The SC-200 (Microsoft Security Operations Analyst) exam tests your ability to investigate, respond to, and hunt for threats using Microsoft security tools. SOC analysts, threat hunters, and security engineers preparing for this exam need hands-on knowledge of Sentinel, Defender XDR, and Defender for Cloud.
These 25 questions cover real SOC scenarios — KQL queries, incident response workflows, SIEM configuration, and threat detection. For a full study roadmap, see our SC-200 study guide or compare paths with SC-200 vs SC-300.
What You'll Get:
- ✓25 scenario-based questions across all three exam pillars
- ✓KQL query questions — exactly what you see on the real exam
- ✓Detailed explanations for every answer option
- ✓Scoring guide to assess your readiness
What These Questions Cover
📝 Practice Test Instructions
- • Each question has ONE correct answer
- • For KQL questions, read the query carefully before selecting
- • Note your answers before scrolling to the answer key
- • Aim to complete all 25 questions in 25 minutes
Microsoft Defender XDR
Questions 1–8
Defender for Endpoint — Alert Triage
A security analyst receives an alert in Microsoft Defender XDR: "Suspicious process launched by Office application." The alert is classified as Medium severity. The analyst needs to determine if the alert is a true positive before escalating.
What is the FIRST action the analyst should take?
Defender XDR — Incident Correlation
Your SOC receives 47 separate alerts across Defender for Endpoint, Defender for Office 365, and Defender for Identity related to the same attack chain. Analysts are struggling to see the full picture.
Which Microsoft Defender XDR capability automatically correlates these alerts into a single view?
Defender for Endpoint — Live Response
During an active incident investigation, you need to collect a memory dump from a compromised Windows device and run a custom investigation script on it — all without physically accessing the device.
Which Defender for Endpoint feature allows this?
Defender for Identity — Lateral Movement
Microsoft Defender for Identity raises an alert: "Suspected identity theft (pass-the-hash)." The alert shows a user account was used to authenticate to multiple servers within a 10-minute window using NTLM.
What does this alert indicate and what should you investigate first?
Defender for Office 365 — Safe Attachments
Users in your organization are reporting that they received emails with PDF attachments that deployed malware when opened. You need to prevent this from happening in the future.
Which Defender for Office 365 feature should you enable?
Advanced Hunting — KQL
You want to find all devices that had a process named "mimikatz.exe" execute within the last 7 days using Advanced Hunting in Microsoft Defender XDR.
Which KQL query would return this data from the DeviceProcessEvents table?
Defender for Cloud Apps — Shadow IT
Your security team wants to identify which unsanctioned cloud applications employees are accessing. You want a risk assessment of each discovered app based on compliance certifications and security controls.
Which Defender for Cloud Apps feature provides this capability?
Automated Investigation and Remediation
An automated investigation in Defender for Endpoint has completed and recommends remediating a malicious file found on 12 devices. The recommendation is awaiting approval.
Where should a security analyst go to approve or reject these remediation actions?
Microsoft Sentinel
Questions 9–18
Data Connectors
You need to ingest security events from Azure Active Directory sign-in logs, Azure Activity logs, and Microsoft 365 audit logs into Microsoft Sentinel.
What is the correct way to connect these data sources?
Analytics Rules
You want to create a detection rule in Microsoft Sentinel that fires an alert when a user signs in from two different countries within 30 minutes (impossible travel).
Which type of analytics rule should you create?
KQL for Sentinel
You want a Sentinel query that shows all failed sign-in events from the SigninLogs table where the failure reason is "Invalid password" in the last 24 hours, ordered by most recent first.
Which KQL query is correct?
Sentinel Watchlists
Your organization has a list of 500 known malicious IP addresses maintained by your threat intelligence team in a CSV file. You want to use this list in Sentinel analytics rules to detect when any of these IPs appear in sign-in events.
What is the BEST way to operationalize this IP list in Sentinel?
Sentinel Playbooks (SOAR)
When a high-severity incident is created in Sentinel, you want to automatically send a notification to the SOC Teams channel and create a ticket in ServiceNow. This should happen without analyst intervention.
