SC-200: Microsoft Security Operations Analyst — Questions and Answers

Question 1: An analyst suspects credential dumping via lsass.exe on a Windows endpoint. Which Microsoft Defender for Endpoint detection would most directly confirm this activity?

An alert for 'Suspicious process accessed LSASS memory' (Correct answer)
A network connection alert to a C2 domain
A vulnerability finding for CVE-2021-34527
A software inventory entry for Mimikatz

Correct answer: An alert for 'Suspicious process accessed LSASS memory'

MDE detects and alerts on processes that read LSASS memory using techniques consistent with credential dumping tools like Mimikatz.

Question 2: What is the main advantage of machine learning in threat detection?

Ignores unknown attack patterns
Detects complex cyber threats through pattern recognition (Correct answer)
Eliminates the need for human analysts
Relies only on predefined attack signatures

Correct answer: Detects complex cyber threats through pattern recognition

Machine learning significantly enhances threat detection by enabling systems to analyze vast amounts of data and identify subtle, complex patterns indicative of malicious activity that might be missed by traditional signature-based methods. This capability allows for the detection of novel and evolving cyber threats, including polymorphic malware and advanced persistent threats, through sophisticated pattern recognition.

Question 3: In the kill chain model, which phase does a threat actor typically focus on when they send spear-phishing emails with malicious attachments?

Delivery (Correct answer)
Exploitation
Reconnaissance
Weaponization

Correct answer: Delivery

The Delivery phase of the Cyber Kill Chain involves transmitting the weaponized payload to the target, with spear-phishing emails being one of the most common delivery mechanisms.

Question 4: A Conditional Access policy uses 'Sign-in risk' as a condition. Which back-end service evaluates the sign-in risk score in real time?

Microsoft Sentinel Analytics
Microsoft Defender for Endpoint
Azure AD Smart Lockout
Microsoft Entra ID Protection (Identity Protection) (Correct answer)

Correct answer: Microsoft Entra ID Protection (Identity Protection)

Microsoft Entra ID Protection computes real-time sign-in risk scores using machine learning and feeds them to Conditional Access for policy enforcement.

Question 5: Which Microsoft Entra ID feature provides just-in-time privileged access with approval workflows and time-limited role assignments?

Privileged Identity Management (PIM) (Correct answer)
Azure AD Roles (permanent assignment)
Entra ID Protection user risk policy
Administrative Units

Correct answer: Privileged Identity Management (PIM)

PIM enables eligible users to activate privileged roles on-demand with approval workflows and enforces time-limited assignments to reduce standing privilege.

Question 6: Which log source in Microsoft Sentinel contains details about Azure resource authorization failures, including RBAC denials?

SecurityAlert
AzureActivity (Correct answer)
AzureDiagnostics
SigninLogs

Correct answer: AzureActivity

The AzureActivity table logs Azure Resource Manager operations including authorization failures, role assignments, and resource-level RBAC decisions.

Question 7: An SC-200 analyst reviews a Defender for Endpoint alert about a process calling BCryptEncrypt with a hardcoded key. What security concern does hardcoding encryption keys represent?

It prevents key rotation and exposes the key to static analysis or binary extraction (Correct answer)
It prevents use of AES and forces DES fallback
It causes encryption to fail on FIPS-compliant systems
It triggers automatic revocation by Windows CNG

Correct answer: It prevents key rotation and exposes the key to static analysis or binary extraction

Hardcoded keys cannot be rotated and can be extracted through reverse engineering, making the encryption trivially breakable.

Question 8: You want to hunt for suspicious PowerShell executions across all endpoints in your organization. Which tool in Microsoft Defender XDR should you use?

Advanced Hunting (Correct answer)
Device Inventory
Security Score
Threat Analytics

Correct answer: Advanced Hunting

Advanced Hunting uses KQL to query up to 30 days of raw telemetry across endpoints, email, identity, and cloud apps.

Question 9: When configuring Always Encrypted in Azure SQL Database, where must the Column Encryption Key (CEK) be stored to maintain security?

