SC-200 Microsoft Security Operations Analyst Free Practice Exam Questions (2025 Updated)

When you create a Near-Real-Time (NRT) analytics rule in Microsoft Sentinel, the rule runs every minute and triggers almost immediately when matching events are ingested. These NRT rules are designed for time-sensitive detections, such as when you need to respond quickly to activity from connectors like Azure Activity.

However, NRT rules do not generate incidents directly. Instead, they produce alerts, which can then trigger playbooks or automations via the Alert automation settings section.

A. Incident automation settings:This applies to standard scheduled analytics rules that create incidents, not NRT rules. Since NRT rules generate alerts (not incidents), this option would not apply.

B. Entity mapping:This is used to map data fields (like Account, Host, IP) for better investigation, but it does not control playbook execution.

C. The query rule:The query defines what data triggers the rule, not the automation or playbook execution. The playbook is attached separately.

D. Alert automation settings: ✅According to Microsoft documentation, “To automatically run a playbook when an alert is created by a near-real-time rule, configure the playbook in the Alert automation settings section.”This allows the playbook to run immediately when the alert is generated, achieving near-real-time response with minimal latency.

The scenario describes agentless scanning for virtual machines — a feature of Microsoft Defender for Cloud under the Defender CSPM (Cloud Security Posture Management) plan. Defender CSPM introduces agentless scanning capabilities that use snapshot-based (out-of-band) scanning to assess OS vulnerabilities, sensitive data, and configurations without requiring agents.

Microsoft documentation clarifies:

“Agentless scanning for machines is available in Defender CSPM and Defender for Servers P2. The scanning engine takes snapshots of virtual machines and performs analysis out-of-band to identify vulnerabilities and sensitive data exposure.”

For controlling which virtual machines participate, tag-based inclusion or exclusion is used. You can define which machines to include/exclude using Azure resource tags, such as:

Environment=Production

Scan=Exclude

Microsoft Defender for Cloud reads these tags to determine which resources should have scanning enabled or excluded.

Role-based access control (RBAC) and Azure Policy assignments control access and policy enforcement, but they are not used to exclude specific resources from Defender CSPM agentless scanning.

✅ Final Configuration:

Defender Plan: Defender CSPM

Exclusion Method: Tagging

In Microsoft Sentinel, roles define access based on least privilege.

To investigate incidents, a user needs permissions to view incidents, alerts, entities, and evidence, and to perform investigation actions (like assigning, commenting, or changing incident status).

Microsoft defines the Microsoft Sentinel Responder role as:

“Allows users to view incidents, assign incidents to themselves or others, change incident severity and status, and run playbooks.”

This is the minimal role required for incident investigation.

Reader: Can view data but cannot act on incidents.

Responder ✅: Can investigate and respond.

Contributor: Can create and edit rules, analytics, and automation (more privileges than required).

Automation Contributor: Used for playbook automation, not investigation.

✅ Answer: A. Microsoft Sentinel Responder

In Microsoft Defender for Identity, false positives can occur due to legitimate administrative activities or benign network behavior. To minimize investigation effort, Microsoft recommends reviewing the Resolution Method field associated with the alert’s source computer.

The Resolution Method indicates how Defender for Identity classified or resolved the source computer’s identity—whether through secure channel (Kerberos/NTLM), DNS resolution, or other identification techniques. If the method is unreliable (e.g., based on DNS name only), it may cause inaccurate correlations that trigger false positives.

By verifying the Resolution Method, analysts can quickly determine whether an alert was raised due to weak identity mapping or misattribution. Microsoft’s official documentation states that reviewing the Resolution Method “helps analysts understand how the entity was resolved and assess whether the detection could be a false positive.”

Hence, to reduce the time spent on false positives, the most relevant data point to review is the Resolution Method of the source computer — Answer: D.

XDR Custom Detection Rules Documentation):

In Microsoft Defender XDR, custom detection rules are scheduled KQL queries that evaluate telemetry on a recurring schedule, using a lookback (loopback) period to determine how much historical data to analyze during each run.

The loopback period determines the time window over which data is evaluated (e.g., 12 hours, 48 hours). To change this period, administrators modify the rule’s schedule configuration — specifically the frequency or recurrence settings in the custom detection rule editor. The KQL query (including summarize or where operators) defines the logic but not the temporal scope of data evaluation.

Therefore, extending the loopback from 12 hours to 48 hours requires adjusting the frequency (schedule) configuration of the rule, not the query itself.

✅ Correct Answer: A. the frequency

To minimize administrative effort in responding to incidents and remediating security threats in Microsoft Sentinel, you should use the platform’s built-in automation and orchestration capabilities — specifically Automation Rules and Playbooks.

