Free SC-200 practice test: 20 questions
Twenty questions across the three SC-200 skill areas, weighted roughly as the real exam is: nine on managing the security operations environment, seven on responding to incidents and four on threat hunting. These are original SOC scenario questions. Find the constraint in each scenario before you look at the options.
Manage a security operations environment
Question 1. A Sentinel analytics rule must detect a single high-risk sign-in pattern as fast as possible. The query reads one table and uses no joins. Which rule type should you create?
- A. Scheduled
- B. Machine learning behavioral analytics
- C. Near-real-time (NRT)
- D. A workbook
Show answer
Answer: C
Near-real-time rules run about every minute and are designed for simple queries on one table, giving the fastest detection. A scheduled rule has a longer minimum interval. A machine learning rule detects statistical anomalies, not a defined pattern. A workbook cannot create incidents.
Want more questions like this? Full SC-200 practice tests →
Question 2. You need to automatically set the owner and add a tag on every new incident from one analytics rule, without writing code. What should you use?
- A. A Logic Apps playbook with custom code
- B. An automation rule with the rule as a condition
- C. A second analytics rule
- D. A watchlist
Show answer
Answer: B
An automation rule can assign an owner, set status or severity and add tags with conditions such as the originating rule. A playbook is possible but needs a Logic Apps workflow that this simple task does not require. An analytics rule cannot change incidents after creation. A watchlist stores reference data.
Want more questions like this? Full SC-200 practice tests →
Question 3. A playbook that blocks a user in Entra ID runs from an automation rule but fails with a permissions error. What is the most likely cause?
- A. The analytics rule has no KQL query
- B. The data retention is too short
- C. A workbook parameter is missing
- D. The playbook identity lacks the required permission
Show answer
Answer: D
The playbook’s identity needs permission to take the action in Entra ID, and the Sentinel automation also needs permission to run the playbook. A missing KQL query is irrelevant to the playbook action. Data retention does not affect permissions. A workbook parameter has no role here.
Want more questions like this? Full SC-200 practice tests →
Question 4. You must collect Syslog messages from several Linux servers and CEF logs from a firewall into Sentinel using current agents. Which approach is correct?
- A. Syslog via AMA and Common Event Format via AMA connectors with data collection rules
- B. Windows Security Events via AMA
- C. Windows Event Forwarding
- D. Upload log files manually every day
Show answer
Answer: A
The Syslog via AMA and Common Event Format via AMA connectors use the Azure Monitor Agent with data collection rules, which is the current approach named in the outline. Windows Security Events via AMA is for Windows hosts. Windows Event Forwarding collects Windows events. Uploading files by hand does not provide continuous collection.
Want more questions like this? Full SC-200 practice tests →
Question 5. A custom data source writes records that fit no built-in table, and you need to query them in the workspace. What should you create?
- A. A workbook
- B. A custom log table
- C. A watchlist as the only store
- D. An automation rule
Show answer
Answer: B
A custom log table in the workspace holds ingested data that has no built-in table. A workbook displays data but does not store it. A watchlist is reference data and not a log store. An automation rule cannot define a storage schema.
Want more questions like this? Full SC-200 practice tests →
Question 6. A team wants to detect a behaviour using an advanced hunting query on Defender XDR tables and have it raise alerts and isolate the device automatically. What should they create?
- A. A Sentinel workbook
- B. A threat analytics report
- C. A hunting bookmark
- D. A custom detection rule
Show answer
Answer: D
Custom detection rules in Defender XDR are built from advanced hunting queries, run on a schedule or continuously, raise alerts and can take response actions such as isolating a device. A Sentinel workbook does not detect. A threat analytics report is Microsoft content. A Sentinel hunting bookmark records findings only.
Want more questions like this? Full SC-200 practice tests →
Question 7. A new SOC member needs to triage and close incidents in Sentinel but must not edit analytics rules. Which role is the least privileged that works?
