SC-200: Microsoft Security Operations Analyst — Questions and Answers

Question 1: In a Microsoft Sentinel playbook, an analyst needs to parse a JSON field returned from an HTTP action before using its values. Which Logic Apps action should they use?

Select
Filter array
Compose
Parse JSON (Correct answer)

Correct answer: Parse JSON

The 'Parse JSON' action deserializes a JSON string into a structured object whose fields can be referenced in subsequent steps.

Question 2: What is a fundamental principle of Cloud Security Architecture in Microsoft Security Operations Analyst practice?

Working in isolation without guidance
Using outdated methods
Ignoring industry guidelines
Following established standards and best practices (Correct answer)

Correct answer: Following established standards and best practices

Following established standards and best practices ensures quality and consistency in Cloud Security Architecture.

Question 3: Which Microsoft Sentinel data connector uses the Common Event Format (CEF) over Syslog to ingest logs from third-party security appliances?

HTTP Data Collector API
CEF via AMA (Correct answer)
Azure Monitor Agent
Log Analytics API

Correct answer: CEF via AMA

The CEF via Azure Monitor Agent connector forwards CEF-formatted syslog messages from Linux forwarders directly into Microsoft Sentinel.

Question 4: In Microsoft Defender XDR, what does 'go hunt' on an alert entity automatically do?

Opens a new incident containing the alert
Submits the entity to Microsoft Threat Intelligence
Creates a suppression rule for similar alerts
Launches a pre-populated advanced hunting query scoped to that entity (Correct answer)

Correct answer: Launches a pre-populated advanced hunting query scoped to that entity

'Go hunt' pre-populates an advanced hunting query filtered to the selected entity, accelerating investigation.

Question 5: Which Microsoft Sentinel feature uses machine learning to correlate low-fidelity alerts from multiple products into high-fidelity incidents without requiring custom rules?

NRT (Near Real-Time) rules
Scheduled analytic rules
Anomaly rules
Fusion detection (Correct answer)

Correct answer: Fusion detection

Fusion uses ML to correlate signals across multiple Microsoft and third-party products, producing high-confidence incidents from low-signal alerts.

Question 6: A security analyst uses Microsoft Defender Vulnerability Management to prioritize patches. Which metric does the platform's Threat-Based Vulnerability Management feature use to elevate a CVE's priority above its CVSS score alone?

Number of affected devices across the tenant
Active exploit kit or threat actor activity linked to the CVE (Correct answer)
Patch release date from the vendor
Asset value tag assigned by the administrator

Correct answer: Active exploit kit or threat actor activity linked to the CVE

Threat-Based Vulnerability Management elevates CVE priority when active exploit kits or tracked threat actors are observed exploiting that vulnerability in the wild.

Question 7: What is the importance of staying current with trends in Security Operations & Monitoring for Microsoft Security Operations Analyst?

It is only required for new professionals
Trends do not affect professional practice
It ensures practices remain effective and relevant (Correct answer)
It is not necessary once certified

Correct answer: It ensures practices remain effective and relevant

Staying current with industry trends ensures that professional practices remain effective, relevant, and aligned with evolving standards.

Question 8: An attacker performs a Kerberoasting attack to obtain service ticket hashes. Which encryption type is easiest to crack offline and indicates a misconfiguration?

DES-CBC-MD5 (disabled by default in modern AD)
AES256-CTS-HMAC-SHA1-96
RC4-HMAC (NTLM-based Kerberos encryption) (Correct answer)
AES128-CTS-HMAC-SHA1-96

Correct answer: RC4-HMAC (NTLM-based Kerberos encryption)

RC4-HMAC encrypted service tickets are faster to crack offline than AES tickets; service accounts should be configured to require AES-only Kerberos encryption.

Question 9: What is the main advantage of machine learning in threat detection?

Detects complex cyber threats through pattern recognition (Correct answer)
Ignores unknown attack patterns
Eliminates the need for human analysts
Relies only on predefined attack signatures

Correct answer: Detects complex cyber threats through pattern recognition

Machine learning significantly enhances threat detection by enabling systems to analyze vast amounts of data and identify subtle, complex patterns indicative of malicious activity that might be missed by traditional signature-based methods. This capability allows for the detection of novel and evolving cyber threats, including polymorphic malware and advanced persistent threats, through sophisticated pattern recognition.

Question 10: A company's security team wants to receive a Teams notification whenever a Critical incident is created in Microsoft Sentinel. What is the MOST efficient way to implement this?

Configure an automation rule that triggers a playbook with a Teams connector (Correct answer)
Use a Logic App triggered by a custom webhook
Write a custom Azure Function
Set up an email alert in Azure Monitor

Correct answer: Configure an automation rule that triggers a playbook with a Teams connector

An automation rule in Sentinel can trigger a Logic App (playbook) when an incident is created, and the playbook can use the Teams connector to post a message.

Question 11: A threat hunter writes a KQL query to find processes that load known cryptomining libraries. Which table in Microsoft Defender for Endpoint (via advanced hunting) should they query?

