Free SC-200 sample questions with answers
Here are five free SC-200 sample questions, covering the three skill areas, with the answer and the reasoning behind each. Try each one before opening the answer. These are original SOC scenario questions written against the official skills outline, not questions from the real exam.
Question 1. Your SOC wants every new Microsoft Sentinel incident with severity High to be assigned to the on-call analyst group and tagged, without any custom code. Another step must also send a message to a chat channel using a connector. How should you implement this?
- A. A Sentinel workbook with a parameter for severity
- B. A new scheduled analytics rule for high severity alerts
- C. An automation rule that assigns and tags the incident and runs a playbook that posts to the channel
- D. A playbook only, triggered manually by the analyst
Show answer
Answer: C
Automation rules handle simple incident triage such as assigning an owner, changing severity or adding tags, and can also run a playbook. The chat message needs a Logic Apps playbook with the connector. A playbook alone for everything is more work than needed, a workbook only visualises data, and an analytics rule detects threats rather than handling incidents after creation.
Want more questions like this? Full SC-200 practice tests →
Question 2. You must keep firewall logs for 12 months for compliance. They are rarely queried and are not used by analytics rules, and you want to minimise cost. Where should the table's data be kept long term?
- A. Keep everything in the analytics tier with 12-month retention
- B. Use the data lake tier for long-term retention
- C. Delete the data after 30 days and export a screenshot
- D. Store the data in a Sentinel workbook
Show answer
Answer: B
Data that is queried rarely and not needed by real-time detections suits the lower-cost data lake tier, which gives cheap long retention and can be queried with KQL jobs when needed. The analytics tier is meant for data used by detections and interactive hunting and costs more per gigabyte. Deleting after 30 days breaks the compliance requirement. A workbook does not store data.
Want more questions like this? Full SC-200 practice tests →
Question 3. Defender for Endpoint reports ransomware-like activity on a server. You need to inspect running processes and collect a file from the device without physically accessing it, while the device stays isolated. What should you use?
- A. Create a new custom detection rule on the device name
- B. Restrict app execution on the device
- C. Run a scheduled scan from the device inventory
- D. Start a live response session on the device
Show answer
Answer: D
Live response opens a remote shell session to the device through the Defender channel, so you can run commands, inspect processes and collect files, and it keeps working while the device is isolated from the network. A custom detection rule only creates alerts about future activity. Restricting app execution blocks non-Microsoft-signed software but does not give you any access to the device. A scan from the device inventory does not provide an interactive session or file collection.
Want more questions like this? Full SC-200 practice tests →
Question 4. In Defender XDR advanced hunting you want devices on which PowerShell was started with an encoded command in the last 24 hours, showing the device name and command line. Which query is correct?
- A. DeviceProcessEvents | where Timestamp > ago(24h) and FileName =~ ‘powershell.exe’ and ProcessCommandLine has ‘-enc’ | project DeviceName, ProcessCommandLine
- B. EmailEvents | where Timestamp > ago(24h) and Subject has ‘-enc’ | project DeviceName, ProcessCommandLine
- C. DeviceProcessEvents | where Timestamp > ago(24h) | summarize count() by FileName
- D. DeviceNetworkEvents | where Timestamp > ago(24h) and RemoteUrl has ‘powershell’ | project DeviceName
Show answer
Answer: A
DeviceProcessEvents records process creation with the file name and command line. The query filters by time and process name, then matches the encoded-command switch and projects the requested columns. EmailEvents holds mail data, so it cannot show process command lines. Putting summarize count by FileName drops the command line column. DeviceNetworkEvents holds connections, not process command lines.
Want more questions like this? Full SC-200 practice tests →
Question 5. A junior analyst must be able to view incidents, assign them to themselves and change their status, but must not be able to create or edit analytics rules or playbooks. Which Microsoft Sentinel role gives the least privilege that meets this?
- A. Microsoft Sentinel Reader
- B. Microsoft Sentinel Responder
- C. Microsoft Sentinel Contributor
- D. Microsoft Sentinel Automation Contributor
Show answer
Answer: B
Microsoft Sentinel Responder can manage incidents, such as assigning them and changing status, without editing rules. Reader only views data, so the analyst could not change incidents. Contributor adds the ability to create and edit rules and other resources, which is more than required. Automation Contributor is an account role for letting Sentinel run playbooks and is not meant for people.
Want more questions like this? Full SC-200 practice tests →
How did you do?
Questions 1 and 2 catch people who know the products as a user but not as an administrator: the line between automation rules and playbooks, and the cost logic of the retention tiers, are configuration topics that analysts rarely touch. If either slowed you down, read the security operations environment guide.
Question 4 shows why KQL fluency matters. Three wrong options are plausible only if you do not know which table holds which signal. The KQL guide and the threat hunting guide cover that.
What these questions have in common
None asks for a definition. Each describes a SOC situation and several options that sound reasonable, and the answer depends on one detail: no custom code, rarely queried, still isolated, which table, least privilege. Underline the constraint before you read the options.
For a longer check, take the 20-question practice test.