What should you create to automate this response?
Sentinel Workbooks
Your CISO wants a visual dashboard showing Sentinel incident trends over time, top alert sources, and mean time to close for incidents. The dashboard should refresh automatically.
What Sentinel feature should you use?
Incident Investigation
A Sentinel incident is triggered: multiple failed SSH logins to an Azure VM followed by a successful login and execution of a cryptocurrency miner. You need to understand the full attack timeline and identify all affected entities.
Which Sentinel feature provides a visual map of the attack with all related entities and alerts?
Threat Intelligence
You subscribe to a TAXII threat intelligence feed that provides malicious IP indicators. You want these indicators to automatically trigger alerts in Sentinel when matched against your network logs.
What must you configure in Microsoft Sentinel?
UEBA
Your organization wants Sentinel to detect when user behavior deviates significantly from their normal baseline — for example, a user downloading 50x more data than usual or accessing systems they never accessed before.
Which Sentinel capability provides this behavioral baseline and anomaly detection?
Sentinel Cost Management
Your Sentinel workspace is ingesting 200 GB/day. Your security team only needs to query the last 90 days of data for investigations, but you must retain logs for 2 years for compliance purposes.
Which Log Analytics retention configuration optimizes cost while meeting both requirements?
Microsoft Defender for Cloud
Questions 19–25
Secure Score
Your Microsoft Defender for Cloud Secure Score is 45%. Your CISO wants to improve it to 70% within 3 months. You need to identify which recommendations will have the highest impact on the score.
How should you prioritize remediation efforts?
Defender for Cloud Plans
Your organization runs workloads in Azure, on-premises servers, and AWS. You want Microsoft Defender for Cloud to protect all these workloads with advanced threat detection including just-in-time VM access and file integrity monitoring.
What do you need to enable?
Just-In-Time VM Access
Attackers are attempting brute force attacks against management ports (RDP port 3389, SSH port 22) on your Azure VMs. You need to reduce the attack surface by ensuring these ports are only open when explicitly requested.
Which Defender for Cloud feature should you enable?
Regulatory Compliance
Your organization needs to demonstrate compliance with the CIS Microsoft Azure Foundations Benchmark. You need a dashboard showing which controls are passing and failing, mapped to specific Azure resource configurations.
Where in Defender for Cloud would you find this?
Security Alerts
Defender for Cloud raises an alert: "Suspicious authentication activity — possible brute force." The alert shows 500 failed login attempts to an Azure SQL Database followed by a successful login from an unusual IP. The data in the database contains customer PII.
What is the recommended immediate response?
Defender for Cloud — CSPM vs CWPP
Your security architect asks you to explain the difference between CSPM and CWPP components in Defender for Cloud.
Which statement BEST describes both components?
Multi-Cloud Security
Your organization uses both Azure and AWS. You want a single pane of glass to see security recommendations and threat detections for both cloud environments in Defender for Cloud.
How do you connect AWS to Microsoft Defender for Cloud?
✋ Stop Here Before Scrolling!
Have you answered all 25 questions? Complete the test before checking the answers below.
Pro tip: Note your KQL answers carefully — they appear as code on the real exam too
📝 Answer Key with Detailed Explanations
Review each explanation carefully, even for questions you answered correctly
Quick Answer Reference
Question 1: Alert Triage
✓ Correct Answer: A) Examine the alert's process tree and timeline in the Defender XDR incident page
Why this is correct:
Before taking any containment action, analysts must determine if an alert is a true positive. The Defender XDR incident page shows the full process tree, parent-child process relationships, command lines executed, and timeline — giving context to assess severity and confirm the threat without taking premature action that could alert the attacker.
Why other answers are incorrect:
💡 Key Concept:
SOC triage order: 1) Understand (process tree, timeline), 2) Confirm (true/false positive), 3) Contain (if confirmed), 4) Remediate, 5) Document.