In the SQL Server master database
In Azure Key Vault or a local certificate store, never in the database (Correct answer)
In the application's config file encrypted with DPAPI
In the Azure SQL transparent data encryption settings

Correct answer: In Azure Key Vault or a local certificate store, never in the database

Always Encrypted stores only the encrypted CEK value in the database; the plaintext CEK is protected by a Column Master Key kept in a trusted key store like Azure Key Vault.

Question 10: What is the primary benefit of security automation?

Replaces all manual security processes
Reduces response time and minimizes errors (Correct answer)
Ignores low-priority alerts
Eliminates the need for security teams

Correct answer: Reduces response time and minimizes errors

The primary benefit of security automation is its ability to streamline security operations by automating routine tasks, threat detection, and response actions. This leads to a significant reduction in the time required to address security events, minimizes the potential for human error in repetitive tasks, and allows security teams to focus on more complex strategic issues, thereby increasing overall efficiency and accuracy.

Question 11: You are reviewing an Azure architecture where virtual machines in a spoke VNet must communicate with on-premises servers through a hub VNet. Which Azure service should you place in the hub to inspect and filter this traffic?

Network Security Groups
Azure DDoS Protection
Azure Application Gateway
Azure Firewall (Correct answer)

Correct answer: Azure Firewall

Azure Firewall is a managed, stateful firewall deployed in the hub VNet that inspects east-west and north-south traffic in a hub-and-spoke topology.

Question 12: A playbook in Microsoft Sentinel needs to enrich an incident with threat intelligence data from an external API. Which Logic Apps connector action is most appropriate?

Azure Function with managed identity
Service Bus trigger
Event Hub output connector
HTTP action to call the external REST API (Correct answer)

Correct answer: HTTP action to call the external REST API

The HTTP action in Logic Apps allows playbooks to call external REST APIs to retrieve enrichment data.

Question 13: Which tool is most commonly used for real-time security monitoring in Microsoft environments?

Azure DevOps
Microsoft Outlook
Microsoft Word
Microsoft Sentinel (Correct answer)

Correct answer: Microsoft Sentinel

Microsoft Sentinel is a scalable, cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution. It is specifically designed for real-time security monitoring, threat detection, investigation, and response across an enterprise's entire digital estate within Microsoft environments. Its comprehensive capabilities make it the go-to tool for this purpose.

Question 14: Which NIST Cybersecurity Framework function focuses on developing organizational understanding to manage cybersecurity risk to systems, people, assets, data, and capabilities?

Detect
Respond
Identify (Correct answer)
Protect

Correct answer: Identify

The Identify function of NIST CSF focuses on developing organizational understanding of cybersecurity risks across systems, assets, data, and capabilities.

Question 15: Which permission is required for a managed identity used by a Logic Apps playbook to add comments to a Microsoft Sentinel incident?

Microsoft Sentinel Reader
Microsoft Sentinel Responder (Correct answer)
Microsoft Sentinel Contributor
Security Administrator

Correct answer: Microsoft Sentinel Responder

Microsoft Sentinel Responder allows playbooks to update incidents, add comments, and change status without full contributor rights.

Question 16: During incident triage in Microsoft Defender XDR, an analyst wants to correlate alerts from Defender for Endpoint, Defender for Office 365, and Defender for Identity into a single view. Which feature provides this unified correlation?

Threat Analytics reports
Microsoft Entra ID Protection risk events
Individual product alert queues
Incidents page in the Microsoft Defender portal (Correct answer)

Correct answer: Incidents page in the Microsoft Defender portal

The Incidents page in the Microsoft Defender portal correlates alerts across all Defender products into unified incidents showing the full attack chain.

Question 17: Which KQL operator is used in Microsoft Sentinel to join two tables and return only rows that have matching values in both tables?

join kind=leftouter
lookup
join kind=inner (Correct answer)
union

Correct answer: join kind=inner

join kind=inner returns only rows with matches in both the left and right tables.

Question 18: An attacker uses a compromised host to pivot to other internal systems without generating external traffic. Which Defender for Endpoint feature helps detect this lateral movement?

