases
Query external SIEM systems
Export query results to external storage
Import reference data from a URL (e.g., threat intel CSV) into a query (Correct answer)

Correct answer: Import reference data from a URL (e.g., threat intel CSV) into a query

externaldata loads tabular data from an external URL like Azure Blob Storage into a KQL query for enrichment or lookups.

Question 28: When onboarding a new Syslog data source to Microsoft Sentinel using AMA, which resource must be created to define which facilities and severities are collected?

Data Collection Rule (DCR) (Correct answer)
Sentinel analytics rule
Log Analytics saved search
Data Collection Endpoint (DCE)

Correct answer: Data Collection Rule (DCR)

A Data Collection Rule (DCR) defines the Syslog facilities, severities, and destination workspace for the Azure Monitor Agent.

Question 29: What is the primary goal of incident containment?

Immediately delete all compromised files
Shut down the entire network
Prevent further damage and isolate systems (Correct answer)
Inform all employees about the incident

Correct answer: Prevent further damage and isolate systems

The primary goal of incident containment is to limit the scope and impact of a security incident by preventing it from spreading further within the network or causing additional damage. This often involves isolating affected systems, disconnecting compromised devices, or implementing temporary network segmentation to stop the attack's progression and minimize harm.

Question 30: What is the purpose of risk assessments in compliance programs?

Identify vulnerabilities and prioritize security measures (Correct answer)
Increase compliance complexity
Replace all existing security controls
Ignore security risks

Correct answer: Identify vulnerabilities and prioritize security measures

Risk assessments are crucial in compliance programs because they systematically identify potential vulnerabilities and threats within an organization's systems and processes. By evaluating the likelihood and impact of these risks, organizations can prioritize and implement appropriate security measures, ensuring resources are effectively allocated to protect sensitive assets and meet regulatory requirements.

Question 31: What is the importance of staying current with trends in Threat Intelligence & Analysis for Microsoft Security Operations Analyst?

It is only required for new professionals
Trends do not affect professional practice
It is not necessary once certified
It ensures practices remain effective and relevant (Correct answer)

Correct answer: It ensures practices remain effective and relevant

Staying current with industry trends ensures that professional practices remain effective, relevant, and aligned with evolving standards.

Question 32: Which Microsoft Sentinel data connector type uses a Log Analytics agent (MMA/AMA) installed on the source machine?

REST API connector
Codeless Connector Platform (CCP)
Azure service-to-service connector
Agent-based connector (Syslog/CEF) (Correct answer)

Correct answer: Agent-based connector (Syslog/CEF)

Agent-based connectors (Syslog/CEF) require the Log Analytics or Azure Monitor agent installed on the log source.

Question 33: A company's security team wants to receive a Teams notification whenever a Critical incident is created in Microsoft Sentinel. What is the MOST efficient way to implement this?

Use a Logic App triggered by a custom webhook
Write a custom Azure Function
Set up an email alert in Azure Monitor
Configure an automation rule that triggers a playbook with a Teams connector (Correct answer)

Correct answer: Configure an automation rule that triggers a playbook with a Teams connector

An automation rule in Sentinel can trigger a Logic App (playbook) when an incident is created, and the playbook can use the Teams connector to post a message.

Question 34: Microsoft Defender for Office 365 detects an email where the attacker used S/MIME to sign a phishing message with a legitimate-looking certificate. What does S/MIME signing verify?

That no macros are embedded in attachments
That the sender's identity is bound to a certificate authority-issued certificate (Correct answer)
That the email passed SPF and DKIM checks
That the email content is encrypted end-to-end

Correct answer: That the sender's identity is bound to a certificate authority-issued certificate

S/MIME digital signatures use a certificate to authenticate the sender's identity, but do not prevent phishing if the certificate is obtained fraudulently.

Question 35: What distinguishes a SOC 2 Type I report from a SOC 2 Type II report?

Type I evaluates controls at a point in time; Type II evaluates effectiveness over a period (Correct answer)
Type I requires external auditors; Type II can use internal auditors
Type I covers security only; Type II covers all five trust service criteria
Type I is for cloud providers; Type II is for on-premises systems

Correct answer: Type I evaluates controls at a point in time; Type II evaluates effectiveness over a period

SOC 2 Type I assesses whether controls are suitably designed at a specific point in time, while Type II evaluates the operating effectiveness of those controls over a defined period (typically 6-12 months).

