SC-200 Microsoft Security Operations Analyst Free Practice Questions and Answers

An analyst is hunting for successful sign-ins followed by a privileged role assignment within 30 minutes. Which approach best identifies a sequence across tables?

• A. Join relevant identity audit and sign-in tables using a common user identifier and time window
• B. Count all alerts by severity
• C. Use a workbook with no query
• D. Filter only on device name

An analyst wants to investigate whether a suspicious executable was launched across endpoints. Which data source is most directly relevant in Advanced Hunting?

• A. DeviceProcessEvents
• B. EmailEvents only
• C. CloudAppEvents only
• D. IdentityInfo only

A Sentinel playbook fails when attempting to update an incident because its connection lacks permissions. What should the administrator do?

• A. Grant the playbook identity the minimum required incident permissions and validate the connection
• B. Make every user a global administrator
• C. Disable Sentinel incident updates
• D. Create a new analytics rule

A threat indicator has passed its expiration time. How should the analyst treat it in current investigations?

• A. Treat it as active indefinitely
• B. Treat it as expired unless it is reviewed and renewed based on current intelligence
• C. Delete all related historical incidents
• D. Use it as an allow indicator automatically

Investigation confirms that an incident is resolved and all required response actions are complete. What should the analyst do?

• A. Close or resolve the incident with an accurate classification and document the outcome
• B. Delete the incident evidence
• C. Reopen the incident automatically
• D. Disable the data connector