EmailAttachmentInfo
SecurityAlert
DeviceNetworkEvents
DeviceImageLoadEvents (Correct answer)

Correct answer: DeviceImageLoadEvents

DeviceImageLoadEvents records DLL and library load events, making it ideal for detecting cryptomining or suspicious module loads.

Question 12: Which skill is most important for success in Cloud Security Architecture within Microsoft Security Operations Analyst?

Working without any training
Continuous learning and adaptation (Correct answer)
Resisting change
Avoiding feedback

Correct answer: Continuous learning and adaptation

Continuous learning ensures professionals stay current with evolving practices in Cloud Security Architecture.

Question 13: Which skill is most important for success in Threat Intelligence & Analysis within Microsoft Security Operations Analyst?

Continuous learning and adaptation (Correct answer)
Resisting change
Avoiding feedback
Working without any training

Correct answer: Continuous learning and adaptation

Continuous learning ensures professionals stay current with evolving practices in Threat Intelligence & Analysis.

Question 14: During an incident investigation, you need to collect a forensic memory dump from a compromised Windows endpoint without physically accessing it. Which Defender for Endpoint capability enables this?

Automated investigation
Live response (Correct answer)
Device isolation
Threat and vulnerability management

Correct answer: Live response

Live response in Microsoft Defender for Endpoint provides a remote shell to collect files, run scripts, and capture forensic artifacts like memory dumps from endpoints.

Question 15: Which Microsoft Purview feature uses encryption to restrict who can access sensitive documents even after they are downloaded outside the organization?

Microsoft Defender for Cloud Apps session policies
Microsoft Purview Information Protection sensitivity labels with encryption (Correct answer)
Azure AD Conditional Access app control
Data Loss Prevention (DLP) policies

Correct answer: Microsoft Purview Information Protection sensitivity labels with encryption

Sensitivity labels in Microsoft Purview can apply AES encryption and usage rights that persist with the document regardless of where it is stored.

Question 16: Which permission is required for a managed identity used by a Logic Apps playbook to add comments to a Microsoft Sentinel incident?

Microsoft Sentinel Reader
Security Administrator
Microsoft Sentinel Responder (Correct answer)
Microsoft Sentinel Contributor

Correct answer: Microsoft Sentinel Responder

Microsoft Sentinel Responder allows playbooks to update incidents, add comments, and change status without full contributor rights.

Question 17: When configuring User and Entity Behavior Analytics (UEBA) in Microsoft Sentinel, which data source provides the baseline for anomaly scoring of Azure AD sign-in behavior?

Microsoft Defender for Endpoint logs
Azure AD sign-in and audit logs (Correct answer)
Azure Activity logs
Office 365 audit logs

Correct answer: Azure AD sign-in and audit logs

UEBA baselines Azure AD sign-in and audit logs to establish normal user behavior patterns and score deviations.

Question 18: Which advanced hunting KQL query technique allows a Defender XDR analyst to parameterize a query and reuse it across multiple investigations?

Query packs with variables
Saved functions in the Sentinel function library (Correct answer)
let statements with function definitions saved as custom detection queries
Stored procedures

Correct answer: Saved functions in the Sentinel function library

Microsoft Sentinel allows saving KQL as reusable functions in the workspace function library, which can be called by name in any query.

Question 19: An organization uses Microsoft Defender Vulnerability Management and wants to track remediation work assigned to IT teams. Which built-in workflow feature enables an analyst to create and track these remediation tasks without leaving the Defender portal?

Create an Azure DevOps work item from the recommendation blade
Open a recommendation and export it to a CSV for the IT team
Use the 'Request remediation' feature to generate a remediation activity tracked in Defender Vulnerability Management (Correct answer)
Create a ServiceNow ticket via ITSM connector

Correct answer: Use the 'Request remediation' feature to generate a remediation activity tracked in Defender Vulnerability Management

'Request remediation' in Defender Vulnerability Management lets analysts submit remediation activities directly to IT administrators with due dates, tracked within the portal's Remediation page.

Question 20: What is the importance of staying current with trends in Threat Intelligence & Analysis for Microsoft Security Operations Analyst?

It is only required for new professionals
It ensures practices remain effective and relevant (Correct answer)
Trends do not affect professional practice
It is not necessary once certified

Correct answer: It ensures practices remain effective and relevant

Staying current with industry trends ensures that professional practices remain effective, relevant, and aligned with evolving standards.

Question 21: What is the role of machine learning in security analytics?

Replace the need for human analysts
Ignore false positive alerts
Automatically fix all security vulnerabilities
Identify patterns and detect anomalies (Correct answer)

Correct answer: Identify patterns and detect anomalies

Machine learning in security analytics is primarily used to process vast amounts of data to identify unusual patterns and detect anomalies. By learning from historical data, ML algorithms can flag deviations from normal behavior, which often indicate potential security threats or breaches that might otherwise go unnoticed by traditional rule-based systems.

Question 22: When onboarding a new Syslog data source to Microsoft Sentinel using AMA, which resource must be created to define which facilities and severities are collected?

