Welcome to the Microsoft Security Operations Analyst(SC-200) Practice Exam. This practice test is designed to help you assess your knowledge and readiness for the SC-200 certification by covering key concepts, tools, and best practices used in security operations.
%20Practice%20Exam.png)
Each question challenges your understanding of Microsoft
security technologies and scenarios you may encounter on the job. Use this exam
to identify your strengths and areas for improvement as you prepare for the
official certification.
Here’s an overview of Domains relevant to the
Microsoft Security Operations Analyst (SC-200) certification, focusing on core
areas you’ll want to master:
DOMAINS COVERED IN THE SC-200 CERTIFICATION
1.
Threat Management
o Detect, investigate, and respond to
threats using Microsoft Sentinel, Defender, and Security Copilot.
o Work with alerts, incidents, hunting
queries, and security analytics.
2.
Identity and Access Management
o Implement and monitor conditional
access policies, risk policies, and identity protection.
o Manage user and sign-in risk,
multifactor authentication, and privileged identity management.
3.
Information Protection and Governance
o Use Microsoft Purview to monitor and
protect sensitive data.
o Manage insider risk and compliance
policies, including audit logs and retention.
4.
Security Operations and Monitoring
o Use Microsoft Defender for Endpoint,
Identity, Office 365, and Cloud Apps to detect and respond to attacks.
o Manage and triage alerts, incidents,
and cases in Microsoft Sentinel and Defender portals.
5.
Investigation and Remediation
o Investigate incidents, conduct root
cause analysis, and perform remediation tasks such as device isolation and
threat hunting.
o Understand the automation and
orchestration capabilities in Microsoft Security tools.
MICROSOFT
SECURITY OPERATIONS ANALYST (SC-200) PRACTICE EXAM
Question 1
A security analyst is tasked with automating investigation flows to streamline
repetitive steps in Copilot. After selecting relevant prompts from an existing
session, the analyst wants to create a promptbook. What should the analyst do
next to accomplish this task?
a. Select the 'Create promptbook' icon to open the page where they can name,
tag, and further customize the promptbook.
b. Select the 'Export prompts' button to download the selected prompts for
manual execution.
c. Choose the 'Save session' option to preserve the current state of the
session for later use.
Question 2
There are two risk policies that can be enabled in the directory. One is user
risk policy. Which is the other risk policy?
a. Sign-in risk policy
b. Mobile device access risk policy
c. Hybrid identity sign-in risk policy
Question 3
The security operations analyst discovered an interesting event, what should be
done to mark it for further review?
a. Highlight
b. Tag
c. Flag
Question 4
What does Microsoft Sentinel provide?
a. A solution for securely storing keys and secrets in the cloud
b. A solution for checking your security posture in the cloud
c. An end-to-end solution for security operations
Question 5
What feature of Microsoft Purview Audit (Premium) is essential for managing
sensitive communications securely?
a. Basic audit logs.
b. Standard data retention.
c. MailItemsAccessed.
Question 6
What information is provided by a deep file analysis?
a. Registry Modifications
b. Command history
c. Code change history
Question 7
What is a key component to include in a prompt when seeking a table-format
response from Microsoft Security Copilot?
a. Expectation - specifying the desired format
b. Goal - specifying the security-related information needed
c. Source - identifying the plugins to use
Question 8
What is a recommended next step if an alert involves multiple serious
activities across different services?
a. Delete the alert to reduce dashboard clutter.
b. Dismiss the alert to avoid duplication.
c. Create a case to manage follow-up actions and collaboration.
Question 9
What is the main difference between Audit (Standard) and Audit (Premium)
regarding audit log retention periods?
a. Audit (Standard) supports 10-year retention policies.
b. Audit (Standard) offers a maximum retention period of 180 days.
c. Both versions offer indefinite retention.
Question 10
What is the primary purpose of exporting audit logs to CSV in Microsoft Purview
Audit?
a. To perform detailed data analysis and meet compliance reporting
requirements.
b. To reduce the storage space used on servers.
c. To enhance the visual presentation of data.
Question 11
What is the role of the orchestrator in Microsoft Security Copilot's prompt
processing?
a. To manage user permissions and access within Security Copilot.
b. To compose capabilities together to respond to a user's prompt.
c. To directly execute security scripts without user input.