Question 2: Incident Correlation
✓ Correct Answer: B) Defender XDR Incidents (automatic alert correlation)
Why this is correct:
Microsoft Defender XDR automatically correlates related alerts from Defender for Endpoint, Office 365, Identity, and Cloud Apps into a single incident using AI-based correlation. This "attack story" view shows the full kill chain instead of dozens of separate alerts.
Why other answers are incorrect:
💡 Key Concept:
Defender XDR incident = correlation of multiple alerts across Defender products. Sentinel incident = correlation from any data source in Sentinel. They complement each other — Sentinel can ingest Defender XDR incidents too.
Question 3: Live Response
✓ Correct Answer: C) Live response session
Why this is correct:
Live response gives analysts an interactive command-line shell on a remote device. You can upload and run scripts, collect files, collect memory dumps, run forensic tools, and investigate processes — all remotely without physically touching the device or deploying additional agents.
Why other answers are incorrect:
💡 Key Concept:
Live response prerequisites: Defender for Endpoint P2, device online, analyst has "Live response" permission in RBAC. Available for Windows, macOS, and Linux devices.
Question 4: Lateral Movement
✓ Correct Answer: D) A possible pass-the-hash attack — investigate the source machine for credential dumping tools
Why this is correct:
Pass-the-hash (PtH) is an attack where the attacker captures an NTLM hash from one machine and uses it to authenticate to other systems without knowing the plaintext password. Rapid NTLM authentication to multiple servers is a key indicator. The source machine is the starting point — it likely has Mimikatz or similar credential dumping tools.
Why other answers are incorrect:
💡 Key Concept:
Pass-the-Hash vs Pass-the-Ticket: PtH uses NTLM hashes, Pass-the-Ticket uses Kerberos TGTs. Both are credential theft lateral movement techniques. Defender for Identity detects both.
Question 5: Safe Attachments
✓ Correct Answer: A) Safe Attachments policy with Dynamic Delivery
Why this is correct:
Safe Attachments detonates email attachments in a sandbox environment before delivering them to users. Dynamic Delivery delivers the email body immediately and replaces the attachment with a placeholder while it's being scanned — minimizing delays while blocking malicious attachments.
Why other answers are incorrect:
💡 Key Concept:
Safe Attachments modes: Off, Monitor (deliver + log), Block (quarantine), Replace (remove attachment), Dynamic Delivery (deliver immediately, replace attachment while scanning). Dynamic Delivery is best UX.
Question 6: KQL — Advanced Hunting
✓ Correct Answer: B) DeviceProcessEvents | where FileName == "mimikatz.exe" | where Timestamp > ago(7d)
Why this is correct:
This is valid KQL syntax. "where" is the correct KQL filter operator, "==" is the equality operator for strings, and "ago(7d)" is the correct KQL timespan function. Timestamp is the correct field name in DeviceProcessEvents for the process execution time.
Why other answers are incorrect:
💡 Key Concept:
Key KQL operators for SC-200: where (filter), project (select columns), summarize (aggregate), extend (add calculated column), join, union, ago() for time ranges, startofday()/endofday() for time bucketing.
Question 7: Shadow IT Discovery
✓ Correct Answer: C) Cloud Discovery (Shadow IT discovery)
Why this is correct:
Cloud Discovery in Defender for Cloud Apps analyzes network traffic logs (from firewalls, proxies, or the MDE integration) to identify cloud applications in use. It then scores each app across 90+ risk factors including compliance certifications, security controls, and data handling practices.
Why other answers are incorrect:
💡 Key Concept:
Cloud Discovery uses: Firewall/proxy logs (manual upload or automated), or MDE integration (gives per-device, per-user app usage). The app risk catalog scores 31,000+ cloud apps.
Question 8: Action Center
✓ Correct Answer: D) Defender XDR Action Center — Pending actions
Why this is correct:
The Defender XDR Action Center is the central location for reviewing and approving/rejecting automated investigation remediation actions. The Pending tab shows actions waiting for approval, and the History tab shows already completed actions. This applies to both automated and manual response actions.
Why other answers are incorrect:
💡 Key Concept:
Action Center — Pending: Automated investigation recommendations, manual Response actions queued. You can approve individual actions or all actions at once. History shows last 30 days of actions.