Microsoft Sentinel Automation Rules (Option C):

Automation rules in Sentinel allow you to automate incident management tasks such as assigning owners, changing severity, tagging, or automatically running playbooks when an incident or alert is created.

They help standardize responses across similar alerts, significantly reducing manual intervention.

Microsoft documentation states:

“Automation rules simplify the management of playbook triggers and incident handling by allowing you to define actions that automatically occur when incidents are created or updated.”

Microsoft Sentinel Playbooks (Option D):

Playbooks are Logic App–based workflows that automate responses to security alerts or incidents.

They can perform remediation actions such as disabling compromised accounts, isolating infected devices, blocking IP addresses, or sending notifications to SOC teams.

You can link playbooks directly to analytics rules or call them through automation rules for end-to-end automation.

Incorrect Options:

A. Bookmarks are used for hunting investigations, not for automation or remediation.

B. Azure Automation runbooks can be used for specific administrative scripts but require more manual setup and integration — not the most efficient choice for Sentinel’s automated workflows.

E. Azure Functions apps are custom code execution environments; while powerful, they are not the primary tool for Sentinel’s automated response.

The case study requires:

“Ensure that the Group1 members can create and edit playbooks.”

In Microsoft Sentinel, the ability to create, edit, and assign playbooks is granted by the Microsoft Sentinel Automation Contributor role.

This role allows users to:

Create and manage automation rules,

Create and edit playbooks (Logic Apps) in the connected subscription,

Associate playbooks with Sentinel incidents or alerts.

By contrast:

Logic App Contributor allows Logic App creation but doesn’t include Sentinel-level integration permissions.

Automation Operator can run playbooks but not edit or create them.

Sentinel Playbook Operator can execute playbooks but cannot modify or assign them.

✅ Answer for Question 11: A. Microsoft Sentinel Automation Contributor

The requirement is to enable Microsoft Defender for Servers Plan 2 on all Azure VMs while excluding Server2 from agentless scanning. Defender for Cloud provides a built-in mechanism to exclude specific machines from agentless scanning based on resource tags. The process is: assign a distinct tag name:value to the VM you want to exclude (Server2), and then, in Defender for Cloud’s Agentless scanning for machines settings, specify that tag pair under exclusions. Defender’s continuous discovery honors these exclusions and skips any VM that matches the configured tag. This approach aligns with the business requirement of least privilege and minimal administrative effort: it avoids broad configuration changes, requires no extensions on the VM, and is reversible by simply removing or changing the tag. The Microsoft Antimalware extension and Automanage configuration are unrelated to agentless scanning behavior, and a resource lock would only prevent modifications/deletions, not scanning. Therefore, to meet the Defender for Cloud requirement precisely, configure an Azure resource tag on Server2 and reference that tag in the agentless scanning exclusion settings.

Microsoft Sentinel playbooks can be triggered by different types of events—alerts, incidents, or entities. Since the requirement specifies “incidents generated by rulequery1” and asks for automatic processing of those incidents, the correct approach is to use a playbook with an incident trigger.

According to Microsoft Sentinel automation documentation:

“When you want automation to start after an incident is created or updated, use the incident trigger. This allows you to automate workflows such as closing incidents, adding comments, or sending notifications.”

This trigger type works with automation rules that specify when and how to execute playbooks based on incident state or severity. Using a playbook with an incident trigger meets the need for post-incident automation (e.g., auto-closing incidents if they match certain conditions).

✅ Answer for Question 8: A. a playbook with an incident trigger

To have a Microsoft Sentinel workbook pull live data from an external web service, you use the workbook’s built-in JSON data source. Workbooks can query REST endpoints that return JSON and render results dynamically in visuals. Because the Azure portal (where the workbook runs) is a different origin than your on-prem/public Webapp1, browsers will block these cross-origin requests unless the endpoint explicitly allows them. Therefore, the external service must enable CORS to permit the portal’s origin to fetch the JSON. This aligns with Microsoft guidance that Workbooks can query HTTP/HTTPS JSON endpoints and that external endpoints must allow cross-origin requests for client-side calls from the Azure portal. Enforcing CORS on Webapp1 satisfies the security model while enabling the workbook to retrieve data at view time—meeting the requirement to “dynamically retrieve data from Webapp1.” Options like “custom endpoint” or “custom resource provider” aren’t needed here, and enabling SOP or only enforcing TLS 1.2 wouldn’t address the browser’s cross-origin policy blocking the call.