Question 12
What role do cases play in insider risk investigations?
a. They track licensing for each alert.
b. They store Power Automate logs for compliance tracking.
c. They allow grouping and managing alert investigations for a specific user.
Question 13
What step should be taken first before searching the audit log in Microsoft
Purview?
a. Install the latest updates for Microsoft 365.
b. Export the existing audit logs to a CSV file for backup.
c. Confirm audit log search is enabled.
Question 14
When you're reviewing a specific incident, which tab is contained on the
incident page?
a. Networks
b. Non-Azure Machines
c. Assets
Question 15
Where do you go in Microsoft Purview Insider Risk Management to view all alerts
generated by policies?
a. Cases dashboard
b. Alerts dashboard
c. Activity explorer
Question 16
Which anomaly detection policy triggers an alert if the same user credentials
originate from two geographically distant locations within a short time?
a. Impossible travel
b. Impossible distance
c. Impossible twins
Question 17
Which Behavioral blocking can be used with third-party antivirus?
a. Feedback-loop blocking
b. EDR in block mode
c. Client behavior blocking.
Question 18
Which component of Microsoft Security Copilot is responsible for composing
capabilities together to answer a user's prompt effectively?
a. Orchestrator
b. Prompt bar
c. Plugin
Question 19
Which file type can be used to upload Indicators?
a. CSV
b. XML
c. JSON
Question 20
Which filter is included as part of an Alert notification rule?
a. Alert Severity
b. Subject IDs
c. Account
Question 21
Which information is provided on the user account page?
a. Security groups
b. Associated alerts
c. Threat hunt ID
Question 22
Which is a valid remediation level?
a. Semi - user accounts only
b. Semi - require approval for any remediation
c. Semi - files only
Question 23
Which language is used to query data within Microsoft Sentinel?
a. SQL
b. KQL
c. GraphQL
Question 24
Which Microsoft Defender XDR solution can detect a malware installation?
a. Microsoft Defender for Endpoint
b. Microsoft Defender for Identity
c. Microsoft Defender for Office 365
Question 25
Which Microsoft Defender XDR solution can detect an Active Directory Domain
compromise?
a. Microsoft Defender for Identity
b. Microsoft Defender for Endpoint
c. Microsoft Defender for Office 365
Question 26
Which Microsoft Defender XDR solution can detect a phishing email?
a. Microsoft Defender for Identity
b. Microsoft Defender for Endpoint
c. Microsoft Defender for Office 365
Question 27
Which of the actions below is a Device action?
a. Isolate device
b. Reboot
c. Reformat device
Question 28
Which of the following artifact types has an investigation page?
a. Hunter
b. Threat Actor
c. Domain
Question 29
Which of the following items is a deployment option?
a. Microsoft Deployment System
b. ASRConfig.exe
c. PowerShell
Question 30
Which of the following options is a valid Microsoft Defender XDR for Endpoint
onboarding option for Windows 10 devices?
a. Microsoft Store
b. General install package
c. Group policy
Question 31
Which of these is a feature of Conditional Access App Control policies?
a. Protect on download
b. Remote access
c. Require multi-factor authentication
Question 32
Which option below is an attack surface reduction rule that can be configured?
a. Block content from mobile devices
b. Block PowerShell from executing
c. Block process creations originating from PSExec and WMI commands
Question 33
Which report lists the software vulnerabilities your devices are exposed to by
listing the Common Vulnerabilities and Exposures (CVE) ID?
a. Weakness
b. Event Timeline
c. Software Inventory
Question 34
Which report or dashboard provides a list of the most recently published threat
reports?
a. Threat protection
b. Vulnerable devices report
c. Threat Analytics
Question 35
Which role is required to use Advanced hunting for insider risk events?
a. Insider Risk Management Analyst or Investigator
b. Security Operator
c. Microsoft 365 Compliance Administrator
Question 36
Which security permission allows the configuration of storage settings?
a. Advanced commands
b. Manage security settings in Security Center
c. Manage portal system settings
Question 37
Which solution is used to control the applications that must earn trust to be
run?
a. Exploit protection
b. Controlled folder access
c. Application control
Question 38
Which task can a user with the Security Operator role perform?
a. Confirm safe sign-in
b. Reset a password for a user
c. Configure alerts
Question 39
Which type is an accepted indicator type?
a. Email subject line
b. Code data
c. Certificates
Question 40
Which type of information is collected in an Investigation package?
