SC-200 was restructured in 2026 from a product-based blueprint (Defender XDR / Sentinel / Defender for Cloud) to a process-based one. These 25 questions are organized — and weighted — the same way the real exam is now: managing the SOC environment, responding to incidents, and hunting for threats, using Sentinel and Defender XDR throughout.
Several questions below cover content most SC-200 material hasn't caught up with yet — agentic AI investigation via Security Copilot, Sentinel's Analytics/Data lake/XDR retention tiers, and the Sentinel MCP Server. For a full study roadmap, see our SC-200 study guide or compare paths with SC-200 vs SC-300.
What You'll Get:
- ✓25 scenario-based questions weighted 11/9/5 to match the exam's ~40/35/20 domain split
- ✓KQL query questions — exactly what you see on the real exam
- ✓Detailed explanations for every answer option
- ✓Scoring guide to assess your readiness
What These Questions Cover
📝 Practice Test Instructions
- • Each question has ONE correct answer
- • For KQL questions, read the query carefully before selecting
- • Note your answers before scrolling to the answer key
- • Aim to complete all 25 questions in 25 minutes
Manage a Security Operations Environment
Questions 1–11
Automatic Attack Disruption
Your SOC wants Microsoft Defender XDR to automatically contain a fast-moving ransomware attack — for example, disabling a compromised account or isolating an affected device — the moment high-confidence signals are detected, without waiting for analyst approval.
What should you configure?
Attack Surface Reduction (ASR) Rules
You want to block Office applications from creating child processes commonly used to launch malware, without blocking legitimate macro-driven workflows your finance team relies on.
What should you configure in Defender for Endpoint?
Data Connectors
You need to ingest security events from Microsoft Entra ID sign-in logs, Azure Activity logs, and Microsoft 365 audit logs into Microsoft Sentinel.
What is the correct way to connect these data sources?
Sentinel Analytics Rules
You want to create a detection rule in Microsoft Sentinel that fires an alert when a user signs in from two different countries within 30 minutes (impossible travel).
Which type of analytics rule should you create?
Sentinel Watchlists
Your threat intelligence team maintains a CSV of 500 known malicious IP addresses. You want to reference this list from Sentinel analytics rules to detect when any of these IPs appear in sign-in events.
What is the best way to operationalize this list?
Sentinel Playbooks (SOAR)
When a high-severity incident is created in Sentinel, you want to automatically post a notification to the SOC Teams channel and open a ServiceNow ticket, without analyst intervention.
What should you create to automate this response?
Sentinel Workbooks
Your CISO wants a visual dashboard showing Sentinel incident trends over time, top alert sources, and mean time to close — refreshing automatically.
What Sentinel feature should you use?
Threat Intelligence Ingestion
You subscribe to a TAXII feed providing malicious IP indicators and want these indicators to automatically drive alerts in Sentinel when they match your network logs.
What must you configure in Microsoft Sentinel?
Sentinel Anomalies
Your organization wants Sentinel to flag when a user's behavior deviates sharply from their own baseline — for example, downloading far more data than usual, or accessing systems they've never touched before.
Which Sentinel capability provides this behavioral baseline and anomaly scoring?
Sentinel Data Retention Tiers
Your Sentinel workspace ingests 200 GB/day. Analysts mostly need fast queries against the last 90 days, but compliance requires 2 years of retained data, and you want to minimize cost.
Which retention approach fits?
SOC Optimization Recommendations
Your Sentinel workspace has grown organically over two years. You suspect there are data sources being ingested with no analytics rule ever using them, and coverage gaps against known attack techniques.
What built-in Sentinel capability directly surfaces this kind of tuning guidance?
Respond to Security Incidents
Questions 12–20
Defender XDR Alert Triage
A security analyst receives an alert in Microsoft Defender XDR: "Suspicious process launched by Office application." The alert is Medium severity. The analyst needs to determine if it's a true positive before escalating.
What is the FIRST action the analyst should take?
Investigating Complex Multi-Domain Attacks
Your SOC receives 47 separate alerts across Defender for Endpoint, Defender for Office 365, and Defender for Identity, all related to the same attack chain spanning email, endpoint, and identity.