To monitor Windows Security events from Server1 using the Windows Security Events via AMA connector, the first object you must create is a Data Collection Rule (DCR). With the Azure Monitor Agent (AMA) model used by Microsoft Sentinel, data flow is controlled by DCRs, not by the legacy MMA/OMS workspace settings. A DCR defines what to collect (e.g., the Security event log, specific event IDs or XPath queries), from where (the target machines or machine groups), and where to send it (the Sentinel/Log Analytics workspace). After creating the DCR, you associate it with Server1 (Arc-enabled), and the connector will begin streaming Security events to your Sentinel workspace. Creating a Sentinel scheduled rule or an automation rule does not enable collection; those features act after data is already ingested. Event Grid topics are unrelated to Windows event collection. Therefore, the correct first step for meeting the Sentinel requirement to monitor Server1’s Security log via AMA is to create a DCR, then assign it to Server1 and the Sentinel workspace.

In Microsoft Sentinel’s Advanced Security Information Model (ASIM), DNS queries are normalized through the Im_Dns parser, which unifies DNS telemetry from multiple sources (Infoblox, Windows DNS, Azure Firewall DNS proxy, etc.). Microsoft guidance states that when you need broad compatibility and want to “use built-in ASIM parsers whenever possible,” you should call the generic Im_Dns() parser. To minimize overhead, ASIM provides a pack parameter that restricts the parser to a specific content pack (vendor/source) so it won’t iterate through all available source parsers under the hood. For Infoblox NIOS, you pass the Infoblox pack via the pack parameter, which limits parsing to the Infoblox implementation and reduces query cost/latency while keeping the query portable across environments.

Putting it together, the recommended pattern is:

Im_Dns(pack="InfobloxNIOS")

| where DnsResponseCodeName == "NXDOMAIN"

| summarize count()

This approach satisfies all requirements:

Uses built-in ASIM (Im_Dns).

Minimizes query overhead (uses pack to limit parsing to Infoblox).

Targets NXDOMAIN responses for counting DNS request failures from Infoblox1.

To show labeled files from Windows 10 endpoints in the Azure Information Protection – Data discovery dashboard, you must first enable the built-in integration between Microsoft Defender for Endpoint and Azure Information Protection (AIP). This is turned on in the Microsoft Defender Security Center under Settings → Advanced features. When enabled, Defender for Endpoint inventories sensitivity labels seen on files across managed Windows devices and streams that telemetry to the AIP Data discovery experience, providing visibility into where labeled data resides on endpoints. Scanner clusters and content scan jobs in AIP are intended for on-premises repositories (file shares/SharePoint servers), not for endpoint discovery. Device health/compliance reports do not surface or forward label inventory to AIP. Therefore, the first configuration step is enabling the AIP integration advanced feature in Defender for Endpoint so labeled files on Windows clients appear in the AIP Data discovery dashboard.

To restrict cloud apps running on CLIENT1 (a Windows 10 endpoint) in compliance with Microsoft Defender for Endpoint (MDE) requirements, you must integrate Microsoft Defender for Endpoint with Microsoft Defender for Cloud Apps (formerly Cloud App Security) using Cloud Discovery. This integration enables the blocking of unsanctioned cloud apps through the endpoint’s network protection capabilities.

According to Microsoft Defender for Cloud Apps documentation, Cloud Discovery uses traffic data from Defender for Endpoint to identify and manage the use of shadow IT. The relevant steps include:

1️⃣ Enable advanced features in Microsoft Defender for Endpoint (M365 Defender portal → Settings → Endpoints → Advanced features).

You must enable the following advanced features:

Microsoft Defender for Cloud Apps integration

Network protection (in block mode)

Custom network indicators (if applicable)These options allow Defender for Endpoint to share telemetry and enforce app restrictions received from Defender for Cloud Apps.

2️⃣ Configure Cloud Discovery settings in Microsoft Defender for Cloud Apps.

In the Defender for Cloud Apps portal, Cloud Discovery must be configured to receive continuous reports from Defender for Endpoint devices. Within these settings, you define sanctioned and unsanctioned applications. Once an app is marked as unsanctioned, Defender for Endpoint enforces blocking on all onboarded devices (like CLIENT1).

This two-part configuration ensures that MDE enforces the blocking of unsanctioned cloud applications discovered through Cloud App Security telemetry, fulfilling the business requirement that “All Cloud App Security unsanctioned apps must be blocked on the Windows 10 computers by using Microsoft Defender for Endpoint.”

According to Microsoft Defender for Cloud (formerly Azure Security Center) documentation, when integrating servers and virtual machines for security monitoring, the Defender for Cloud data is stored and analyzed in a Log Analytics workspace. Microsoft best practices recommend using an existing workspace when one is already deployed for centralized log collection—especially if it already gathers telemetry from Azure and on-premises resources.

