Sign in

Free SC-200 sample questions

Real questions from the Security Operations Analyst practice bank, with the correct answer and an explanation for each one. No junk, no filler.

Try them in the simulator Same questions, with study, timed and flashcard modes.

Showing 20 of 40 free sample questions.

Question 13Choose one

A new SOC analyst is learning about the different roles within Microsoft Sentinel. A senior analyst needs to be able to manage incidents, run playbooks, and dismiss false positives, but should NOT be able to modify analytics rules, data connectors, or workspace settings. Which built-in Azure role is most appropriate to assign to the senior analyst at the resource group level where Sentinel resides?

Question 14Choose one

An organization is concerned about credential theft from LSASS memory on their servers. The security team wants to use Microsoft Defender for Endpoint to block this type of attack. Which security feature should they configure?

Question 15Choose one

A security analyst is writing a KQL query in Microsoft Sentinel to summarize the number of alerts generated by each analytics rule in the last 24 hours. The query should display two columns: the rule name and the count of alerts. Which query is correctly written? pie title Alert Distribution by Rule "Brute Force Attempt": 45 "Malicious IP Login": 25 "Impossible Travel": 15 "Anomalous Download": 15

Question 16Choose one

A security engineer is configuring data collection for a fleet of Windows Servers using the Azure Monitor Agent (AMA). To optimize costs, the organization requires that only specific Security Event IDs (4624 and 4625) be ingested into Microsoft Sentinel. The engineer creates a Data Collection Rule (DCR). Which configuration step is required within the DCR to achieve this granular filtering at the source?

Question 17Choose one

A SOC team wants to implement an automated response that blocks a malicious IP address on an on-premises Cisco firewall whenever a specific high-severity incident is triggered in Microsoft Sentinel. The automation will use a Logic App. Which component is ESSENTIAL to allow the cloud-based Logic App to communicate securely with the on-premises firewall?

Question 18Choose one

A threat hunter is investigating a potential compromise involving a list of suspicious IP addresses provided by a third-party threat intelligence vendor. The list is stored in a CSV file hosted on an Azure Blob Storage container that is publicly accessible via a SAS token. The hunter needs to cross-reference this list with the `SigninLogs` table in Microsoft Sentinel. Which KQL operator should the hunter use to ingest this external CSV data directly into the query context?

Question 19Choose one

A security analyst is creating a new analytics rule in Microsoft Sentinel. The goal is to detect a high volume of failed sign-in attempts within a short timeframe. The analyst decides to use a Near-Real-Time (NRT) analytics rule instead of a standard Scheduled rule. What is a key limitation of NRT rules that the analyst must consider?

Question 20Choose one

You are a security administrator using Microsoft Defender for Endpoint. You have identified a device (DeviceA) that is currently communicating with a known Command and Control (C2) server. You need to immediately prevent this device from accessing the network while allowing connectivity to the Defender for Endpoint service for further investigation. Which action should you perform?

20 more free samples are waiting

Create a free account to unlock the whole SC-200 sample bank, or get full access to all 297 practice questions in the simulator.

Create account