Microsoft SC-200 Practice Exams
Last updated on Oct 22,2026- Exam Code: SC-200
- Exam Name: Microsoft Security Operations Analyst
- Certification Provider: Microsoft
- Latest update: Oct 22,2026
You need to deploy the native cloud connector to Account! to meet the Microsoft Defender for Cloud requirements.
What should you do in Account! first?
- A . Create an AWS user for Defender for Cloud.
- B . Create an Access control (1AM) role for Defender for Cloud.
- C . Configure AWS Security Hub.
- D . Deploy the AWS Systems Manager (SSM) agent
You have an Azure subscription that contains a Log Analytics workspace.
You need to enable just-in-time (JIT) VM access and network detections for Azure resources.
Where should you enable Azure Defender?
- A . at the subscription level
- B . at the workspace level
- C . at the resource level
You need to create the test rule to meet the Azure Sentinel requirements.
What should you do when you create the rule?
- A . From Set rule logic, turn off suppression.
- B . From Analytics rule details, configure the tactics.
- C . From Set rule logic, map the entities.
- D . From Analytics rule details, configure the severity.
HOTSPOT
You need to configure the Azure Sentinel integration to meet the Azure Sentinel requirements.
What should you do? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.
HOTSPOT
You have a Microsoft Sentinel workspace that has User and Entity Behavior Analytics (UEBA) enabled.
You need to identify all the log entries that relate to security-sensitive user actions performed on a server named Server1.
The solution must meet the following requirements:
• Only include security-sensitive actions by users that are NOT members of the IT department.
• Minimize the number of false positives.
How should you complete the query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.
HOTSPOT
You have an Azure subscription that contains a Log Analytics workspace named Workspace1.
You configure Azure activity logs and Microsoft Entra ID logs to be forwarded to Workspace1.
You need to identify which Azure resources have been queried or modified by risky users.
How should you complete the KQL query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.
You have a Microsoft 365 E5 subscription that uses Microsoft SharePoint Online.
You delete users from the subscription.
You need to be notified if the deleted users downloaded numerous documents from SharePoint Online sites during the month before their accounts were deleted.
What should you use?
- A . a file policy in Microsoft Defender for Cloud Apps
- B . an access review policy
- C . an alert policy in Microsoft Defender for Office 365
- D . an insider risk policy
HOTSPOT
You have a Microsoft 365 E5 subscription that uses Microsoft Defender and an Azure subscription that uses Azure Sentinel.
You need to identify all the devices that contain files in emails sent by a known malicious email sender. The query will be based on the match of the SHA256 hash.
How should you complete the query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.
You have an Azure subscription that uses Microsoft Sentinel.
You detect a new threat by using a hunting query.
You need to ensure that Microsoft Sentinel automatically detects the threat. The solution must minimize administrative effort.
What should you do?
- A . Create a playbook.
- B . Create a watchlist.
- C . Create an analytics rule.
- D . Add the query to a workbook.
DRAG DROP
You have a Microsoft Sentinel workspace that contains the following Advanced Security Information Model (ASIM) parsers:
• _Im_ProcessCreate
• InProceessCreate
You create a new source-specific parser named vimProcessCreate.
You need to modify the parsers to meet the following requirements:
• Call all the ProcessCreate parsers.
• Standardize fields to the Process schema.
Which parser should you modify to meet each requirement? To answer, drag the appropriate parsers to the correct requirements. tach parser may be used once, more than once, or not at all You may need to drag the split bar between panes or scroll to view content. NOTE Each correct selection is worth one point.