a. Prefetch Files
b. Command History
c. Network transactions
Question 41
You can classify an Incident as which of the following?
a. True positive
b. Test alert
c. High alert
Question 42
A security analyst is using Microsoft Security Copilot and wants to generate
insights from their security data. They want to use natural language to do
this. Where should they input their request?
a. In the 'Prompts to try' section
b. In the 'Workspaces' section
c. In the 'Prompt bar'
Question 43
A security analyst needs to review past sessions created in Microsoft Security
Copilot. After accessing the standalone experience, which option should they
select to manage and review these sessions?
a. Select settings.
b. Select the My sessions option from the home menu.
c. Select the Help icon.
Question 44
A security operations analyst needs to exclude a custom executable file
c:\myapp\myapp.exe, which exclusion type should they use?
a. Folder
b. File
c. Extension
Question 45
A team member is trying to use a non-Microsoft plugin with Microsoft Security
Copilot but it appears greyed out and restricted. What could be the possible
reason?
a. The plugin requires an account and license to the specific service.
b. The Copilot owner has restricted plugin access.
c. The plugin isn't supported by Microsoft Security Copilot.
Question 46
A team member needs to set up a new workspace in Copilot for a specific
project. What role must this team member have in order to create a new
workspace?
a. Billing Administrator
b. Security Administrator
c. Security Reader
Question 47
A Windows 10 Device doesn't appear in the device list, what could be the
problem?
a. The Device is missing the latest KBs
b. The Device had no alerts in the past 30 days
c. The Device was renamed
Question 48
How are audit log retention policies prioritized in Microsoft Purview Audit
(Premium) when conflicts occur?
a. Based on the date the policy was created.
b. Alphabetically by policy name.
c. By a priority level set by the administrator
Question 49
How can you get an at-a-glance overview of the kinds of apps are being used
within your organization?
a. Use Azure Information Protection
b. Use the Cloud Discovery Dashboard
c. Use Conditional Access
Question 50
How does Microsoft Security Copilot enhance threat detection through
integration with existing tools?
a. By using plugins to connect with Microsoft's security products and
open-source intelligence feeds.
b. By replacing all existing security tools with its own standalone solutions.
c. By limiting data sources to only Microsoft Defender XDR and Sentinel.
Question 51
How does the scatter plot in the User activity tab help investigators?
a. It maps user behavior to Microsoft Entra ID roles.
b. It provides direct access to Copilot summaries for each activity.
c. It visualizes risk-scored events over time to identify sequences and
patterns.
Question 52
How should a security analyst craft a prompt for analyzing suspicious scripts
using Microsoft Security Copilot?
a. Ask for all possible threats in the system.
b. Include the script details and request a summary with potential threat
indicators.
c. Request a generic security overview.
Question 53
If a prompt fails to generate a useful response in Microsoft Security Copilot,
what is the best next step?
a. Refine the prompt by adding more specific details and context.
b. Try using the same prompt multiple times.
c. Switch to a different security tool.
Question 54
In advanced features, which setting should be turned on to block files even if
a third-party antivirus is used?
a. Automated Investigation
b. Allow or block file
c. Enable EDR in block mode
Question 55
In Microsoft Graph, which three APIs expose information about risky users and
sign-ins?
a. riskDetection, riskyUsers, signIns
b. riskDetection, itemActivity, signIns
c. riskyUsers, signIns, IdentitySet
Question 56
In the Vulnerable Devices Report, which graphs show each device counted only
once based on the highest level of known exploit?
a. Severity level graphs
b.
Exploit availability graphs
c. Vulnerability age graphs
Question 57
Microsoft Security Copilot has generated an incident report for a recent
security breach. How can you verify that the insights in the report are
generated from trusted sources?
a. Count the number of plugins involved
b. Review the format of the report
c. Check the process log for the capabilities used
Question 58
The default data retention period in Microsoft Defender XDR for Endpoint is?
a. One month
b. Six months
c. Three months
Question 59
The Defender for Cloud Apps framework includes which of the following?
a. Protect Active Directory
b. Discover and control the use of Shadow IT
c. Block external traffic
Question 60
The Devices page shows information from which Defender product?
a. Microsoft Defender for Identity
b. Microsoft Defender for Endpoint
c. Microsoft Cloud App Security
CORRECT ANSWERS & EXPLANATIONS
Question 1
Answer: a. Select the 'Create promptbook' icon to open the page where they can
name, tag, and further customize the promptbook.