Data Collection Endpoint (DCE)
Data Collection Rule (DCR) (Correct answer)
Sentinel analytics rule
Log Analytics saved search

Correct answer: Data Collection Rule (DCR)

A Data Collection Rule (DCR) defines the Syslog facilities, severities, and destination workspace for the Azure Monitor Agent.

Question 23: Which skill is most important for success in Security Operations & Monitoring within Microsoft Security Operations Analyst?

Continuous learning and adaptation (Correct answer)
Resisting change
Working without any training
Avoiding feedback

Correct answer: Continuous learning and adaptation

Continuous learning ensures professionals stay current with evolving practices in Security Operations & Monitoring.

Question 24: An analyst is reviewing a Microsoft Sentinel incident and sees multiple alerts grouped together. What determines whether alerts are grouped into the same incident?

Alert severity
The time of day the alert was triggered
The user account involved
Alert grouping settings in the analytics rule (Correct answer)

Correct answer: Alert grouping settings in the analytics rule

Alert grouping is configured within the analytics rule settings, allowing similar alerts to be merged into a single incident based on entity matching criteria.

Question 25: A playbook needs to add a tag to a Microsoft Sentinel incident when a specific entity IP is found in a threat intelligence watchlist. Which Logic Apps trigger should initiate this playbook?

Microsoft Sentinel — When a new alert is created
Microsoft Sentinel — When a response to a Microsoft Sentinel alert is triggered
Microsoft Sentinel — When Microsoft Sentinel incident creation rule was triggered (Correct answer)
Recurrence trigger every 15 minutes

Correct answer: Microsoft Sentinel — When Microsoft Sentinel incident creation rule was triggered

The 'When Microsoft Sentinel incident creation rule was triggered' trigger fires when an automation rule invokes the playbook at incident creation.

Question 26: In Microsoft Defender for Endpoint, what is the relationship between an 'alert' and an 'incident'?

Alerts come from third-party tools; incidents originate from Microsoft Defender tools
Incidents are low-severity findings; alerts are always high-severity
Alerts require manual investigation; incidents are always auto-remediated
An alert represents a single suspicious event; an incident is a collection of correlated alerts (Correct answer)

Correct answer: An alert represents a single suspicious event; an incident is a collection of correlated alerts

An alert represents a single suspicious activity detection, while an incident is Microsoft Defender's grouping of correlated alerts that together describe a broader attack story.

Question 27: What does SOAR stand for in cybersecurity?

Security Orchestration, Automation, and Response (Correct answer)
Secure Organizational and Automation Resources
Software Optimization and Attack Response
System Operations and Analytics Response

Correct answer: Security Orchestration, Automation, and Response

SOAR stands for Security Orchestration, Automation, and Response. It refers to a stack of software solutions and tools that allow organizations to collect security data from various sources, automate security operations tasks, and orchestrate incident response workflows. This framework helps improve the efficiency and effectiveness of security teams by streamlining their processes.

Question 28: A healthcare organization needs to share a Microsoft Sentinel playbook with their MSSP to respond to HIPAA-related incidents. What must be considered regarding PHI in the playbook?

Playbooks cannot contain any patient data so sharing is always safe
Ensure the playbook does not log or transmit PHI to external services without a BAA in place (Correct answer)
The MSSP automatically becomes a covered entity by receiving the playbook
HIPAA prohibits sharing any security playbooks with external parties

Correct answer: Ensure the playbook does not log or transmit PHI to external services without a BAA in place

Before sharing automated playbooks that may handle PHI, organizations must ensure a Business Associate Agreement (BAA) is in place and that no PHI is transmitted to unauthorized external services.

Question 29: Which key type stored in Azure Key Vault is used to wrap (encrypt) other encryption keys, following the envelope encryption pattern?

Certificate
Secret
Managed Identity
Key Encryption Key (KEK) (Correct answer)

Correct answer: Key Encryption Key (KEK)

A Key Encryption Key (KEK) encrypts Data Encryption Keys (DEKs), implementing envelope encryption to protect key material.

Question 30: A security operations center wants to measure improvements in their organization's vulnerability remediation posture over a 90-day period using Microsoft Defender Vulnerability Management. Which metric should they track?

Number of Defender for Cloud recommendations in 'Unhealthy' state
Microsoft Secure Score percentage change
Total number of high-severity incidents closed in Defender XDR
Exposure score trend over time in the Vulnerability Management dashboard (Correct answer)

Correct answer: Exposure score trend over time in the Vulnerability Management dashboard

The exposure score trend in Defender Vulnerability Management directly tracks the organization's overall vulnerability risk over time, making it the best metric for measuring remediation progress.

SC-200: Microsoft Security Operations Analyst

The SC-200 exam validates skills in threat management, monitoring, and response using Microsoft security solutions including Microsoft Sentinel, Microsoft Defender XDR, and Microsoft Defender for Cloud. It leads to the Microsoft Certified: Security Operations Analyst Associate certification.

Questions

35 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

learn.microsoft.com — Score validity, test delivery, renewal, retake fee, exam format, passing score, time limit, exam information · verified Oct 2026