- A. Microsoft Sentinel Responder
- B. Microsoft Sentinel Reader
- C. Microsoft Sentinel Contributor
- D. Microsoft Sentinel Automation Contributor
Show answer
Answer: A
Sentinel Responder lets users manage incidents without changing rules. Reader cannot change incidents. Contributor can edit rules, exceeding the need. Automation Contributor is a service role used so Sentinel can run playbooks, not for analysts.
Want more questions like this? Full SC-200 practice tests →
Question 8. Large volumes of verbose network logs are kept for audit and rarely queried, and detections do not use them. How should you minimise cost while keeping the data?
- A. Keep it in the analytics tier indefinitely
- B. Delete it after seven days
- C. Store it in the data lake tier
- D. Disable the data connector
Show answer
Answer: C
The data lake tier provides low-cost, long-term storage for data that is rarely queried and not needed by detections. Keeping it in the analytics tier costs more. Dropping the data fails the audit requirement. Turning off the connector also loses the data.
Want more questions like this? Full SC-200 practice tests →
Question 9. Defender for Endpoint should block a specific known-bad behaviour from Office applications such as launching child processes. Which feature configures this?
- A. Live response
- B. An attack surface reduction rule
- C. Automated investigation
- D. A Sentinel playbook
Show answer
Answer: B
Attack surface reduction rules block risky behaviours such as Office apps creating child processes. Live response is an investigation tool. Automated investigation examines alerts after the fact. A Sentinel playbook acts after an alert exists rather than blocking the behaviour on the device.
Want more questions like this? Full SC-200 practice tests →
Respond to security incidents
Question 10. Defender XDR shows an incident combining a phishing email, a malicious attachment opening on a laptop and a suspicious sign-in for the same user. What is the best first containment?
- A. Close the incident as benign
- B. Delete only the phishing email
- C. Wait for another alert to confirm
- D. Isolate the laptop, secure the account and remove the email
Show answer
Answer: D
The incident shows a compromised user and device, so contain both: isolate the device and secure the account by revoking sessions and resetting credentials, alongside removing the email. Closing as benign ignores evidence. Deleting only the email leaves the device and account compromised. Waiting for another alert delays response.
Want more questions like this? Full SC-200 practice tests →
Question 11. You need an interactive shell on a compromised endpoint to run commands and collect a file, with no physical access. What do you use?
- A. Live response
- B. A custom detection rule
- C. eDiscovery content search
- D. A workbook
Show answer
Answer: A
Live response gives a remote interactive session to run commands and collect files. An investigation package is a collected snapshot with no interactivity. A custom detection rule creates future alerts. Content search looks at Microsoft 365 content, not endpoints.
Want more questions like this? Full SC-200 practice tests →
Question 12. Which Microsoft Purview capability tells you which users accessed and downloaded a file in SharePoint and when?
- A. eDiscovery content search
- B. Microsoft Graph activity logs
- C. Purview Audit
- D. A Defender for Endpoint device timeline
Show answer
Answer: C
Purview Audit records user activities across Microsoft 365 including file access and downloads. Content search finds items by content. Graph activity logs record Graph API calls. An endpoint timeline covers device events, not SharePoint activity.
Want more questions like this? Full SC-200 practice tests →
Question 13. Entra ID flags a user as high risk after a sign-in from an unusual location, and the user confirms they did not sign in. What should you do?
- A. Dismiss the user risk
- B. Confirm the user as compromised, revoke sessions and reset credentials
- C. Do nothing until the next sign-in
- D. Delete the user account
Show answer
Answer: B
Confirming compromise and revoking sessions and resetting the credentials stops the attacker. Dismissing the risk would mark it safe. Doing nothing leaves the account open. Deleting the user destroys evidence and disrupts the business unnecessarily.
Want more questions like this? Full SC-200 practice tests →
Question 14. Which tool is best to find every mailbox that received a specific malicious message, by its content?