Endpoint detection and response (EDR) behavioral sensors (Correct answer)
Microsoft Secure Score
Application Guard
Automated investigation and remediation (AIR)

Correct answer: Endpoint detection and response (EDR) behavioral sensors

EDR behavioral sensors continuously monitor process activity, network connections, and file events to detect lateral movement techniques on endpoints.

Question 19: In Microsoft Sentinel, which data connector provides sign-in logs and audit logs from Microsoft Entra ID?

Office 365 connector
Azure Active Directory connector (Correct answer)
Microsoft Defender for Cloud connector
Microsoft 365 Defender connector

Correct answer: Azure Active Directory connector

The Azure Active Directory (Microsoft Entra ID) connector streams SigninLogs, AuditLogs, and other identity logs directly into Microsoft Sentinel.

Question 20: Under HIPAA Security Rule, covered entities must conduct which activity to identify potential risks and vulnerabilities to ePHI?

Annual penetration testing
SOC 2 Type II audit
Risk analysis (Correct answer)
Business impact assessment

Correct answer: Risk analysis

HIPAA Security Rule (45 CFR § 164.308(a)(1)) requires covered entities to conduct a risk analysis to identify potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI.

Question 21: An organization wants to automatically trigger an isolation playbook in Microsoft Sentinel when a high-severity alert involving a specific host is generated. What should the analyst configure?

A workbook with a saved query
A watchlist with host IP addresses
An analytics rule with an automation rule that runs a playbook (Correct answer)
A data connector with custom parsing

Correct answer: An analytics rule with an automation rule that runs a playbook

Analytics rules detect threats and automation rules can trigger Logic Apps (playbooks) based on incident conditions such as severity and entity type.

Question 22: A healthcare organization needs to share a Microsoft Sentinel playbook with their MSSP to respond to HIPAA-related incidents. What must be considered regarding PHI in the playbook?

HIPAA prohibits sharing any security playbooks with external parties
Ensure the playbook does not log or transmit PHI to external services without a BAA in place (Correct answer)
The MSSP automatically becomes a covered entity by receiving the playbook
Playbooks cannot contain any patient data so sharing is always safe

Correct answer: Ensure the playbook does not log or transmit PHI to external services without a BAA in place

Before sharing automated playbooks that may handle PHI, organizations must ensure a Business Associate Agreement (BAA) is in place and that no PHI is transmitted to unauthorized external services.

Question 23: A security analyst is reviewing Microsoft Defender for Cloud and notices a resource has a High severity recommendation to enable disk encryption. After applying encryption, how does Defender for Cloud reflect the remediation?

The resource is automatically tagged as compliant
It sends an email notification to the subscription owner
It generates a new alert confirming remediation
The recommendation moves to a healthy state and Secure Score increases (Correct answer)

Correct answer: The recommendation moves to a healthy state and Secure Score increases

Once a recommendation is remediated, Defender for Cloud marks it as healthy during the next assessment cycle and the Secure Score increases accordingly.

Question 24: In Microsoft Defender Threat Intelligence (MDTI), what does the 'Reputation' score of an artifact primarily indicate?

The age of the threat indicator in the database
The likelihood that the artifact is associated with malicious activity (Correct answer)
The severity of the CVE associated with the artifact
The number of times the indicator has been observed globally

Correct answer: The likelihood that the artifact is associated with malicious activity

MDTI Reputation scores indicate the likelihood that an artifact (IP, domain, hash) is malicious based on historical threat data and behavioral signals.

Question 25: What is the purpose of a post-incident review?

Punish the responsible team members
Ignore the incident and move on
Erase all incident logs
Analyze and improve security measures (Correct answer)

Correct answer: Analyze and improve security measures

A post-incident review, also known as a lessons learned session, is conducted after an incident has been resolved to analyze what happened, how it was handled, and what could be improved. Its purpose is to identify weaknesses in security controls, refine incident response procedures, and implement changes to prevent similar incidents in the future, thereby continuously improving security measures.