How should this be investigated and tracked?
Defender for Endpoint Live Response
During an active investigation, you need to collect a memory dump from a compromised Windows device and run a custom investigation script on it — without physically accessing the device.
Which Defender for Endpoint feature allows this?
Defender for Identity — Lateral Movement
Microsoft Defender for Identity raises an alert: "Suspected identity theft (pass-the-hash)." A user account authenticated to multiple servers within a 10-minute window using NTLM.
What does this alert indicate and what should you investigate first?
Defender for Cloud Apps — Shadow IT
Your security team wants to identify which unsanctioned cloud applications employees are accessing, with a risk assessment based on compliance certifications and security controls.
Which Defender for Cloud Apps feature should you use to investigate this?
Automated Investigation and Remediation — Approval
An automated investigation in Defender for Endpoint has completed and recommends remediating a malicious file found on 12 devices. The recommendation is awaiting approval.
Where should an analyst go to approve or reject this remediation?
Agentic AI Investigation with Security Copilot
A Tier 1 analyst is triaging a Defender XDR incident with a long alert timeline spanning several devices and users. They want a fast summary of what happened and a suggested next investigation step, without manually reading every alert.
What capability should the analyst use?
Defender for Cloud Workload Protection Alerts
Defender for Cloud raises an alert on an Azure SQL Database: "Suspicious authentication activity — possible brute force." The alert shows 500 failed login attempts followed by a successful login from an unusual IP, and the database contains customer PII.
What is the recommended immediate response?
Investigating Microsoft 365 Activity
As part of an incident investigation, you need to determine exactly which files a departing employee accessed via the Microsoft Graph API in their final two weeks, beyond what appears in the standard incident timeline.
Where should you look for this evidence?
Perform Threat Hunting
Questions 21–25
Advanced Hunting — KQL
You want to find all devices that had a process named "mimikatz.exe" execute within the last 7 days, using Advanced Hunting in Microsoft Defender XDR.
Which KQL query correctly returns this from the DeviceProcessEvents table?
Sentinel Hunting Queries
You want a Sentinel hunting query that shows failed sign-in events from the SigninLogs table where the failure reason is "Invalid password" in the last 24 hours, most recent first.
Which KQL query is correct?
Hunting Graphs, Blast Radius, and Sentinel Graph
A Sentinel incident shows multiple failed SSH logins to an Azure VM, followed by a successful login and execution of a cryptocurrency miner. You need a visual view of every related entity — accounts, hosts, processes — and how far the compromise may have spread.
Which combination of capabilities gives you this view?
KQL Jobs Against the Data Lake Tier
You need to run a large historical KQL query for a threat hunt covering 18 months of data, most of which sits in the Data lake tier rather than the Analytics tier, and don't need the result instantly.
What should you use?
Notebook Hunting via the Sentinel MCP Server
A threat hunter wants to build a repeatable, code-based hunting workflow that can call Sentinel data and tooling programmatically from within a notebook environment, rather than hand-writing every KQL query in the portal.
What capability supports this notebook-based hunting workflow?
✋ Stop Here Before Scrolling!
Have you answered all 25 questions? Complete the test before checking the answers below.
Pro tip: Note your KQL answers carefully — they appear as code on the real exam too
📝 Answer Key with Detailed Explanations
Review each explanation carefully, even for questions you answered correctly
Quick Answer Reference
Question 1: Automatic Attack Disruption
✓ Correct Answer: B) Automatic attack disruption in Microsoft Defender XDR
Why this is correct:
Automatic attack disruption is built specifically to contain fast-moving attacks like ransomware in real time, using high-confidence signals, without waiting for analyst approval — it can automatically disable a compromised account or isolate a device.
Why other answers are incorrect:
💡 Key Concept:
Automatic attack disruption is a Domain 1 configuration topic (deciding when/how it triggers) and a Domain 2 topic when you're investigating what it already did.
Question 2: ASR Rules
✓ Correct Answer: B) An ASR rule in audit mode first, then enforced with exclusions for the finance team's known-good process
Why this is correct:
Attack surface reduction rules target exactly this kind of behavior (Office apps spawning child processes). Rolling out in audit mode first, then enforcing with a targeted exclusion, blocks the malicious pattern while preserving the legitimate workflow.
