Disagreement ranking

SC-200 — most debated topics

Community-voted ranking of 79 topics, sorted by disagreement level. A higher dispute score means more test-takers disagree on the answer.

Full ranking

79 topics · highest disagreement first

  1. Creating a Microsoft Sentinel bookmark from the Hunting page to support an incident investigation

    S-grade Dispute: 61% 9 comments

  2. Containing a Defender for Identity pass-the-ticket alert by quarantining only the affected device

    S-grade Dispute: 56% 14 comments

  3. Identifying Affected Entities in Microsoft Defender XDR Incidents

    S-grade Dispute: 56% 22 comments

  4. Limiting Microsoft Defender device discovery to specific onboarded devices by creating a device tag first

    S-grade Dispute: 52% 15 comments

  5. Least-privilege roles for Microsoft 365 Defender action approvals

    S-grade Dispute: 50% 28 comments

  6. Querying Sentinel Watchlists via Azure Resource Graph

    A-grade Dispute: 50% 2 comments

  7. Responding to Compromised Linux Endpoints in Microsoft Defender XDR

    A-grade Dispute: 50% 8 comments

  8. Assigning the Microsoft Sentinel Responder role so a user can investigate incidents under least privilege

    S-grade Dispute: 45% 8 comments

  9. Choosing the Azure Activity workbook to analyze subscription-level administrative actions in Microsoft Sentinel

    S-grade Dispute: 44% 5 comments

  10. Setting a custom detection rule frequency to identify C2 communication within the past 14 days

    S-grade Dispute: 44% 9 comments

  11. Blocking suspected malware by file hash indicators in Defender for Endpoint — only PE files are supported

    S-grade Dispute: 41% 14 comments

  12. Manual Remediation for Malware-Infected Emails in Defender XDR

    A-grade Dispute: 40% 13 comments

  13. Reviewing Prefetch files in the investigation package to find first and last execution times of an executable

    S-grade Dispute: 36% 8 comments

  14. Using the Evidence and Response tab to see all entities affected by a Defender XDR incident

    S-grade Dispute: 35% 15 comments

  15. Selecting Defender for Resource Manager and Defender for DevOps to mitigate source-code, template, malicious-IP, and secret risks

    S-grade Dispute: 33% 6 comments

  16. Enabling the Microsoft 365 connector and app governance so Defender for Cloud Apps feeds automatic attack disruption

    A-grade Dispute: 33% 3 comments

  17. Identifying Zero-Hour Auto Purge (ZAP) Actions in Defender

    A-grade Dispute: 33% 22 comments

  18. Collecting a Defender for Endpoint investigation package to get network, process, and login data with least effort

    S-grade Dispute: 31% 10 comments

  19. Counting incidents created when four independent Sentinel analytics rules all fire for one action

    S-grade Dispute: 29% 9 comments

  20. Assigning Workbook Contributor so a user can deploy and customize Sentinel workbook templates under least privilege

    S-grade Dispute: 29% 8 comments

  21. Detect Data Theft by Departing Users with Insider Risk Management

    S-grade Dispute: 29% 61 comments

  22. Scoping Microsoft Defender XDR deception rules to specific devices with device tags

    S-grade Dispute: 25% 6 comments

  23. Granting Defender XDR Unified RBAC permission to send alert email notifications under least privilege

    S-grade Dispute: 25% 9 comments

  24. Using EDR in block mode to remediate artifacts missed by a third-party antivirus in passive mode

    A-grade Dispute: 25% 3 comments

  25. Viewing all shared Copilot for Security session results regardless of the recipient's plugin permissions

    A-grade Dispute: 25% 3 comments

  26. Assigning Security Operator to Group1 and Copilot Contributor to Group2 for least-privilege Copilot and incident response

    A-grade Dispute: 22% 3 comments

  27. Assigning the Copilot Owner role so a user can upload files, view the usage dashboard, and share promptbooks with all users

    S-grade Dispute: 20% 6 comments

  28. Scoping a Defender XDR custom deception rule to 10 specific devices by assigning device tags first

    S-grade Dispute: 20% 9 comments

  29. Configuring a critical asset rule so a database server appears on the Defender XDR attack surface map

    A-grade Dispute: 20% 3 comments

  30. Resolving Copilot for Security capacity limits by increasing provisioned SCUs

    A-grade Dispute: 20% 3 comments

  31. Collecting a Defender for Endpoint investigation package via CLI live response only on macOS and Linux devices

    S-grade Dispute: 18% 7 comments

  32. Creating a promptbook from selected session prompts without including responses

    A-grade Dispute: 17% 3 comments

  33. Assigning Security Administrator so a user can manage Defender XDR custom detection rules and Endpoint security policies

    S-grade Dispute: 9% 8 comments

  34. Using Defender XDR alert tuning rules to hide or resolve alerts and reduce alert fatigue

    A-grade Dispute: 0% 3 comments

  35. Selecting the Common Windows Security event set to get a user audit trail while minimizing volume

    A-grade Dispute: 0% 4 comments

  36. Connecting the Microsoft 365 app connector to enrich Cloud Discovery usernames with Entra ID UPNs

    A-grade Dispute: 0% 3 comments

  37. Adding a query to a Sentinel workbook to build a timechart of SecurityEvent counts by day

    A-grade Dispute: 0% 3 comments

  38. Streaming Microsoft Graph activity logs to a third-party SIEM via Azure Event Hubs

    A-grade Dispute: 0% 3 comments

  39. Using a Conditional Access policy to revoke or force re-authentication of a compromised Outlook on the web session

    A-grade Dispute: 0% 3 comments

  40. Enabling the Defender for Cloud CSPM plan so regulatory compliance standards can be added

    A-grade Dispute: 0% 4 comments

  41. Finding enabled anomaly rules in Sentinel on the Analytics page Anomalies tab

    A-grade Dispute: 0% 3 comments

  42. Creating a scheduled query rule from a hunting query so detections generate incidents

    A-grade Dispute: 0% 3 comments

  43. Creating a Conditional Access policy first to enable Defender for Cloud Apps session control

    A-grade Dispute: 0% 3 comments

  44. Installing the Azure Connected Machine agent to onboard an AWS-hosted server to Defender for Cloud

    A-grade Dispute: 0% 7 comments

  45. Analyzing Microsoft Graph API attack tactics through the MicrosoftGraphActivityLogs advanced-hunting table

    A-grade Dispute: 0% 4 comments

  46. Why increasing audit-search record count does not fix missing JSON columns in Excel

    A-grade Dispute: 0% 3 comments

  47. Reducing rows before the JSON transform so Excel generates the needed audit columns

    A-grade Dispute: 0% 3 comments

  48. Reducing returned records from Defender before export so Excel builds the audit JSON columns

    A-grade Dispute: 0% 3 comments

  49. Identifying the incident remediation action that requires manual action despite full automation

    A-grade Dispute: 0% 6 comments

  50. Submitting only PE files for Microsoft Defender XDR deep analysis

    A-grade Dispute: 0% 5 comments

  51. Analyzing all Microsoft Graph API attack tactics through the MicrosoftGraphActivityLogs table

    A-grade Dispute: 0% 4 comments

  52. Labeling an IP address entity as an IoC directly from a Sentinel incident

    A-grade Dispute: 0% 5 comments

  53. Using Sentinel automation rules and playbooks to minimize incident response effort

    A-grade Dispute: 0% 4 comments

  54. Uploading a signed PowerShell script to the live response library before running it

    A-grade Dispute: 0% 4 comments

  55. Using the SeenBy() function to map discovered network devices to the onboarded device that saw them

    A-grade Dispute: 0% 3 comments

  56. Querying IdentityLogonEvents to hunt LDAP simple binds to AD DS domain controllers

    A-grade Dispute: 0% 5 comments

  57. Creating Custom Tracked Queries in Microsoft Defender

    A-grade Dispute: 0% 6 comments

  58. How Do You Add a Defender for Cloud Apps Alert to a Sentinel Incident?

    A-grade Dispute: 0% 31 comments

  59. How Do You Run a KQL Query as a Sentinel Search Job?

    A-grade Dispute: 0% 3 comments

  60. How to Identify MITRE ATT&CK Phases in Microsoft Sentinel?

    A-grade Dispute: 0% 1 comments

  61. How do you join two Sentinel auxiliary tables for six months of data?

    A-grade Dispute: 0% 2 comments

  62. How do you check if AzureActivity exists in each Sentinel workspace?

    A-grade Dispute: 0% 1 comments

  63. Which least-privilege role enables the Microsoft Sentinel plugin in Copilot for Security?

    A-grade Dispute: 0% 1 comments

  64. What retention period should you set for the AzureActivity table?

    A-grade Dispute: 0% 1 comments

  65. Which Devices Support Custom IoCs in Defender for Endpoint?

    A-grade Dispute: 0% 1 comments

  66. How should a scheduled KQL job write to an existing Sentinel data lake table?

    A-grade Dispute: 0% 1 comments

  67. Which KQL Table and Status Code Show Unauthorized Requests?

    A-grade Dispute: 0% 15 comments

  68. Where to Create a Conditional Access App Control Custom Policy and Enable It

    A-grade Dispute: 0% 9 comments

  69. Escalating Alerts in Azure Sentinel via Incident Assignment

    A-grade Dispute: 0% 15 comments

  70. How do you enable Sentinel UEBA and collect on-premises AD DS events?

    A-grade Dispute: 0% 8 comments

  71. Configuring Automated Investigation Packages in Microsoft Defender for Endpoint

    A-grade Dispute: 0% 4 comments

  72. Collecting Forensic Data in Microsoft Defender XDR

    A-grade Dispute: 0% 2 comments

  73. Suppressing False Positive Alerts in Microsoft Defender for Endpoint

    S-grade Dispute: 0% 91 comments

  74. Microsoft Defender for Identity Honeytoken Configuration

    A-grade Dispute: 0% 9 comments

  75. Enforcing MFA for Remote Workers Using Named Locations

    A-grade Dispute: 0% 12 comments

  76. Supported File Formats for Microsoft Security Copilot Uploads

    A-grade Dispute: 0% 2 comments

  77. Validate ASR Policy Impact Using Troubleshooting Mode

    A-grade Dispute: 0% 1 comments

  78. Minimize Administrative Effort for Process and Network Data in Microsoft Defender

    A-grade Dispute: 0% 20 comments

  79. Creating a Custom Promptbook in Microsoft Security Copilot

    A-grade Dispute: 0% 3 comments

← Back to SC-200 Microsoft Security Operations Analyst Study Guide