Question 26: Which KQL function is used to detect anomalies in a time series within Microsoft Sentinel, returning a spike or drop indicator?

series_decompose_anomalies() (Correct answer)
series_fir()
anomalychart()
series_outliers()

Correct answer: series_decompose_anomalies()

series_decompose_anomalies() decomposes a time series into trend, seasonality, and residual, then flags statistical anomalies.

Question 27: Which Microsoft Defender for Cloud plan provides just-in-time (JIT) VM access to reduce the attack surface of management ports?

Defender CSPM
Defender for Containers
Defender for App Service
Defender for Servers (Correct answer)

Correct answer: Defender for Servers

Defender for Servers includes JIT VM access, which blocks inbound traffic to management ports like RDP/SSH and opens them only on approved request.

Question 28: Which Microsoft Sentinel feature allows threat hunting by pivoting on threat intelligence indicators to find related entities across your environment?

Fusion ML detection
UEBA timeline
Hunting queries with ThreatIntelligenceIndicator joins (Correct answer)
Threat Intelligence Workbook

Correct answer: Hunting queries with ThreatIntelligenceIndicator joins

Analysts can write KQL hunting queries that join the ThreatIntelligenceIndicator table with other log tables to find entities matching known malicious indicators.

Question 29: You need to ensure Azure virtual machines can receive OS patches automatically without manual intervention. Which Azure feature handles this for Windows and Linux VMs?

Azure Automatic VM Guest Patching (Correct answer)
Microsoft Defender for Servers auto-provisioning
Azure Policy DeployIfNotExists
Azure Update Manager scheduled assessment

Correct answer: Azure Automatic VM Guest Patching

Azure Automatic VM Guest Patching automatically installs critical and security patches on VMs using a rolling, availability-aware approach.

Question 30: A Sentinel analytic rule generates too many false positives because it triggers on service accounts. Which approach best reduces noise without disabling the rule?

Disable entity mapping for account entities
Increase the rule query frequency to daily
Switch the rule type from Scheduled to NRT
Add a watchlist of service accounts and use '!in' to exclude them in the query (Correct answer)

Correct answer: Add a watchlist of service accounts and use '!in' to exclude them in the query

Using a watchlist of known service accounts with '!in' exclusion filters suppresses false positives while keeping detection active for real user accounts.

Question 31: What is the primary difference between a threat intelligence 'Feed' and a threat intelligence 'Platform' (TIP) in an enterprise security context?

Feeds require TAXII while TIPs use proprietary APIs
Feeds are commercial products while TIPs are open-source tools
Feeds provide raw indicators only; TIPs aggregate, normalize, and operationalize intelligence from multiple feeds (Correct answer)
TIPs only support STIX format while feeds support any format

Correct answer: Feeds provide raw indicators only; TIPs aggregate, normalize, and operationalize intelligence from multiple feeds

Threat intelligence feeds provide raw indicator data, while a TIP aggregates data from multiple feeds, normalizes it, adds context, and enables operationalization through integrations with security tools.

Question 32: During an incident response, an analyst discovers a malicious scheduled task set to run at user logon. Which Microsoft Defender for Endpoint live response command would remove the scheduled task from the compromised endpoint?

run schtasks /delete /tn <taskname> /f (Correct answer)
collect-investigation-package
isolate-device
remediate-file

Correct answer: run schtasks /delete /tn <taskname> /f

Using the Live Response console, the analyst can run native Windows commands like 'schtasks /delete' to remove the malicious scheduled task directly on the endpoint.

Question 33: After an insider threat incident, the organization wants to monitor for future bulk file downloads from SharePoint Online. Which Microsoft solution provides built-in policies specifically for cloud app anomaly detection of this behavior?

Microsoft Entra ID Protection
Microsoft Purview Insider Risk Management (Correct answer)
Microsoft Defender for Endpoint behavioral rules
Azure Monitor diagnostic logs

Correct answer: Microsoft Purview Insider Risk Management

Microsoft Purview Insider Risk Management includes built-in policies for detecting data theft sequences such as bulk file downloads from SharePoint and OneDrive.

