SC-200 Study Guide 2026
Everything you need to pass the SC-200 exam in one place: the exam format, every topic to study, real practice questions with explanations, flashcards, and full-length practice tests. Free, no sign-up needed.
📋 SC-200 Exam Format at a Glance
📚 SC-200 Topics to Study (63)
✍️ Sample SC-200 Questions & Answers
1. A vulnerability scan of an AKS cluster reveals that a pod is running as root. Which Microsoft Defender for Containers check would flag this as a misconfiguration?
Defender for Containers maps to CIS Kubernetes Benchmark controls, and running containers as root violates the control 'Containers should not run as root user (UID 0).'
2. Which MITRE ATT&CK tactic describes an adversary's attempt to avoid detection while maintaining access to a network?
Defense Evasion encompasses techniques adversaries use to avoid detection, such as disabling security tools, obfuscating code, or clearing logs.
3. Which Azure Sentinel (Microsoft Sentinel) feature automatically maps detected threats to the MITRE ATT&CK framework?
Analytics rule templates in Microsoft Sentinel include MITRE ATT&CK tactic and technique mappings to help analysts contextualize alerts.
4. An analyst notices a threat indicator in Sentinel with a 'Confidence' value of 45. How should this indicator be treated?
A confidence value of 45 (out of 100) indicates low confidence, meaning the indicator should be treated as a weak signal that requires additional evidence before taking action.
5. A Logic Apps playbook fails intermittently when querying Microsoft Sentinel. Which best practice reduces transient failures?
Configuring retry policies on connector actions handles transient API errors and improves playbook reliability.
6. Which Microsoft Entra ID report helps identify users who have not completed MFA registration and are at risk under a Conditional Access policy requiring MFA?
The Authentication methods usage and insights report shows MFA registration status per user, identifying gaps before enforcement causes lockouts.