Question 36: What is the primary purpose of Attack Surface Reduction (ASR) rules in Microsoft Defender for Endpoint?

To monitor network traffic for anomalous patterns
To generate vulnerability reports for patch management teams
To encrypt endpoint data at rest
To block behaviors commonly used by malware before malicious activity occurs (Correct answer)

Correct answer: To block behaviors commonly used by malware before malicious activity occurs

ASR rules proactively block specific behaviors commonly exploited by malware — such as running obfuscated scripts or launching executable content from email — preventing attacks before they can execute.

Question 37: Which KQL function is used to detect anomalies in a time series within Microsoft Sentinel, returning a spike or drop indicator?

anomalychart()
series_outliers()
series_decompose_anomalies() (Correct answer)
series_fir()

Correct answer: series_decompose_anomalies()

series_decompose_anomalies() decomposes a time series into trend, seasonality, and residual, then flags statistical anomalies.

Question 38: What is a fundamental principle of Cloud Security Architecture in Microsoft Security Operations Analyst practice?

Working in isolation without guidance
Using outdated methods
Following established standards and best practices (Correct answer)
Ignoring industry guidelines

Correct answer: Following established standards and best practices

Following established standards and best practices ensures quality and consistency in Cloud Security Architecture.

Question 39: Under HIPAA Security Rule, covered entities must conduct which activity to identify potential risks and vulnerabilities to ePHI?

Business impact assessment
Risk analysis (Correct answer)
SOC 2 Type II audit
Annual penetration testing

Correct answer: Risk analysis

HIPAA Security Rule (45 CFR § 164.308(a)(1)) requires covered entities to conduct a risk analysis to identify potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI.

Question 40: What is the role of machine learning in security analytics?

Automatically fix all security vulnerabilities
Replace the need for human analysts
Ignore false positive alerts
Identify patterns and detect anomalies (Correct answer)

Correct answer: Identify patterns and detect anomalies

Machine learning in security analytics is primarily used to process vast amounts of data to identify unusual patterns and detect anomalies. By learning from historical data, ML algorithms can flag deviations from normal behavior, which often indicate potential security threats or breaches that might otherwise go unnoticed by traditional rule-based systems.

Question 41: What is the purpose of the 'Entity behavior analytics' (UEBA) feature in Microsoft Sentinel?

To establish baselines and detect anomalous behavior per user and entity (Correct answer)
To automatically remediate vulnerabilities on endpoints
To block malicious IPs in real time
To correlate threat intelligence with network traffic

Correct answer: To establish baselines and detect anomalous behavior per user and entity

UEBA builds behavioral baselines per user, device, and application, then assigns risk scores when observed behavior deviates from those baselines.

Question 42: You want to hunt for suspicious PowerShell executions across all endpoints in your organization. Which tool in Microsoft Defender XDR should you use?

Security Score
Device Inventory
Advanced Hunting (Correct answer)
Threat Analytics

Correct answer: Advanced Hunting

Advanced Hunting uses KQL to query up to 30 days of raw telemetry across endpoints, email, identity, and cloud apps.

Question 43: During incident response, an analyst needs to immediately revoke all active sessions for a compromised Entra ID user. Which PowerShell command accomplishes this?

Remove-AzureADUser
Set-AzureADUser -AccountEnabled $false
Reset-AzureADUserPassword
Revoke-AzureADUserAllRefreshToken (Correct answer)

Correct answer: Revoke-AzureADUserAllRefreshToken

Revoke-AzureADUserAllRefreshToken (or the Microsoft Graph equivalent) invalidates all refresh tokens, forcing the user to re-authenticate and evicting any attacker with stolen tokens.

Question 44: An analyst uses Defender for Cloud's regulatory compliance dashboard and sees a control failing under the NIST SP 800-53 benchmark. The failing check is 'Vulnerabilities in security configuration on your machines should be remediated.' Which underlying technology provides the raw assessment data for this check?

Azure Policy guest configuration (Correct answer)
Microsoft Entra ID Protection risk detections
Microsoft Defender Vulnerability Management agent
Log Analytics workspace security events

Correct answer: Azure Policy guest configuration

Azure Policy guest configuration (formerly Azure Automation DSC) assesses OS-level security configuration baselines and feeds that data into Defender for Cloud's compliance controls.

