SC-200 — Microsoft Security Operations Analyst
Microsoft

Microsoft Security Operations Analyst (SC-200) Practice Questions

★★★★★★ 4.6 545 verified reviews
80 questions
June 11, 2026 updated
✓ Online quiz simulator
▶ Start Free Practice Exam

Domain coverage

  • Manage a security operations environment (40–45%)
  • Respond to security incidents (35–40%)
  • Perform threat hunting (20–25%)

Sample Questions (8 of 80 shown)

Q1 Perform threat hunting
Which KQL query correctly uses Microsoft Defender XDR advanced hunting to find all devices that executed a process named 'mimikatz.exe' in the last 7 days?
  1. DeviceProcessEvents | filter FileName = 'mimikatz.exe' AND time > 7d
  2. DeviceProcessEvents | where FileName == 'mimikatz.exe' | where Timestamp > ago(7d)
  3. SELECT * FROM DeviceProcessEvents WHERE FileName = 'mimikatz.exe' AND date > NOW()-7
  4. DeviceProcessEvents | where ProcessName contains 'mimikatz' | limit 100
✓ Correct Answer: B
Valid KQL syntax: 'where' is the filtering operator, '==' is equality for strings, 'ago(7d)' is the correct time span function, and 'Timestamp' is the correct field name in DeviceProcessEvents (vs. 'TimeGenerated' in Sentinel tables).
Q2 Perform threat hunting
Which KQL query correctly shows all failed sign-in events from the Sentinel SigninLogs table in the last 24 hours where the failure reason was 'Invalid password', ordered by most recent first?
  1. SigninLogs | filter ResultType = 'failed' | filter time > 24h | sort by time
  2. SELECT * FROM SigninLogs WHERE ResultType != 0 AND time > NOW()-24h ORDER BY time DESC
  3. SigninLogs | where ResultType != 0 | where ResultDescription == 'Invalid password' | where TimeGenerated > ago(24h) | order by TimeGenerated desc
  4. SigninLogs | where Status == 'Failure' | where Reason == 'InvalidPassword' | top 100
✓ Correct Answer: C
Sentinel tables use TimeGenerated (not Timestamp). ResultType = 0 means success; non-zero means failure. 'order by' is the correct KQL sorting operator. ResultDescription stores the failure reason text.
Q3 Perform threat hunting
Your organization wants Sentinel to detect when user behavior significantly deviates from their normal baseline — for example, downloading 50 times more data than usual or accessing systems never accessed before. Which Sentinel feature provides this?
  1. User and Entity Behavior Analytics (UEBA)
  2. Scheduled analytics rules with static thresholds
  3. Microsoft Defender for Identity alerts
  4. Azure AD Identity Protection risk policies
✓ Correct Answer: A
Sentinel UEBA learns each user's normal behavior during a baseline period (typically 14+ days), then detects anomalies. It creates entity behavior profiles, assigns anomaly scores, and surfaces results in the UEBA dashboard and Fusion incidents.
Q4 Perform threat hunting
You need to write an advanced hunting query that identifies all devices where a process was created by Microsoft Word (winword.exe) in the last 24 hours. Which query correctly accomplishes this?
  1. DeviceProcessEvents | where Timestamp > ago(1d) | where InitiatingProcessFileName == 'winword.exe' | project DeviceName, FileName, ProcessCommandLine, Timestamp
  2. DeviceFileEvents | where Timestamp > ago(1d) | where FileName endswith '.docx'
  3. DeviceEvents | where ActionType == 'ProcessCreated' and InitiatingProcessFileName == 'winword.exe'
  4. DeviceNetworkEvents | where RemoteUrl startswith 'word'
✓ Correct Answer: A
DeviceProcessEvents tracks process creation events. Filtering by InitiatingProcessFileName == 'winword.exe' identifies child processes of Word. The project operator returns relevant columns. This is a common hunting pattern for macro-based malware delivery.
Q5 Perform threat hunting
In Microsoft Sentinel, you want to search for signs of C2 (command and control) communication by identifying devices making unusual outbound connections to rarely-accessed domains. Which KQL pattern should you use?
  1. Use summarize to count connections per domain per device, then filter domains with low overall frequency but recent spikes
  2. Use a simple where clause filtering all outbound ports
  3. Use project to list all domains alphabetically
  4. Use union to combine all network logs
✓ Correct Answer: A
The summarize operator groups data for aggregation. Counting connections per domain per device and filtering for domains with low historical frequency but recent spikes is an effective C2 hunting pattern. This can be done using bin(), count(), and filtering on percentiles or baseline comparisons.
Q6 Perform threat hunting
You are hunting for kerberoasting attacks using Microsoft Defender XDR advanced hunting. Which table should you query to find unusual Kerberos TGS request patterns that may indicate credential theft?
  1. DeviceLogonEvents
  2. IdentityLogonEvents
  3. DeviceProcessEvents
  4. DeviceNetworkEvents
✓ Correct Answer: B
IdentityLogonEvents contains authentication events from Active Directory including Kerberos TGS requests. Kerberoasting involves requesting TGS tickets for service accounts, then attempting to crack them offline. Unusual patterns (high volume, uncommon SPNs) in this table can indicate kerberoasting.
Q7 Perform threat hunting
You need to create a custom detection rule in Microsoft Defender XDR using advanced hunting. What must you include when creating a custom detection from a hunting query?
  1. The query, a list of impacted entities, and an alert title
  2. Only the KQL query — everything else is automatic
  3. A Logic App for automated response
  4. A Microsoft Sentinel analytics rule to supplement the detection
✓ Correct Answer: A
When creating a custom detection rule from a hunting query in Microsoft Defender XDR, you must provide: the KQL query, the list of impacted entities (devices, users, mailboxes), an alert title, severity, and the action to take (generate alert per event or per device/user).
Q8 Perform threat hunting
Which KQL operator would you use in an advanced hunting query to join DeviceProcessEvents with DeviceFileEvents to correlate process creations with file modifications?
  1. union
  2. join
  3. extend
  4. where
✓ Correct Answer: B
The join operator merges rows from two tables based on matching column values. For correlating process creations with file modifications, you would join on DeviceName and TimeGenerated (or DeviceId), specifying an appropriate join kind (e.g., inner) and time window.