In this case, the existing workspace LA1 already “contains logs and metrics collected from all Azure resources and on-premises servers.” This satisfies the business requirement of “all servers must send logs to the same Log Analytics workspace.” Creating a new workspace would violate the cost-minimization and centralization requirements. Therefore, LA1 is the correct workspace to use.

For the Windows security events collection setting, Defender for Cloud offers three levels:

Minimal – collects essential security events only (insufficient for comprehensive monitoring).

Common – collects a balanced set of security-related events (such as account logon, privilege use, and object access), recommended by Microsoft for most environments.

All Events – collects every possible security event, which increases data ingestion cost and is typically used only for high-security or regulated environments.

Because Litware Inc. must minimize cost while ensuring a full audit trail of user activities, the Common level provides the optimal balance of visibility and cost efficiency.

Therefore, based on Microsoft Defender for Cloud configuration guidelines:

✅ Log Analytics workspace to use: LA1

✅ Windows security events to collect: Common

 Table: DeviceFileEvents

 Aggregation function: count()

In Microsoft Defender XDR advanced hunting, data tables such as DeviceFileEvents, DeviceProcessEvents, and CloudAppEvents are used to investigate various types of activities. Since this query aims to investigate an issue related to file activity—specifically identifying when files have been accessed, modified, or created repeatedly—the correct data source table is DeviceFileEvents. This table contains information about file-level activities recorded by Defender for Endpoint sensors, including file path, file name, action type, and user account involved.

The KQL structure shown in the image follows standard hunting query syntax:

DeviceFileEvents

| where Timestamp > ago(2d)

| summarize activityCount = count() by FolderPath, FileName, ActionType, AccountDisplayName

| where activityCount > 5

Here’s why:

The where Timestamp > ago(2d) clause filters results from the last 2 days, a typical timeframe for immediate investigations.

The summarize operator groups events by FolderPath, FileName, ActionType, and AccountDisplayName, then uses count() to determine how many times each file was acted upon.

Finally, where activityCount > 5 filters to show only unusually high-frequency activity, which might indicate suspicious or automated file manipulation.

Microsoft Defender XDR documentation highlights that DeviceFileEvents is the correct schema for file activity investigations, while DeviceProcessEvents focuses on process creation and execution, and CloudAppEvents targets cloud application usage.

Thus, the verified and documented correct completions are:

Table: DeviceFileEvents

Aggregation function: count()

To complete the KQL query against the BehaviorAnalytics table, you need to know the exact column name (for example, the Boolean field that flags a new or first-time country for the sign-in). Microsoft’s standard method to discover table schemas and column names is the Logs (Log Analytics) query window. In this pane, the left-hand Schema browser lists all connected tables and, when expanded, shows every column name and data type. Selecting a table (e.g., BehaviorAnalytics) reveals its fields, and the editor provides IntelliSense/autocomplete for columns as you type your KQL, making it straightforward to complete a clause like | where == true.

Security alerts in Azure Security Center (Defender for Cloud), the Azure Activity log, and Azure Advisor do not expose the per-table column schema needed to build KQL filters. Security Center surfaces alerts and recommendations; the Activity log records control-plane operations; and Advisor provides optimization guidance—none of these replace the Logs experience for exploring data schemas.

Therefore, to accurately identify and verify the column required in the where clause for failed sign-ins from a first-time country, you should use the Log Analytics workspace query window, consult the Schema pane for the BehaviorAnalytics table, and leverage the editor’s autocomplete to insert the correct column name.

As outlined in Microsoft’s official Defender for Office 365 documentation, this service provides comprehensive protection against threats targeting Microsoft 365 collaboration tools—such as SharePoint Online, OneDrive for Business, and Microsoft Teams. The marketing team uses SharePoint Online for vendor collaboration and has experienced incidents in which vendors uploaded malicious files. Microsoft Defender for Office 365 specifically addresses this scenario through features like Safe Attachments and Safe Links, which automatically scan uploaded or shared files for malware and block access to harmful content.

When a vendor uploads a file to SharePoint Online, Defender for Office 365 inspects the file in real time within a virtual sandbox environment before allowing users to open or share it. If malware is detected, the system quarantines or removes the file and notifies administrators. These detection and remediation capabilities prevent infection propagation, protect sensitive marketing data, and maintain compliance with Contoso’s security posture.

By leveraging Defender for Office 365, Contoso’s marketing team can continue external collaboration safely, ensuring that all uploaded files are scanned and validated before internal access—thereby resolving their specific malware-related issue.