Microsoft SC-200 Security Operations Analyst Exam Questions
499 Questions & Answers
Review these free SC-200 practice questions on Microsoft security operations, incident response, Microsoft Sentinel, KQL investigation, and automation. Select your answer, then open Reveal Solution to check the reasoning. These original practice items support exam preparation and are not official Microsoft exam questions.
An analyst receives an alert that a privileged account signed in from an unfamiliar country and then accessed several cloud applications. What should the analyst do first?
Reveal Solution
Confirm whether the activity is malicious by examining sign-in details, identity risk, and correlated events before selecting a containment action.
A scheduled analytics rule repeatedly creates separate incidents for alerts that belong to one attack chain. Which rule capability helps group related alerts into a single incident?
Reveal Solution
Incident grouping correlates alerts according to configured criteria so investigators can work a unified incident.
An analyst wants to find sign-in events from one source IP during the last 24 hours and return the newest events first. Which KQL pattern is appropriate?
Reveal Solution
Filter the table by a recent time range and the IP address, then sort descending by TimeGenerated to see the latest events first.
A confirmed compromised endpoint is actively communicating with a command-and-control host. Which response is most appropriate while preserving evidence for investigation?
Reveal Solution
Isolating a compromised device can limit further communication while preserving the device and its telemetry for investigation.
A team wants an approved playbook to run automatically whenever a high-severity incident is created in Sentinel. What should be configured?
Reveal Solution
Automation rules can match incident conditions and invoke an approved playbook to standardize response steps.