Question 45: Which tool is commonly used in Microsoft security operations for investigating security incidents?

Azure DevOps
Microsoft Sentinel (Correct answer)
OneDrive
Microsoft Teams

Correct answer: Microsoft Sentinel

Microsoft Sentinel is a powerful SIEM (Security Information and Event Management) solution that centralizes security data from various sources, making it an ideal tool for investigating security incidents. It provides advanced analytics, threat intelligence, and automation capabilities to help security operations analysts efficiently detect, investigate, and respond to threats within Microsoft environments. Its comprehensive features are tailored for incident investigation.

Question 46: Which of the following is a key component of regulatory compliance?

Limiting security awareness training
Disabling security monitoring
Maintaining audit logs (Correct answer)
Avoiding documentation

Correct answer: Maintaining audit logs

Maintaining audit logs is a key component of regulatory compliance as it provides a verifiable record of activities within systems and networks. These logs are essential for demonstrating adherence to security policies, investigating security incidents, and proving compliance during audits, ensuring accountability and transparency.

Question 47: The MITRE ATT&CK framework's 'Defense Evasion' tactic is most relevant to which compliance control objective?

Maintaining audit log retention
Detecting and preventing attackers from disabling security monitoring (Correct answer)
Managing user access privileges
Ensuring encryption of data at rest

Correct answer: Detecting and preventing attackers from disabling security monitoring

Defense Evasion techniques, such as disabling security tools or clearing logs, directly threaten security monitoring capabilities, making detection of these techniques critical for compliance.

Question 48: Which skill is most important for success in Cloud Security Architecture within Microsoft Security Operations Analyst?

Working without any training
Avoiding feedback
Resisting change
Continuous learning and adaptation (Correct answer)

Correct answer: Continuous learning and adaptation

Continuous learning ensures professionals stay current with evolving practices in Cloud Security Architecture.

Question 49: Which Microsoft Sentinel analytics rule type uses machine learning to detect anomalies without requiring a manually written KQL query?

Anomaly (UEBA) (Correct answer)
Fusion
NRT
Scheduled

Correct answer: Anomaly (UEBA)

Anomaly rules in Microsoft Sentinel use built-in ML models from UEBA to detect unusual behavior without requiring custom KQL.

Question 50: Which tool is most commonly used for real-time security monitoring in Microsoft environments?

Microsoft Word
Azure DevOps
Microsoft Outlook
Microsoft Sentinel (Correct answer)

Correct answer: Microsoft Sentinel

Microsoft Sentinel is a scalable, cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution. It is specifically designed for real-time security monitoring, threat detection, investigation, and response across an enterprise's entire digital estate within Microsoft environments. Its comprehensive capabilities make it the go-to tool for this purpose.

Question 51: A Sentinel analytic rule generates too many false positives because it triggers on service accounts. Which approach best reduces noise without disabling the rule?

Disable entity mapping for account entities
Increase the rule query frequency to daily
Add a watchlist of service accounts and use '!in' to exclude them in the query (Correct answer)
Switch the rule type from Scheduled to NRT

Correct answer: Add a watchlist of service accounts and use '!in' to exclude them in the query

Using a watchlist of known service accounts with '!in' exclusion filters suppresses false positives while keeping detection active for real user accounts.

Question 52: Which Microsoft Sentinel data connector ingests Azure Key Vault diagnostic logs to detect unauthorized key access attempts?

Azure Activity connector
Azure Key Vault connector via Azure Monitor / Diagnostic Settings (Correct answer)
Microsoft Defender for Cloud Apps connector
Microsoft 365 Defender connector

Correct answer: Azure Key Vault connector via Azure Monitor / Diagnostic Settings

Azure Key Vault diagnostic logs sent to a Log Analytics workspace via the Key Vault connector enable Sentinel to alert on suspicious key operations.

Question 53: A security analyst is reviewing a Defender for Identity alert about a 'Golden Ticket' attack. What does this attack type involve?

