10 free, exam-style Microsoft Certified: Security Operations Analyst Associate (SC-200) (SC-200) practice questions with answers and explanations. No signup required. Work through them below, then take the full free SC-200 practice test to study every exam domain.
These 10 free SC-200 questions are organized by exam domain, so you can see how each part of the Microsoft Certified: Security Operations Analyst Associate (SC-200) blueprint is tested. Reveal the answer and explanation under each question.
You need a Microsoft Sentinel detection that triggers as close to real time as possible when a specific high-risk sign-in pattern appears, without waiting for a scheduled query interval. Which analytics rule type should you create?
Correct answer: A - A near-real-time (NRT) rule
A SOC lead wants a single detection that automatically correlates multiple lower-fidelity alerts into one high-fidelity multistage-attack incident, and the team must not be able to edit the underlying correlation logic. Which analytics rule type meets these requirements?
Correct answer: A - A Fusion rule
A new tier-1 analyst must triage Microsoft Sentinel incidents, change their status, and investigate entities, but must NOT be able to create or modify analytics rules. Following least privilege, which role should you assign?
Correct answer: A - Microsoft Sentinel Responder
You must collect only specific Windows Security event IDs from on-premises servers onboarded to Azure Arc, minimizing the volume of data ingested into Microsoft Sentinel. What should you configure?
Correct answer: A - Windows Security Events via AMA with a data collection rule
When a Microsoft Sentinel incident is created you must automatically assign an owner, add a tag, and then run a Logic Apps workflow that posts to Microsoft Teams - centralized, with minimal administrative effort. What should you create?
Correct answer: A - An automation rule that sets fields and calls a playbook
You are creating a custom detection rule from an Advanced Hunting query in Microsoft Defender XDR, but the rule cannot be saved. Which columns must the query return for the rule to be valid?
Correct answer: B - Timestamp, plus DeviceId and ReportId as the event ID
You want to deploy a new attack surface reduction (ASR) rule to measure its potential impact and surface false positives before it blocks anything. Which mode should you configure?
Correct answer: B - Audit
Your organization must keep security logs queryable for seven years for compliance, but the data is rarely accessed and cost must be minimized. Recent 30-day data must still power real-time analytics rules. What is the most appropriate approach?
Correct answer: B - Recent data in the analytics tier, older data in the data lake tier
A phishing email reached the inboxes of 200 users before it was detected. You need to locate every copy across all mailboxes and soft-delete them from one place. Which tool should you use?
Correct answer: B - Threat Explorer in Defender for Office 365
Microsoft Entra ID Identity Protection reports a sign-in you have verified is genuinely malicious. You want to mark the user as compromised so the risk engine learns from the decision and triggers remediation. Which action should you take?
Correct answer: B - Confirm user compromised
The SC-200 exam also covers these domains. Drill them in the full free practice test:
Practice hundreds more SC-200 questions with instant scoring, weak-area drills, and full exam simulations.