Explanation: Promptbooks are created by selecting prompts and then using
the 'Create promptbook' feature for customization and saving.
Question 2
Answer: a. Sign-in risk policy
Explanation: Azure AD risk policies include user risk policy and sign-in
risk policy to evaluate risks on users and sign-ins respectively.
Question 3
Answer: b. Tag
Explanation: Tagging allows marking an event for further review and
easier searching later.
Question 4
Answer: c. An end-to-end solution for security operations
Explanation: Microsoft Sentinel is a cloud-native SIEM and SOAR solution
providing comprehensive security operations capabilities.
Question 5
Answer: c. MailItemsAccessed
Explanation: MailItemsAccessed logs track sensitive communications
access, important for compliance and investigations.
Question 6
Answer: b. Command history
Explanation: Deep file analysis includes command history to understand
how a file has been executed or manipulated.
Question 7
Answer: a. Expectation - specifying the desired format
Explanation: Including clear expectations in prompts helps Security
Copilot format the output as requested, e.g., tables.
Question 8
Answer: c. Create a case to manage follow-up actions and collaboration.
Explanation: Cases consolidate alerts and allow analysts to investigate,
track, and collaborate.
Question 9
Answer: b. Audit (Standard) offers a maximum retention period of 180 days.
Explanation: Audit (Standard) has limited retention; Audit (Premium)
allows longer and customizable retention.
Question 10
Answer: a. To perform detailed data analysis and meet compliance reporting
requirements.
Explanation: Exporting audit logs to CSV helps with offline analysis and
compliance audits.
Question 11
Answer: b. To compose capabilities together to respond to a user's prompt.
Explanation: The orchestrator coordinates different plugins and
capabilities to deliver a coherent response.
Question 12
Answer: c. They allow grouping and managing alert investigations for a specific
user.
Explanation: Cases are containers for alerts and activities related to
specific investigations or users.
Question 13
Answer: c. Confirm audit log search is enabled.
Explanation: Audit log search must be enabled to start querying logs in
Purview.
Question 14
Answer: c. Assets
Explanation: The incident page typically contains asset-related
information relevant to the incident.
Question 15
Answer: b. Alerts dashboard
Explanation: The alerts dashboard shows all generated alerts by insider
risk policies.
Question 16
Answer: a. Impossible travel
Explanation: Impossible travel detects sign-ins from geographically
distant locations in a short time, suggesting possible compromise.
Question 17
Answer: b. EDR in block mode
Explanation: EDR (Endpoint Detection and Response) in block mode can
block threats even if a third-party antivirus is installed.
Question 18
Answer: a. Orchestrator
Explanation: The orchestrator composes multiple capabilities and plugins
to answer prompts in Security Copilot.
Question 19
Answer: a. CSV
Explanation: Indicators can be imported via CSV files for easier bulk
uploading.
Question 20
Answer: a. Alert Severity
Explanation: Alert notification rules can be filtered by severity to
control what triggers notifications.
Question 21
Answer: b. Associated alerts
Explanation: User account pages display alerts related to that user for
investigation.
Question 22
Answer: b. Semi - require approval for any remediation
Explanation: Semi remediation level requires approval before taking
action.
Question 23
Answer: b. KQL
Explanation: Kusto Query Language (KQL) is used in Microsoft Sentinel
for querying logs and telemetry.
Question 24
Answer: a. Microsoft Defender for Endpoint
Explanation: Defender for Endpoint detects malware installation on
devices.
Question 25
Answer: a. Microsoft Defender for Identity
Explanation: Defender for Identity detects domain compromises and
attacks targeting Active Directory.
Question 26
Answer: c. Microsoft Defender for Office 365
Explanation: Defender for Office 365 focuses on email threats like
phishing.
Question 27
Answer: a. Isolate device
Explanation: Isolate device is a device action that limits network
communication for containment.
Question 28
Answer: c. Domain
Explanation: Domains have dedicated investigation pages in Defender XDR.
Question 29
Answer: b. ASRConfig.exe
Explanation: ASRConfig.exe is a tool used for deployment/configuration
of Attack Surface Reduction rules.
