Free SC-200 sample questions
Real questions from the Security Operations Analyst practice bank, with the correct answer and an explanation for each one. No junk, no filler.
Try them in the simulator Same questions, with study, timed and flashcard modes.
Showing 20 of 40 free sample questions.
A SOC analyst is using Microsoft Defender for Endpoint's live response feature to investigate a potentially compromised device. The analyst needs to upload a forensic analysis script to the device, execute it, and then download the resulting output file for offline analysis. Which sequence of live response commands should the analyst use?
A security team has deployed Microsoft Defender for Cloud and enabled enhanced security features. They receive a high-severity alert indicating that Just-In-Time (JIT) VM access is not enabled for an internet-facing virtual machine. What is the primary risk mitigated by enabling JIT VM access?
A SOC manager wants to create a visual dashboard in Microsoft Sentinel to track the number of incidents by severity and assignee over the past 30 days. The dashboard must be interactive, allowing analysts to filter the data dynamically. Which Sentinel feature is best suited for this requirement?
A company is using Microsoft 365 and has a policy that prohibits employees from using unapproved cloud storage services. A security analyst needs to create a policy in Microsoft Defender for Cloud Apps that will block file uploads to any discovered cloud storage application that has a risk score below 6, while still allowing downloads. What type of policy should the analyst create?
A hospital uses Microsoft Sentinel for its security operations. To comply with HIPAA, the SOC team must retain all security logs for a minimum of seven years. The first 90 days of logs need to be available for fast, interactive querying, while the remaining data can be stored in a lower-cost tier. How should the security administrator configure data retention in the Log Analytics workspace?
A security analyst is investigating an alert from Microsoft Defender for Identity that indicates a potential Pass-the-Ticket attack. The alert details show that a user's Kerberos ticket was allegedly used from a workstation they do not typically access. What is the most effective next step for the analyst to take within the Microsoft Defender portal to validate this threat?
A SOC team needs to onboard a custom-developed, on-premises application's logs into Microsoft Sentinel. The application writes logs in a proprietary, multi-line text format to a local file. The logs must be parsed and structured into custom fields like 'TransactionID', 'UserID', and 'ErrorMessage' within a custom table named 'LegacyApp_CL'. What is the most appropriate method to achieve this?
During a threat hunt, a security analyst discovers a suspicious PowerShell command line executed on several machines. The analyst wants to save the KQL query and its results, add contextual notes about the findings, and map the activity to a MITRE ATT&CK technique. Which Microsoft Sentinel feature is designed for this purpose?
A company wants to prevent users from accidentally sharing documents containing credit card numbers via Microsoft Teams. The security team creates a Microsoft Purview Data Loss Prevention (DLP) policy. An employee attempts to share a text file with 20 credit card numbers in a Teams chat. What is the expected outcome?
An organization has configured Microsoft Defender for Office 365. An analyst is reviewing the Threat protection status report and notices a large spike in emails categorized as 'ZAP'. What does this indicate?
A security analyst needs to create a KQL query that joins email attachment information with device file creation events to trace a malicious attachment from receipt to execution. The tables to be used are `EmailAttachmentInfo` and `DeviceFileEvents`. The join must be based on the file's SHA256 hash. Complete the following KQL query by selecting the correct operator. `EmailAttachmentInfo` `| where isnotempty(SHA256)` `| _____ (DeviceFileEvents) on SHA256`
20 more free samples are waiting
Create a free account to unlock the whole SC-200 sample bank, or get full access to all 297 practice questions in the simulator.