Forging Kerberos TGTs using a compromised KRBTGT account hash (Correct answer)
Escalating privileges via Azure RBAC misconfiguration
Intercepting NTLM challenge-response hashes on the network
Stealing OAuth tokens from Azure AD

Correct answer: Forging Kerberos TGTs using a compromised KRBTGT account hash

A Golden Ticket attack involves using a stolen KRBTGT hash to forge Kerberos Ticket Granting Tickets (TGTs), granting arbitrary access to any service.

Question 54: What is the primary benefit of security automation?

Reduces response time and minimizes errors (Correct answer)
Eliminates the need for security teams
Ignores low-priority alerts
Replaces all manual security processes

Correct answer: Reduces response time and minimizes errors

The primary benefit of security automation is its ability to streamline security operations by automating routine tasks, threat detection, and response actions. This leads to a significant reduction in the time required to address security events, minimizes the potential for human error in repetitive tasks, and allows security teams to focus on more complex strategic issues, thereby increasing overall efficiency and accuracy.

Question 55: A threat actor is using living-off-the-land binaries (LOLBins) to evade detection. Which Microsoft Defender for Endpoint capability is specifically designed to block this behavior?

Controlled Folder Access
Attack Surface Reduction (ASR) rules (Correct answer)
Endpoint Detection and Response (EDR)
Network Protection

Correct answer: Attack Surface Reduction (ASR) rules

Attack Surface Reduction rules include specific rules to block abuse of LOLBins like mshta.exe, wscript.exe, and others.

Question 56: A security analyst uses Microsoft Defender Vulnerability Management to prioritize patches. Which metric does the platform's Threat-Based Vulnerability Management feature use to elevate a CVE's priority above its CVSS score alone?

Active exploit kit or threat actor activity linked to the CVE (Correct answer)
Asset value tag assigned by the administrator
Number of affected devices across the tenant
Patch release date from the vendor

Correct answer: Active exploit kit or threat actor activity linked to the CVE

Threat-Based Vulnerability Management elevates CVE priority when active exploit kits or tracked threat actors are observed exploiting that vulnerability in the wild.

Question 57: Which Microsoft Sentinel Log Analytics workspace setting should be configured to meet a compliance requirement that security logs must be retained for 7 years?

Diagnostic settings
Workspace retention and archiving settings (Correct answer)
Purge policies
Data export rules

Correct answer: Workspace retention and archiving settings

Microsoft Sentinel workspace retention settings allow interactive retention up to 2 years and archival up to 12 years total to meet long-term compliance requirements.

Question 58: An organization wants to detect when an Azure resource is accessed from a Tor exit node IP address. Which Microsoft service provides the IP reputation data to enable this detection?

Microsoft Entra ID Protection
Microsoft Threat Intelligence (MSTI) (Correct answer)
Microsoft Defender for Endpoint
Azure DDoS Protection

Correct answer: Microsoft Threat Intelligence (MSTI)

Microsoft Threat Intelligence (MSTI) provides IP reputation data including Tor exit node classification, which Sentinel and Defender products use for enrichment and detection.

Question 59: Which Microsoft Sentinel feature allows analysts to visually investigate the relationships between entities such as accounts, IPs, and hosts involved in an incident?

Notebooks
Hunting queries
Workbooks
Investigation graph (Correct answer)

Correct answer: Investigation graph

The Investigation graph in Microsoft Sentinel provides a visual map of entity relationships and timeline for an incident.

Question 60: A security operations team wants to receive alerts whenever a new Global Administrator is added in their tenant. Which Microsoft Sentinel source provides this data?

Microsoft 365 Defender Incidents API
Azure Policy compliance logs
Microsoft Entra ID AuditLogs via the Azure AD connector (Correct answer)
Microsoft Defender for Endpoint via MDE connector

Correct answer: Microsoft Entra ID AuditLogs via the Azure AD connector

Entra ID AuditLogs record all administrative changes including role assignments, and the Azure AD connector streams these into Sentinel for alerting.

SC-200: Microsoft Security Operations Analyst

The SC-200 exam validates skills in threat management, monitoring, and response using Microsoft security solutions including Microsoft Sentinel, Microsoft Defender XDR, and Microsoft Defender for Cloud. It leads to the Microsoft Certified: Security Operations Analyst Associate certification.

Questions

100 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

learn.microsoft.com — Score validity, test delivery, renewal, retake fee, exam format, passing score, time limit, exam information · verified Oct 2026