You've viewed 3 of 80 questions. Start the free practice exam to answer all questions with instant feedback.

Exam overview

Microsoft's SC-200 exam targets the Security Operations Analyst who designs and implements threat detection and response solutions across the Microsoft Defender and Sentinel ecosystems. Offered through Pearson VUE as a proctored exam, passing SC-200 awards the Microsoft Certified: Security Operations Analyst Associate credential and demonstrates hands-on competence in KQL-driven threat hunting, incident triage, and automated response playbooks.

Candidates preparing for SC-200 should already have a working grasp of cloud identity, Azure tenant structures, and basic security concepts—the SC-900 fundamentals track provides a good baseline, though it is not a mandatory prerequisite. The most valuable preparation combines the official four-day SC-200T00-A instructor-led course with extensive hands-on time in a Microsoft 365 E5 trial tenant, where you can configure Sentinel connectors, write KQL queries against real log data, and test Defender for Endpoint live response actions on isolated devices.

The exam weighs three domains: managing a security operations environment (40–45%), responding to security incidents (35–40%), and performing threat hunting (20–25%). The biggest technical challenge candidates face is constructing correct Kusto Query Language (KQL) statements—you must know which tables (SecurityEvent, SigninLogs, DeviceProcessEvents) to query and how to use operators like summarize, join, and make-series to surface anomalies. Equally important is understanding when an Automation Rule can handle incident triage natively versus when a Logic App Playbook must be invoked for multi-step orchestration.

Our practice questions mirror the SC-200 question formats you will encounter on exam day: extended case studies with un-reviewable blocks, KQL syntax drop-downs, drag-and-drop incident response sequencing, and multiple-choice scenarios rooted in Defender XDR and Sentinel workflows. Each question includes a detailed answer explanation that walks through the reasoning and references the specific Microsoft documentation path, while the downloadable PDF packages the same question bank for offline review during commutes or in environments without stable internet.