Question 9: Data Connectors
✓ Correct Answer: A) Enable the Microsoft Entra ID, Azure Activity, and Microsoft 365 data connectors in Microsoft Sentinel
Why this is correct:
Microsoft Sentinel uses Data Connectors to ingest data from various sources. For Microsoft services, there are dedicated built-in connectors (Microsoft Entra ID, Azure Activity, Microsoft 365 Defender, Office 365) that use direct API connections — no agent installation required on Azure services.
Why other answers are incorrect:
💡 Key Concept:
Sentinel connector types: Microsoft first-party (direct API), Syslog (Linux via agent), CEF (via forwarder VM), Custom connector (REST API/Logic App), AWS (via CloudTrail connector).
Question 10: Analytics Rules
✓ Correct Answer: B) Scheduled query rule using KQL with entity mapping
Why this is correct:
Scheduled query rules allow you to write custom KQL queries that run on a schedule and generate alerts when conditions are met. For impossible travel, you'd write a query joining consecutive sign-in events from the same user in different countries within the time window. Entity mapping connects the rule output to Sentinel entities (User, IP, Host).
Why other answers are incorrect:
💡 Key Concept:
Sentinel analytics rule types: Scheduled (custom KQL, runs every X minutes), NRT (Near Real Time, <5 min latency), Microsoft incident creation, Fusion (ML correlation), Anomaly, Threat Intelligence.
Question 11: KQL for Sentinel
✓ Correct Answer: C) SigninLogs | where ResultType != 0 | where ResultDescription == "Invalid password" | where TimeGenerated > ago(24h) | order by TimeGenerated desc
Why this is correct:
In Sentinel, the timestamp field for most tables is TimeGenerated (not Timestamp like in Defender XDR). ResultType = 0 means success; non-zero means failure. "order by" is the correct KQL sorting operator. The query structure is correct KQL.
Why other answers are incorrect:
💡 Key Concept:
Sentinel tables use TimeGenerated for timestamps (vs Timestamp in Defender XDR Advanced Hunting). SigninLogs key fields: UserPrincipalName, IPAddress, Location, ResultType (0=success), ResultDescription.
Question 12: Watchlists
✓ Correct Answer: D) Import the CSV as a Sentinel Watchlist and reference it in analytics rules using the _GetWatchlist() function
Why this is correct:
Sentinel Watchlists are designed exactly for this use case — importing structured data (CSV) like IP lists, employee lists, or IOCs and referencing them in KQL queries. The _GetWatchlist("WatchlistName") function returns the watchlist data that can be joined against log tables.
Why other answers are incorrect:
💡 Key Concept:
Watchlist KQL example: let maliciousIPs = _GetWatchlist("MaliciousIPs") | project IPAddress; SigninLogs | where IPAddress in (maliciousIPs) | project TimeGenerated, UserPrincipalName, IPAddress
Question 13: Playbooks
✓ Correct Answer: A) A Sentinel Automation Rule that triggers a Logic App (Playbook) on incident creation
Why this is correct:
Sentinel Automation Rules define when to trigger a response (on incident creation/update, for specific analytic rules). When triggered, they can run a Playbook (Logic App), which is where the actual automated actions happen — Teams notifications, ServiceNow API calls, etc. The combination of Automation Rule + Logic App is Sentinel's SOAR capability.
Why other answers are incorrect:
💡 Key Concept:
Sentinel SOAR flow: Incident created → Automation Rule evaluates → Triggers Logic App (Playbook) → Playbook executes actions (Teams, email, ITSM, block IP, disable user). Automation Rules can also change incident severity/status/owner.
Question 14: Workbooks
✓ Correct Answer: B) Microsoft Sentinel Workbooks
Why this is correct:
Sentinel Workbooks (built on Azure Monitor Workbooks) provide rich, interactive dashboards built from KQL queries. They support charts, tables, time-brushing, and auto-refresh. Sentinel includes pre-built workbooks for common scenarios, and you can create custom ones.