Why other answers are incorrect:
💡 Key Concept:
ASR rules sit in Domain 1's "configure security policies for Defender for Endpoint" objective.
Question 3: Data Connectors
✓ Correct Answer: A) Enable the Microsoft Entra ID, Azure Activity, and Microsoft 365 data connectors in Microsoft Sentinel
Why this is correct:
Sentinel uses built-in first-party data connectors for Microsoft services — direct API connections, no agent installation required.
Why other answers are incorrect:
💡 Key Concept:
Connector types worth knowing: first-party (direct API), Syslog/CEF via AMA, custom (REST API/Logic App), and TAXII for threat intelligence.
Question 4: Analytics Rules
✓ Correct Answer: B) Scheduled query rule using KQL with entity mapping
Why this is correct:
Scheduled query rules let you write custom KQL that runs on an interval and fires when conditions are met — for impossible travel, that means joining consecutive sign-ins by the same user across countries within the time window. Entity mapping ties the output to Sentinel entities.
Why other answers are incorrect:
💡 Key Concept:
Sentinel analytics rule types: Scheduled, NRT (near-real-time), Microsoft incident creation, Fusion, Anomaly, Threat Intelligence — all Domain 1 content.
Question 5: Watchlists
✓ Correct Answer: D) Import the CSV as a Sentinel Watchlist and use _GetWatchlist()
Why this is correct:
Watchlists are designed exactly for this: importing structured reference data and joining it against log data in KQL via _GetWatchlist().
Why other answers are incorrect:
💡 Key Concept:
Example: let maliciousIPs = _GetWatchlist("MaliciousIPs") | project IPAddress; SigninLogs | where IPAddress in (maliciousIPs)
Question 6: Sentinel Playbooks
✓ Correct Answer: A) A Sentinel automation rule that triggers a Logic App (playbook) on incident creation
Why this is correct:
Automation rules decide when to respond; the playbook (Logic App) is where the actual actions — Teams post, ServiceNow ticket — happen. Together they form Sentinel's SOAR capability.
Why other answers are incorrect:
💡 Key Concept:
Automation rules can also change incident severity/status/owner in addition to triggering playbooks.
Question 7: Sentinel Workbooks
✓ Correct Answer: B) Microsoft Sentinel Workbooks
Why this is correct:
Workbooks provide rich, KQL-driven, auto-refreshing dashboards, with pre-built templates for common SOC scenarios.
Why other answers are incorrect:
💡 Key Concept:
Pin individual workbook charts to Azure Dashboards for persistent executive views.
Question 8: Threat Intelligence Ingestion
✓ Correct Answer: D) A Threat Intelligence TAXII data connector, then an analytics rule using the ThreatIntelligenceIndicator table
Why this is correct:
The TAXII connector imports STIX indicators automatically into the ThreatIntelligenceIndicator table; an analytics rule then joins that table against your logs at scale.
Why other answers are incorrect:
💡 Key Concept:
TI sources: TAXII connector, Microsoft Defender Threat Intelligence connector, manual CSV, Graph Security API.
Question 9: Sentinel Anomalies
✓ Correct Answer: A) Sentinel anomalies, built on entity behavior analytics
Why this is correct:
Sentinel establishes a per-entity behavioral baseline and scores deviations from it — the current framing for this capability under the "configure anomalies" Domain 1 objective.
Why other answers are incorrect:
💡 Key Concept:
Anomaly profiles compare a user against their own baseline and against peer groups.
Question 10: Sentinel Data Retention Tiers
✓ Correct Answer: B) Keep 90 days in Analytics for fast querying; move older data into Data lake, queried via KQL jobs
Why this is correct:
Sentinel's current retention model has three tiers: Analytics (fast, real-time-rule-eligible, higher cost), Data lake (long-term, cheaper, queried via KQL jobs rather than instantly), and XDR (data already collected via Defender XDR). Splitting hot vs. long-term data across Analytics and Data lake meets both the query-speed and compliance-cost goals.