Official Exam Domains & Weighting

To successfully pass the SC-200 exam, candidates must master the following core domains:
  • Domain 1: Manage a security operations environment (40–45%)
Covers Sentinel workspace architecture including log retention, data archiving, and RBAC role design (Sentinel Reader, Responder, Contributor). Key skills include configuring data ingestion via Azure Monitor Agent (AMA) and CEF connectors, setting up ASIM parsers, and designing automation rules and Logic App playbooks for incident triage workflows.
  • Domain 2: Respond to security incidents (35–40%)
Focuses on Defender XDR incident triage, interpreting threat analytics, and managing deception rules. Candidates must know how to investigate device timelines in Defender for Endpoint, perform live response isolation actions, gather investigation packages, and track malicious tenant activity via Microsoft Purview Audit and Microsoft Graph activity logs.
  • Domain 3: Perform threat hunting (20–25%)
Tests KQL mastery—knowing which tables (SecurityEvent, SigninLogs, DeviceProcessEvents, OfficeActivity) to query and how to use operators like summarize, join, extend, parse, and make-series to detect anomalies. Also covers advanced hunting queries, hunting graphs, lateral movement blast radius evaluation, Sentinel Graph layout, and executing Notebooks with Sentinel MCP Server integration.

What Our Customers Say 545 verified reviews

4.6 ★★★★★★ Based on 545 reviews
★★★★★★
The SC-200 questions were tougher than the actual exam, which honestly made me more confident. Great prep tool.
— Brandon L.
★★★★★
Passed SC-200 with 912/1000. The practice questions cover the exam objectives thoroughly and the explanations are clear.
— Ella M.
★★★★★★
I liked that the SC-200 questions update regularly. Felt current and aligned with what I actually saw on the test.
— Dylan P.
★★★★★★
I bought access for the SC-200 exam as a gift for my brother. He passed on his first try and said the questions were spot-on.
— Cameron J.
★★★★★
My colleague recommended this for SC-200 and I’m glad I listened. Passed on my first go after two weeks of solid study.
— Logan T.
★★★★★
I passed SC-200 on my first try thanks to these practice questions. The unlimited retakes were essential for building confidence.
— Nicole K.

Log in to rate this exam and leave a review.

Submitted for moderation before publishing. Keep it helpful and respectful.

Frequently Asked Questions

The most common reason candidates fail SC-200 is insufficient KQL (Kusto Query Language) syntax skills. You must be able to correctly construct queries using table joins and interpret drop-down hotspot choices involving advanced anomaly operators like make-series. Another frequent mistake is failing to distinguish between when a native Automation Rule can solve a triaging task versus when a full Logic App Playbook must be called—our practice questions include scenario-based items that test exactly this judgment call.

Do not treat SC-200 as an "open-book" exam. With 40–60 questions and text-heavy case studies packed into 120 minutes of active exam time, looking up more than 3 or 4 obscure items will cost you dearly. Use the integrated Microsoft Learn window only to verify specific table column names or cmdlet syntax—never to learn a concept from scratch. Our timed online practice mode helps you build the pacing discipline needed to finish comfortably within the 120-minute window.

Start with the official, free Microsoft Learn Practice Assessment on the SC-200 credential landing page—it mirrors real exam phrasing and identifies your weakest domains. For a deeper breakdown of trick questions and subtle distractors, work through the Exam Readiness Zone video modules on Microsoft Learn. Our practice question bank is aligned to the same blueprint and includes detailed answer explanations that call out the exact distractor logic Microsoft uses.

The credential expires exactly one year from the date it is issued. Microsoft opens a 6-month renewal eligibility window before expiration, during which you can pass a short, unproctored online assessment on Microsoft Learn at no cost—it covers only platform feature updates since your last exam. Our PDF download includes a certification timeline checklist so you do not miss the renewal window.

The real SC-200 exam gives you 120 minutes of active time for 40–60 questions, including case studies with un-reviewable blocks that can eat 10–15 minutes each. Our mock exam mode enforces the same 120-minute clock and case-study format, so you learn exactly how fast you need to move through KQL drop-downs versus multi-part drag-and-drop sequencing. Practicing under time pressure is the only way to avoid running out of minutes on exam day.

Yes—the downloadable PDF packages the full question bank in a print-friendly format that you can use on flights, commutes, or anywhere without reliable internet. The PDF includes the same detailed answer explanations as the online version, with references to the specific Microsoft Learn documentation paths so you can follow up on concepts you miss. Many candidates use the PDF for a final review of KQL operator syntax and Sentinel connector configurations the morning of their exam sitting.

After a failed first attempt, you must wait 24 hours before rescheduling. A third or subsequent attempt requires a 14-day waiting period between sittings, and you are capped at five attempts within any rolling 12-month period. Our mock exam mode is designed to simulate the real timing and question distribution, so you can identify domain-level gaps and avoid needing a retake in the first place.