Question 34: Which Azure Sentinel (Microsoft Sentinel) feature automatically maps detected threats to the MITRE ATT&CK framework?

Analytics rule templates (Correct answer)
Workbooks
Fusion ML detections
Entity behavior analytics

Correct answer: Analytics rule templates

Analytics rule templates in Microsoft Sentinel include MITRE ATT&CK tactic and technique mappings to help analysts contextualize alerts.

Question 35: What is the purpose of the 'Entity behavior analytics' (UEBA) feature in Microsoft Sentinel?

To establish baselines and detect anomalous behavior per user and entity (Correct answer)
To automatically remediate vulnerabilities on endpoints
To correlate threat intelligence with network traffic
To block malicious IPs in real time

Correct answer: To establish baselines and detect anomalous behavior per user and entity

UEBA builds behavioral baselines per user, device, and application, then assigns risk scores when observed behavior deviates from those baselines.

Question 36: Which advanced hunting KQL query technique allows a Defender XDR analyst to parameterize a query and reuse it across multiple investigations?

Saved functions in the Sentinel function library (Correct answer)
Query packs with variables
let statements with function definitions saved as custom detection queries
Stored procedures

Correct answer: Saved functions in the Sentinel function library

Microsoft Sentinel allows saving KQL as reusable functions in the workspace function library, which can be called by name in any query.

Question 37: Which network security control inspects encrypted HTTPS traffic to detect threats hidden within TLS sessions?

802.1X port authentication
BGP route filtering
Network Access Control (NAC)
TLS/SSL inspection (deep packet inspection) (Correct answer)

Correct answer: TLS/SSL inspection (deep packet inspection)

TLS/SSL inspection decrypts, inspects, and re-encrypts traffic to allow security appliances to detect malware and data exfiltration inside HTTPS.

Question 38: What is the role of a honeypot in network security monitoring?

Filter spam email from reaching users
Accelerate legitimate web application performance
Decoy system designed to lure and detect attackers (Correct answer)
Encrypt sensitive data at rest

Correct answer: Decoy system designed to lure and detect attackers

A honeypot is a deliberately vulnerable decoy resource that attracts attackers, generating high-fidelity alerts when accessed since no legitimate user should interact with it.

Question 39: What does the 'bag_unpack' plugin do in a KQL query within Microsoft Sentinel?

Expands a dynamic property bag column into separate columns (Correct answer)
Decompresses compressed log data
Unpacks nested arrays into rows
Decodes base64-encoded fields

Correct answer: Expands a dynamic property bag column into separate columns

bag_unpack expands a dynamic (JSON) property bag into individual columns, making nested fields queryable.

Question 40: A SOC analyst needs to determine whether a suspicious PowerShell command executed on an endpoint was encoded. Which KQL function decodes a Base64-encoded command line in an Advanced Hunting query?

parse_json()
base64_decode_tostring() (Correct answer)
extract()
split()

Correct answer: base64_decode_tostring()

The KQL function base64_decode_tostring() decodes Base64-encoded strings, revealing obfuscated PowerShell commands in hunting queries.

Question 41: Which Microsoft Sentinel feature allows analysts to visually investigate the relationships between entities such as accounts, IPs, and hosts involved in an incident?

Investigation graph (Correct answer)
Notebooks
Workbooks
Hunting queries

Correct answer: Investigation graph

The Investigation graph in Microsoft Sentinel provides a visual map of entity relationships and timeline for an incident.

Question 42: A SOC analyst is reviewing a Defender for Cloud recommendation classified as 'High' severity. What does this severity indicate?

The misconfiguration poses a significant risk and should be prioritized for remediation (Correct answer)
The resource has been quarantined automatically
The resource is actively under attack
The finding violates a specific regulatory requirement

Correct answer: The misconfiguration poses a significant risk and should be prioritized for remediation

High severity in Defender for Cloud indicates a misconfiguration or vulnerability that poses significant security risk and warrants prompt remediation.

Question 43: Which technique does an adversary use when they compress and encrypt data before sending it outbound to avoid data loss prevention (DLP) detection?