- A. Purview Audit
- B. Microsoft Graph activity logs
- C. A device timeline
- D. Content search in eDiscovery
Show answer
Answer: D
Content search in Purview eDiscovery locates items by content across mailboxes. Audit shows activity rather than item content. Graph activity logs show API calls. A device timeline shows endpoint events.
Want more questions like this? Full SC-200 practice tests →
Question 15. Automatic attack disruption has contained a device during suspected ransomware activity. What is the right next step?
- A. Review the incident, validate the activity and keep containment until remediation is complete
- B. Release the device immediately
- C. Ignore the incident because it was automatic
- D. Delete the incident
Show answer
Answer: A
Review the incident, validate the activity and keep the containment while you investigate and remediate, releasing it only once safe. Releasing immediately risks further spread. Ignoring it skips the investigation. Deleting the incident removes the evidence trail.
Want more questions like this? Full SC-200 practice tests →
Question 16. You see alerts from Defender for Identity (lateral movement) and Defender for Endpoint (credential dumping) on related assets. How should you treat them?
- A. As unrelated alerts, one at a time
- B. Close the lower severity alert
- C. As one multi-stage incident
- D. Wait until the next day
Show answer
Answer: C
They are parts of one attack, so work the correlated incident and look at the whole chain. Handling them separately loses context. Closing the lower severity one drops evidence. Waiting delays containment.
Want more questions like this? Full SC-200 practice tests →
Perform threat hunting
Question 17. You want a report on a newly publicised campaign showing whether your organisation is exposed, with suggested hunting queries. Where do you go?
- A. Device inventory
- B. Threat analytics
- C. Secure score
- D. A custom workbook
Show answer
Answer: B
Threat analytics reports describe active threats, show impact and exposure and include hunting queries. Device inventory lists devices. Secure score measures posture generally. A workbook would have to be built from scratch.
Want more questions like this? Full SC-200 practice tests →
Question 18. Which KQL fragment returns the number of failed sign-ins per user from SigninLogs in the last 24 hours?
- A. SigninLogs | where ResultType != 0 | take 10
- B. SigninLogs | count
- C. SigninLogs | where ResultType == 0 | summarize count() by UserPrincipalName
- D. SigninLogs | where TimeGenerated > ago(24h) and ResultType != 0 | summarize count() by UserPrincipalName
Show answer
Answer: D
It filters on time and failure then groups by user with summarize count(). Option A has no aggregation. Option B only counts all rows, with no grouping. Option C filters successes (ResultType 0), the opposite of failures.
Want more questions like this? Full SC-200 practice tests →
Question 19. You want results from a heavy query over months of data-lake logs written to a table so analysts can use it in the analytics tier. Which feature fits?
- A. A KQL job
- B. A workbook
- C. An NRT analytics rule
- D. A watchlist
Show answer
Answer: A
KQL jobs run queries over data lake data and write results to a table in the analytics tier. A workbook only visualises. An NRT rule evaluates incoming data and not months of history. A watchlist is a manually managed reference list.
Want more questions like this? Full SC-200 practice tests →
Question 20. After a service account is compromised you want to understand what else it could reach so you can scope containment. Which capability helps?
- A. Compliance score
- B. A retention setting
- C. A hunting graph with blast radius
- D. A new custom detection rule
Show answer
Answer: C
A hunting graph with blast radius shows the entities a compromised entity can reach. Compliance score reports on regulatory posture. A retention setting controls storage. A single custom detection only detects future events.
Want more questions like this? Full SC-200 practice tests →
Score yourself
| Score | What it means |
|---|---|
| 18–20 | Strong. Confirm with the official practice assessment and book |
| 15–17 | Close. Revisit the domain where you dropped marks |
| 12–14 | Gaps in more than one area. Use the study plan |
| Under 12 | Spend two more weeks on the domain guides before retesting |
Questions 1 to 9 map to the security operations environment guide, 10 to 16 to the incident response guide, and 17 to 20 to the threat hunting guide. If KQL cost you marks, read the KQL guide.