Why other answers are incorrect:
💡 Key Concept:
This tier model replaced the older "interactive vs. archive" retention framing — know the new names.
Question 11: SOC Optimization Recommendations
✓ Correct Answer: A) SOC optimization recommendations
Why this is correct:
This is a built-in Sentinel capability that surfaces exactly this kind of guidance — unused data sources, coverage gaps against MITRE ATT&CK, and cost/detection tuning opportunities.
Why other answers are incorrect:
💡 Key Concept:
SOC optimization pairs naturally with MITRE ATT&CK coverage analysis — both are Domain 1 "configure detections" content.
Question 12: Alert Triage
✓ Correct Answer: A) Examine the alert's process tree and timeline in the Defender XDR incident page
Why this is correct:
Before any containment action, confirm true-vs-false-positive using the process tree, parent-child relationships, and timeline — context without premature action that could tip off an attacker.
Why other answers are incorrect:
💡 Key Concept:
Triage order: understand → confirm → contain → remediate → document.
Question 13: Complex Multi-Domain Attacks
✓ Correct Answer: A) Correlated automatically into one Defender XDR incident, tracked through case management
Why this is correct:
Defender XDR automatically correlates related alerts across products into one incident/attack story; case management is the explicit Domain 2 mechanism for tracking a complex, multi-stage, multi-domain investigation end to end.
Why other answers are incorrect:
💡 Key Concept:
Domain 2 explicitly names "investigate complex attacks (multi-stage, multi-domain, lateral movement)" and "manage security incidents by using case management" as distinct skills.
Question 14: Live Response
✓ Correct Answer: C) Live response session
Why this is correct:
Live response gives an interactive remote shell — upload/run scripts, collect files and memory dumps, investigate processes — without physically touching the device.
Why other answers are incorrect:
💡 Key Concept:
Prerequisites: Defender for Endpoint P2, device online, "Live response" RBAC permission.
Question 15: Lateral Movement
✓ Correct Answer: D) A possible pass-the-hash attack — investigate the source machine for credential dumping tools
Why this is correct:
Pass-the-hash reuses a captured NTLM hash to authenticate elsewhere without the plaintext password. Rapid NTLM auth to multiple servers is a key indicator; the source machine likely has a credential-dumping tool like Mimikatz.
Why other answers are incorrect:
💡 Key Concept:
Pass-the-Hash uses NTLM hashes; Pass-the-Ticket uses Kerberos TGTs. Defender for Identity detects both.
Question 16: Shadow IT Discovery
✓ Correct Answer: C) Cloud Discovery (Shadow IT discovery)
Why this is correct:
Cloud Discovery analyzes traffic logs to surface unsanctioned apps and scores each against 90+ risk factors including compliance and security controls.
Why other answers are incorrect:
💡 Key Concept:
Cloud Discovery ingests firewall/proxy logs or uses the Defender for Endpoint integration for per-device app usage.
Question 17: Action Center Approval
✓ Correct Answer: D) Defender XDR Action Center — Pending actions
Why this is correct:
The Action Center is the central place to review and approve/reject automated investigation remediation actions, whether from automatic attack disruption or manual response.
Why other answers are incorrect:
💡 Key Concept:
Pending shows queued actions; History shows the last 30 days of completed ones.
Question 18: Agentic AI Investigation
✓ Correct Answer: B) Agentic AI investigation via embedded Security Copilot inside the Defender XDR incident page
Why this is correct:
Domain 2 explicitly tests "investigating incidents by using agentic AI, including embedded Microsoft Security Copilot" — it summarizes a long alert timeline and suggests investigation next steps directly inside the incident, speeding up triage.
Why other answers are incorrect:
💡 Key Concept:
Treat Security Copilot as an investigation accelerator you invoke during response, not a separate product with its own configuration domain.
Question 19: Defender for Cloud Workload Alert Response
✓ Correct Answer: C) Investigate the successful login, check what data was accessed, and consider revoking credentials and notifying the privacy team
Why this is correct:
A successful login after 500 failed attempts strongly suggests compromised credentials. With PII involved, this is a potential breach requiring investigation of access, credential rotation, and privacy-team notification (GDPR/CCPA timelines may apply).