Credential dumping
Exfiltration over command-and-control channel with encoding (Correct answer)
Kerberoasting
Pass-the-hash

Correct answer: Exfiltration over command-and-control channel with encoding

Encoding or encrypting exfiltrated data before transmission is a common DLP evasion technique classified under MITRE ATT&CK T1048 (Exfiltration Over Alternative Protocol) and T1560 (Archive Collected Data).

Question 44: In the context of SC-200, what does 'diamond model' help analysts understand in threat intelligence analysis?

A tiered severity model for classifying threats
The relationships between adversary, capability, infrastructure, and victim (Correct answer)
The financial cost structure of a cyberattack
The four phases of the NIST incident response lifecycle

Correct answer: The relationships between adversary, capability, infrastructure, and victim

The Diamond Model of Intrusion Analysis describes the core features of an intrusion event: the adversary, their capabilities, the infrastructure used, and the victim — and the relationships between them.

Question 45: Which KQL operator would you use in Microsoft Sentinel to join the SecurityAlert table with the IdentityInfo table to enrich alerts with user department information?

extend
join (Correct answer)
union
lookup

Correct answer: join

The KQL 'join' operator merges rows from two tables based on a matching key, enabling enrichment of alerts with identity data.

Question 46: What is a benefit of aligning security policies with compliance requirements?

Increase regulatory fines
Reduce legal risks and enhance security (Correct answer)
Reduce the need for security controls
Complicate security operations

Correct answer: Reduce legal risks and enhance security

Aligning security policies with compliance requirements helps organizations meet their legal and regulatory obligations, thereby significantly reducing the risk of fines, penalties, and legal action. This alignment also inherently strengthens the organization's overall security posture by implementing best practices mandated by various regulations, leading to enhanced security.

Question 47: An analyst uses 'externaldata' in a KQL query. What is the primary use case for this operator in Microsoft Sentinel hunting?

Export query results to external storage
Connect to on-premises SQL databases
Import reference data from a URL (e.g., threat intel CSV) into a query (Correct answer)
Query external SIEM systems

Correct answer: Import reference data from a URL (e.g., threat intel CSV) into a query

externaldata loads tabular data from an external URL like Azure Blob Storage into a KQL query for enrichment or lookups.

Question 48: A red team successfully exfiltrates data by encoding it in DNS query names to an external resolver. Which Microsoft Defender for Endpoint capability is best positioned to detect this DNS tunneling activity?

Web content filtering by category
Network protection with SmartScreen integration
Azure Firewall DNS proxy logging
Defender for Endpoint's behavioral sensor detecting suspicious DNS query patterns (Correct answer)

Correct answer: Defender for Endpoint's behavioral sensor detecting suspicious DNS query patterns

MDE's behavioral sensor analyzes process-level DNS query patterns and can detect anomalous high-entropy or high-frequency DNS queries indicative of DNS tunneling exfiltration.

Question 49: In Microsoft Sentinel, what is the purpose of the 'entity mapping' section in an analytic rule?

Maps log fields to MITRE ATT&CK techniques
Maps query output fields to recognized entity types for incident enrichment (Correct answer)
Defines how alerts are grouped into incidents
Specifies which workbook to update

Correct answer: Maps query output fields to recognized entity types for incident enrichment

Entity mapping links query result columns to entity types (Account, IP, Host) so Sentinel can enrich incidents with entity context.

Question 50: What is the importance of staying current with trends in Threat Intelligence & Analysis for Microsoft Security Operations Analyst?

It ensures practices remain effective and relevant (Correct answer)
It is not necessary once certified
It is only required for new professionals
Trends do not affect professional practice

Correct answer: It ensures practices remain effective and relevant

Staying current with industry trends ensures that professional practices remain effective, relevant, and aligned with evolving standards.

SC-200: Microsoft Security Operations Analyst

The SC-200 exam validates skills in threat management, monitoring, and response using Microsoft security solutions including Microsoft Sentinel, Microsoft Defender XDR, and Microsoft Defender for Cloud. It leads to the Microsoft Certified: Security Operations Analyst Associate certification.

Questions

35 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds