SC-200 — Most Debated Topics

Community-voted ranking of 49 topics, sorted by disagreement level. Higher dispute = more test-takers disagree on the answer.

#1
Creating a Microsoft Sentinel bookmark from the Hunting page to support an incident investigation
S-Grade Dispute: 61% 9 comments
#2
Containing a Defender for Identity pass-the-ticket alert by quarantining only the affected device
S-Grade Dispute: 56% 14 comments
#3
Limiting Microsoft Defender device discovery to specific onboarded devices by creating a device tag first
S-Grade Dispute: 52% 15 comments
#4
Assigning the Microsoft Sentinel Responder role so a user can investigate incidents under least privilege
S-Grade Dispute: 45% 8 comments
#5
Choosing the Azure Activity workbook to analyze subscription-level administrative actions in Microsoft Sentinel
S-Grade Dispute: 44% 5 comments
#6
Setting a custom detection rule frequency to identify C2 communication within the past 14 days
S-Grade Dispute: 44% 9 comments
#7
Blocking suspected malware by file hash indicators in Defender for Endpoint — only PE files are supported
S-Grade Dispute: 41% 14 comments
#8
Reviewing Prefetch files in the investigation package to find first and last execution times of an executable
S-Grade Dispute: 36% 8 comments
#9
Using the Evidence and Response tab to see all entities affected by a Defender XDR incident
S-Grade Dispute: 35% 15 comments
#10
Selecting Defender for Resource Manager and Defender for DevOps to mitigate source-code, template, malicious-IP, and secret risks
S-Grade Dispute: 33% 6 comments
#11
Enabling the Microsoft 365 connector and app governance so Defender for Cloud Apps feeds automatic attack disruption
A-Grade Dispute: 33% 3 comments
#12
Collecting a Defender for Endpoint investigation package to get network, process, and login data with least effort
S-Grade Dispute: 31% 10 comments
#13
Counting incidents created when four independent Sentinel analytics rules all fire for one action
S-Grade Dispute: 29% 9 comments
#14
Assigning Workbook Contributor so a user can deploy and customize Sentinel workbook templates under least privilege
S-Grade Dispute: 29% 8 comments
#15
Scoping Microsoft Defender XDR deception rules to specific devices with device tags
S-Grade Dispute: 25% 6 comments
#16
Granting Defender XDR Unified RBAC permission to send alert email notifications under least privilege
S-Grade Dispute: 25% 9 comments
#17
Using EDR in block mode to remediate artifacts missed by a third-party antivirus in passive mode
A-Grade Dispute: 25% 3 comments
#18
Viewing all shared Copilot for Security session results regardless of the recipient's plugin permissions
A-Grade Dispute: 25% 3 comments
#19
Assigning Security Operator to Group1 and Copilot Contributor to Group2 for least-privilege Copilot and incident response
A-Grade Dispute: 22% 3 comments
#20
Assigning the Copilot Owner role so a user can upload files, view the usage dashboard, and share promptbooks with all users
S-Grade Dispute: 20% 6 comments
#21
Scoping a Defender XDR custom deception rule to 10 specific devices by assigning device tags first
S-Grade Dispute: 20% 9 comments
#22
Configuring a critical asset rule so a database server appears on the Defender XDR attack surface map
A-Grade Dispute: 20% 3 comments
#23
Resolving Copilot for Security capacity limits by increasing provisioned SCUs
A-Grade Dispute: 20% 3 comments
#24
Collecting a Defender for Endpoint investigation package via CLI live response only on macOS and Linux devices
S-Grade Dispute: 18% 7 comments
#25
Creating a promptbook from selected session prompts without including responses
A-Grade Dispute: 17% 3 comments
#26
Assigning Security Administrator so a user can manage Defender XDR custom detection rules and Endpoint security policies
S-Grade Dispute: 9% 8 comments
#27
Using Defender XDR alert tuning rules to hide or resolve alerts and reduce alert fatigue
A-Grade Dispute: 0% 3 comments
#28
Selecting the Common Windows Security event set to get a user audit trail while minimizing volume
A-Grade Dispute: 0% 4 comments
#29
Connecting the Microsoft 365 app connector to enrich Cloud Discovery usernames with Entra ID UPNs
A-Grade Dispute: 0% 3 comments
#30
Adding a query to a Sentinel workbook to build a timechart of SecurityEvent counts by day
A-Grade Dispute: 0% 3 comments
#31
Streaming Microsoft Graph activity logs to a third-party SIEM via Azure Event Hubs
A-Grade Dispute: 0% 3 comments
#32
Using a Conditional Access policy to revoke or force re-authentication of a compromised Outlook on the web session
A-Grade Dispute: 0% 3 comments
#33
Enabling the Defender for Cloud CSPM plan so regulatory compliance standards can be added
A-Grade Dispute: 0% 4 comments
#34
Finding enabled anomaly rules in Sentinel on the Analytics page Anomalies tab
A-Grade Dispute: 0% 3 comments
#35
Creating a scheduled query rule from a hunting query so detections generate incidents
A-Grade Dispute: 0% 3 comments
#36
Creating a Conditional Access policy first to enable Defender for Cloud Apps session control
A-Grade Dispute: 0% 3 comments
#37
Installing the Azure Connected Machine agent to onboard an AWS-hosted server to Defender for Cloud
A-Grade Dispute: 0% 7 comments
#38
Analyzing Microsoft Graph API attack tactics through the MicrosoftGraphActivityLogs advanced-hunting table
A-Grade Dispute: 0% 4 comments
#39
Why increasing audit-search record count does not fix missing JSON columns in Excel
A-Grade Dispute: 0% 3 comments
#40
Reducing rows before the JSON transform so Excel generates the needed audit columns
A-Grade Dispute: 0% 3 comments
#41
Reducing returned records from Defender before export so Excel builds the audit JSON columns
A-Grade Dispute: 0% 3 comments
#42
Identifying the incident remediation action that requires manual action despite full automation
A-Grade Dispute: 0% 6 comments
#43
Submitting only PE files for Microsoft Defender XDR deep analysis
A-Grade Dispute: 0% 5 comments
#44
Analyzing all Microsoft Graph API attack tactics through the MicrosoftGraphActivityLogs table
A-Grade Dispute: 0% 4 comments
#45
Labeling an IP address entity as an IoC directly from a Sentinel incident
A-Grade Dispute: 0% 5 comments
#46
Using Sentinel automation rules and playbooks to minimize incident response effort
A-Grade Dispute: 0% 4 comments
#47
Uploading a signed PowerShell script to the live response library before running it
A-Grade Dispute: 0% 4 comments
#48
Using the SeenBy() function to map discovered network devices to the onboarded device that saw them
A-Grade Dispute: 0% 3 comments
#49
Querying IdentityLogonEvents to hunt LDAP simple binds to AD DS domain controllers
A-Grade Dispute: 0% 5 comments

Ready to practice?

Access 80 SC-200 questions with instant feedback and detailed explanations.

View SC-200 Practice Questions →

← Back to SC-200 Microsoft Security Operations Analyst Study Guide