Why other answers are incorrect:
💡 Key Concept:
Sentinel Workbooks vs Dashboards: Workbooks = rich, query-driven, interactive, support parameters. Pin individual charts to Azure Dashboards for persistent executive views.
Question 15: Investigation Graph
✓ Correct Answer: C) The investigation graph
Why this is correct:
The Sentinel investigation graph provides a visual, interactive map showing all entities (users, hosts, IPs, accounts) associated with an incident and their relationships. You can expand nodes to see related alerts and entities, making it easy to understand lateral movement and the attack scope.
Why other answers are incorrect:
💡 Key Concept:
Investigation graph: click on any entity (user, IP, host) to expand and see all related incidents and alerts. You can trace lateral movement paths visually without writing KQL queries.
Question 16: Threat Intelligence
✓ Correct Answer: D) A data connector for Threat Intelligence TAXII, then an analytics rule using the ThreatIntelligenceIndicator table
Why this is correct:
The Threat Intelligence TAXII data connector in Sentinel connects to TAXII servers and imports STIX indicators into the ThreatIntelligenceIndicator table. You then write analytics rules that join this table with sign-in or network logs to detect matches. This is the fully automated, scalable approach.
Why other answers are incorrect:
💡 Key Concept:
Sentinel TI sources: TI TAXII connector (STIX/TAXII feeds), Microsoft Defender Threat Intelligence connector, manual CSV upload, Microsoft Graph Security API. TI indicators auto-expire based on the Valid Until field.
Question 17: UEBA
✓ Correct Answer: A) User and Entity Behavior Analytics (UEBA)
Why this is correct:
UEBA in Sentinel learns each user's normal behavior over a baseline period (typically 14+ days), then detects anomalies. It creates an entity behavior profile for each user and entity, assigning anomaly scores. High scores surface in the UEBA dashboard and can feed into Fusion incidents.
Why other answers are incorrect:
💡 Key Concept:
UEBA provides: Entity pages (users, hosts, IPs), anomaly scores, peer group comparisons ("this user is behaving differently from 95% of their peers"), and integration with Sentinel incidents.
Question 18: Sentinel Cost Management
✓ Correct Answer: B) Set interactive retention to 90 days and archive retention to 730 days total — archived data is much cheaper
Why this is correct:
Log Analytics supports a two-tier retention model: Interactive retention (hot, queryable instantly, full price) and Archive (cold, cheaper but requires restore before full query). Setting interactive to 90 days and total to 730 days gives analysts fast access to recent data while meeting 2-year compliance retention at significantly lower cost.
Why other answers are incorrect:
💡 Key Concept:
Log Analytics retention pricing: Interactive (default 90 days, up to 2 years): full price. Archive (beyond interactive up to 7 years): ~12x cheaper. Restore archived data for ad-hoc investigation: billed per GB restored.
Question 19: Secure Score
✓ Correct Answer: C) Address recommendations with the highest score impact first, filtered by the Secure Score impact column
Why this is correct:
Defender for Cloud shows the potential Secure Score increase for each recommendation. Sorting by "Potential score increase" identifies the high-value remediations that will move the score the most with the least effort. This is the data-driven prioritization approach.
Why other answers are incorrect:
💡 Key Concept:
Secure Score formula: (Points secured / Total potential points) × 100. Each recommendation has a "Max score" (points if fully remediated). Focus on high max-score recommendations for fastest improvement.
Question 20: Defender for Cloud Plans
✓ Correct Answer: D) Enhanced security features (paid Defender plans) for each workload type across all connected environments
Why this is correct:
The free tier of Defender for Cloud provides basic CSPM (security posture assessment). Advanced threat detection features (JIT VM access, file integrity monitoring, adaptive application controls, workload-specific threat detection) require the paid enhanced security plans — one per workload type (Servers, Databases, Containers, etc.).
Why other answers are incorrect:
💡 Key Concept:
Defender for Cloud plans: Defender for Servers (P1/P2), Databases, Containers, App Service, Storage, Key Vault, DNS, Resource Manager, APIs. Each plan enables specific protections for that workload type.