Why other answers are incorrect:
💡 Key Concept:
Domain 2 frames Defender for Cloud purely as a workload-protection alert source to investigate and remediate — the older CSPM/Secure-Score/JIT posture-management content is not itemized in the current objectives.
Question 20: Investigating Microsoft 365 Activity
✓ Correct Answer: A) Microsoft Graph activity logs, investigated via Microsoft Purview
Why this is correct:
Domain 2 names Microsoft Graph activity logs specifically as an M365 investigation source, alongside Purview Audit and eDiscovery Content search — this is the API-level activity trail beyond what a device timeline or standard incident view shows.
Why other answers are incorrect:
💡 Key Concept:
The three M365-investigation tools worth knowing by name: Purview Audit, eDiscovery Content search, Graph activity logs.
Question 21: KQL — Advanced Hunting
✓ Correct Answer: B) DeviceProcessEvents | where FileName == "mimikatz.exe" | where Timestamp > ago(7d)
Why this is correct:
"where" is the correct KQL filter operator, "==" the equality operator, and "ago(7d)" the correct timespan function. Timestamp is the correct field for process execution time in DeviceProcessEvents.
Why other answers are incorrect:
💡 Key Concept:
Core KQL for SC-200: where, project, summarize, extend, join, union, ago(), startofday()/endofday().
Question 22: Sentinel Hunting Query
✓ Correct Answer: C) SigninLogs | where ResultType != 0 | where ResultDescription == "Invalid password" | where TimeGenerated > ago(24h) | order by TimeGenerated desc
Why this is correct:
Sentinel tables use TimeGenerated (not Timestamp, which is Defender XDR's field name). ResultType = 0 means success; non-zero means failure. "order by" is the correct KQL sort operator.
Why other answers are incorrect:
💡 Key Concept:
Remember: TimeGenerated in Sentinel tables vs. Timestamp in Defender XDR Advanced Hunting tables.
Question 23: Hunting Graphs, Blast Radius, Sentinel Graph
✓ Correct Answer: A) A hunting graph including blast radius, cross-referenced with Sentinel Graph for entity relationships
Why this is correct:
Domain 3 explicitly lists "create hunting graphs, including blast radius" and "analyze relationships between entities by using Sentinel Graph" as distinct current skills — together they give the visual, entity-relationship view this scenario needs.
Why other answers are incorrect:
💡 Key Concept:
This replaces the older "investigation graph" terminology some SC-200 material still uses — the current objectives name it Sentinel Graph.
Question 24: KQL Jobs / Data Lake Tier
✓ Correct Answer: A) A KQL job run against the Data lake tier
Why this is correct:
KQL jobs are the mechanism for large-scale queries against Data lake-tier data — designed for exactly this: long-retention, high-volume queries where instant interactivity isn't required.
Why other answers are incorrect:
💡 Key Concept:
Data lake tier + KQL jobs is new-in-2026 content most older SC-200 material doesn't cover at all.
Question 25: Sentinel MCP Server
✓ Correct Answer: C) Connecting the notebook to Sentinel via the Sentinel MCP Server
Why this is correct:
Domain 3 explicitly names "Notebooks, including connection to the Sentinel MCP Server" as a hunting skill — it lets a notebook environment call Sentinel data and tooling programmatically for repeatable, code-based hunting workflows.
Why other answers are incorrect:
💡 Key Concept:
This is one of the most-overlooked new topics — search for it explicitly if your study material predates mid-2026.
📊 How Did You Score?
Ready for More SC-200 Practice?
These 25 questions are just a sample. The actual SC-200 exam has 40–60 questions.
MSCertQuiz SC-200 includes 500 questions covering:
- ✓ Managing the SOC environment — automation, Sentinel platform config, ingestion, detections
- ✓ Responding to incidents across Defender XDR, Defender for Endpoint, and Microsoft 365
- ✓ Threat hunting with KQL, Sentinel Graph, the Data lake tier, and the MCP Server
- ✓ Agentic AI investigation via Security Copilot
- ✓ All scenario types including complex multi-domain incidents
$14.99 One-Time Payment
Lifetime access • No subscription • 500 questions