Question 30
Answer: c. Group policy
Explanation: Group Policy is a common onboarding method for Defender on
Windows 10 devices.
Question 31
Answer: a. Protect on download
Explanation: Conditional Access App Control can enforce protection
policies on file downloads.
Question 32
Answer: c. Block process creations originating from PSExec and WMI commands
Explanation: This is a configurable attack surface reduction rule
targeting lateral movement techniques.
Question 33
Answer: a. Weakness
Explanation: The Weakness report shows vulnerabilities with CVE IDs
affecting devices.
Question 34
Answer: c. Threat Analytics
Explanation: Threat Analytics dashboard provides recent threat reports
and intelligence.
Question 35
Answer: a. Insider Risk Management Analyst or Investigator
Explanation: These roles have permission to use advanced hunting for
insider risk.
Question 36
Answer: c. Manage portal system settings
Explanation: This permission allows configuration of storage and other
portal-wide settings.
Question 37
Answer: c. Application control
Explanation: Application Control enforces trust policies for allowed
applications.
Question 38
Answer: a. Confirm safe sign-in
Explanation: Security Operators can confirm safe sign-in events but
cannot reset passwords or configure alerts.
Question 39
Answer: c. Certificates
Explanation: Certificates are a valid indicator type for threat
intelligence.
Question 40
Answer: c. Network transactions
Explanation: Investigation packages include network transaction data for
deeper analysis.
Question 41
Answer: a. True positive
Explanation: Incidents can be classified as true positives based on
investigation findings.
Question 42
Answer: c. In the 'Prompt bar'
Explanation: Natural language requests are input in the prompt bar in
Security Copilot.
Question 43
Answer: b. Select the My sessions option from the home menu.
Explanation: Past sessions are managed and reviewed under "My
sessions."
Question 44
Answer: b. File
Explanation: To exclude a specific executable, the file exclusion type
is used.
Question 45
Answer: a. The plugin requires an account and license to the specific service.
Explanation: Non-Microsoft plugins may require licenses or accounts,
restricting access.
Question 46
Answer: b. Security Administrator
Explanation: Security Administrators have permissions to create
workspaces in Security Copilot.
Question 47
Answer: a. The Device is missing the latest KBs
Explanation: Devices without latest updates or onboarding packages may
not appear in the list.
Question 48
Answer: c. By a priority level set by the administrator
Explanation: Audit log retention policies are prioritized by
admin-assigned priority levels.
Question 49
Answer: b. Use the Cloud Discovery Dashboard
Explanation: Cloud Discovery shows apps used in an organization at a
glance.
Question 50
Answer: a. By using plugins to connect with Microsoft's security products and
open-source intelligence feeds.
Explanation: Security Copilot integrates via plugins for broad threat
detection.
Question 51
Answer: c. It visualizes risk-scored events over time to identify sequences and
patterns.
Explanation: Scatter plots help identify behavioral patterns and
suspicious sequences.
Question 52
Answer: b. Include the script details and request a summary with potential
threat indicators.
Explanation: Providing script details helps Copilot analyze and detect
threats accurately.
Question 53
Answer: a. Refine the prompt by adding more specific details and context.
Explanation: Better context improves AI-generated responses.
Question 54
Answer: c. Enable EDR in block mode
Explanation: This setting enforces blocking even when third-party
antivirus is present.
Question 55
Answer: a. riskDetection, riskyUsers, signIns
Explanation: These Microsoft Graph APIs expose information about user
and sign-in risks.
Question 56
Answer: a. Severity level graphs
Explanation: Severity level graphs count devices once based on highest
known exploit severity.
Question 57
Answer: c. Check the process log for the capabilities used
Explanation: Process logs verify which trusted capabilities contributed
to the report.
Question 58
Answer: c. Three months
Explanation: Default data retention in Defender XDR for Endpoint is 90
days (3 months).
Question 59
Answer: b. Discover and control the use of Shadow IT
Explanation: Defender for Cloud Apps includes Shadow IT
Thank you for completing the Microsoft Security Operations Analyst (SC-200) Practice Exam. Review your answers carefully and revisit any topics where you feel less confident.
Consistent practice and understanding of real-world applications will strengthen your skills and boost your confidence for the certification exam.
If you need further explanations or additional
practice, feel free to ask. Best of luck on your path to becoming a certified
Microsoft Security Operations Analyst!