Question 21: Just-In-Time VM Access
✓ Correct Answer: A) Just-in-time VM access
Why this is correct:
JIT VM access closes management ports (RDP 3389, SSH 22, WinRM 5985/5986) by default using NSG rules. When an analyst needs access, they request it through Defender for Cloud (or MDE portal), specifying duration and IP. The NSG rule is temporarily opened only for that IP and time window, dramatically reducing the attack surface.
Why other answers are incorrect:
💡 Key Concept:
JIT workflow: Analyst requests access via Defender for Cloud → Specifies max time (1-24h) and source IP → NSG rule temporarily opens the port → Port closes automatically after time expires. Full audit log of all JIT requests.
Question 22: Regulatory Compliance
✓ Correct Answer: B) Defender for Cloud — Regulatory compliance dashboard
Why this is correct:
The Regulatory Compliance dashboard in Defender for Cloud maps Azure resource configurations to specific compliance framework controls (CIS, NIST, PCI-DSS, ISO 27001, etc.). It shows passing/failing controls, the specific resources affected by each failing control, and provides remediation guidance.
Why other answers are incorrect:
💡 Key Concept:
Defender for Cloud supports 35+ regulatory frameworks out-of-the-box. You can add custom frameworks and assign them to specific subscriptions. Each control maps to specific Secure Score recommendations.
Question 23: Security Alerts Response
✓ Correct Answer: C) Investigate the successful login, check what data was accessed, and consider revoking the SQL credentials and notifying the privacy team
Why this is correct:
A successful SQL login after 500 brute force attempts strongly suggests credential compromise. With PII in the database, this is a potential data breach. The response should include: confirming the access was unauthorized, checking audit logs for data exfiltration, revoking compromised credentials, and notifying the privacy team (GDPR/CCPA may require breach notification within 72 hours).
Why other answers are incorrect:
💡 Key Concept:
Breach notification timelines: GDPR = 72 hours to supervisory authority. CCPA = "expedient" notification. When PII databases are involved in security incidents, always involve privacy/legal teams immediately.
Question 24: CSPM vs CWPP
✓ Correct Answer: D) CSPM assesses and improves your security configuration; CWPP detects runtime threats against your workloads
Why this is correct:
CSPM (Cloud Security Posture Management) focuses on configuration — is your storage account publicly accessible? Are your VMs missing security patches? It's proactive and preventative. CWPP (Cloud Workload Protection Platform) focuses on runtime — detecting attacks happening right now against your VMs, containers, databases.
Why other answers are incorrect:
💡 Key Concept:
Simple memory aid: CSPM = "Are we configured securely?" (proactive, preventative). CWPP = "Are we under attack right now?" (reactive, detective). Defender for Cloud provides both in one product.
Question 25: Multi-Cloud
✓ Correct Answer: A) Add AWS as a connected environment using the Cloud Connectors in Defender for Cloud
Why this is correct:
Defender for Cloud natively supports multi-cloud through Cloud Connectors. For AWS, you connect via an IAM role that grants read access to AWS Security Hub and other services. Once connected, AWS recommendations appear in Defender for Cloud alongside Azure, with a single Secure Score.
Why other answers are incorrect:
💡 Key Concept:
Defender for Cloud supported clouds: Azure (native), AWS (via Cloud Connector), GCP (via Cloud Connector). Each connector requires specific IAM permissions. Multi-cloud shows a unified Secure Score and recommendations.
📊 How Did You Score?
Ready for More SC-200 Practice?
These 25 questions are just a sample. The actual SC-200 exam has 40–60 questions.
MSCertQuiz SC-200 includes 500 questions covering:
- ✓ KQL queries for both Advanced Hunting and Sentinel
- ✓ Sentinel analytics rules, playbooks, and workbooks
- ✓ Full Defender XDR product suite in depth
- ✓ Defender for Cloud CSPM, CWPP, and compliance
- ✓ All scenario types including complex multi-step incidents
$14.99 One-Time Payment
Lifetime access • No subscription • 500 questions