Microsoft Security Operations Analyst (SC-200) practice questions

Domain coverage 3 domains

• Manage a security operations environment (40–45%)
• Respond to security incidents (35–40%)
• Perform threat hunting (20–25%)

Sample questions 8 of 80 shown

1. Q1 Manage a security operations environment

   Which Microsoft Defender for Endpoint advanced feature stops attackers from changing antivirus settings through apps, scripts, or registry edits?

   1. Tamper protection
   2. Live response
   3. Device discovery
   4. Endpoint detection and response in block mode

   Tamper protection locks core Microsoft Defender Antivirus settings such as real-time protection, cloud-delivered protection, and IOAV scanning so they cannot be disabled by malicious tools, registry changes, or unauthorized PowerShell.
2. Q2 Manage a security operations environment

   Which advanced feature must be enabled before an analyst can open a remote investigation shell on a managed device from the unified Defender portal?

   1. Device discovery
   2. Authenticated telemetry
   3. Live response
   4. Automatic attack disruption

   Live response lets an authorized analyst connect to a device and run commands such as run, getfile, putfile, and remediate from security.microsoft.com. Requires the Live response feature enabled and the role permission.
3. Q3 Manage a security operations environment

   Enabling the Microsoft Intune connection in Microsoft Defender for Endpoint primarily allows you to do what?

   1. Share device risk scores with Intune so Conditional Access can require compliant or low-risk devices
   2. Stream Defender for Endpoint events to a Microsoft Sentinel workspace
   3. Run Defender for Endpoint scans on Linux servers without an agent
   4. Replace Defender Antivirus with a third-party engine

   The Intune connector publishes Defender for Endpoint device risk to Intune. Conditional Access can then evaluate the risk signal and block or restrict access from devices above a chosen risk threshold.
4. Q4 Manage a security operations environment

   An analyst wants to receive an email whenever a new high-severity incident is created in the Microsoft Defender portal. Where is this configured?

   1. In Microsoft Sentinel automation rules only
   2. In Defender XDR settings under email notifications for incidents
   3. In Microsoft Entra ID risky sign-in settings
   4. In the Microsoft Purview alert policy for incidents

   Defender XDR has dedicated email notification settings for incidents, actions, and threat analytics. You scope rules by severity, device group, and recipient.
5. Q5 Manage a security operations environment

   Which automation level in Defender for Endpoint will remediate malicious files automatically without requiring analyst approval?

   1. No automated response
   2. Semi - require approval for any remediation
   3. Semi - require approval for non-temp folders
   4. Full - remediate threats automatically

   Full - remediate threats automatically lets AIR take any remediation action without analyst approval. Semi options pause for approval depending on file location.
6. Q6 Manage a security operations environment

   You want to block Office apps from creating child processes only on the finance device group, while keeping the rest of the org in audit mode. What is the best approach?

   1. Create one tenant-wide ASR rule in Block mode
   2. Use device group scoping with separate ASR policies set to Block for finance and Audit elsewhere
   3. Disable the rule globally and rely on tamper protection
   4. Create a Sentinel analytics rule to alert on Office child processes instead

   Attack surface reduction rules can be assigned through device-group-scoped policies in Defender for Endpoint. This is the recommended way to roll out ASR safely without tenant-wide impact.
7. Q7 Manage a security operations environment

   Which Microsoft Sentinel object should you use to run a Logic Apps workflow as a response to an alert or incident?

   1. Workbook
   2. Hunting query
   3. Playbook
   4. Watchlist

   A Microsoft Sentinel playbook is a Logic Apps workflow with the Microsoft Sentinel connector. Automation rules call playbooks (or perform built-in actions) in response to alerts and incidents.
8. Q8 Manage a security operations environment

   An automation rule should close incidents matching a known false-positive pattern. Which two configuration elements are required?

   1. Trigger When incident is created and an action Change status to Closed with a classification
   2. A scheduled analytics rule and a workbook tile
   3. A Logic App with HTTP trigger and a watchlist of users
   4. A custom log table and an ASIM parser

   Automation rules run on triggers like When incident is created or When incident is updated. To auto-close benign matches set the action to Change status to Closed and provide a classification (e.g., False Positive).

Answer all 80 questions with instant feedback →

Reader reviews 566 ratings

• I studied for SC-200 with this bank and passed comfortably. The questions are well-organized and the UI is clean.

  ★★★★★★ Lauren C.

• The SC-200 exam was brutal, but these practice questions prepared me for the worst. Came out with a solid pass.

  ★★★★★★ Carter H.

• Used the SC-200 test bank for two weeks before my exam date. Felt very prepared going in and the results showed.

  ★★★★★★ Luke M.

• The review mode for SC-200 is awesome. Being able to see all questions and explanations at once really helps with last-minute cramming.

  ★★★★★★ Ezra J.

• Had to renew my SC-200 certification and used this to refresh. Way more efficient than re-reading the official study guide.

  ★★★★★★ Leo D.

• The SC-200 questions were tougher than the actual exam, which honestly made me more confident. Great prep tool.

  ★★★★★★ Brandon L.

Frequently asked questions

Free study resources

Community-verified analysis of 68 questions from real test-taker discussions — 20 deep analyses and 0 FAQs.

More Microsoft exams