10 SC-200 Questions Most Candidates Get Wrong
Here are 10 multiple-choice questions designed to mirror the difficulty and structure of the Microsoft SC-200 (Security Operations Analyst) exam. The questions cover key domains including threat hunting, incident response, and configuration of Microsoft 365 Defender and Sentinel.
Question 1
You are a security analyst using Microsoft Sentinel. You need to create a custom analytics rule that detects a specific attack pattern based on a complex sequence of events across multiple tables. The rule must only trigger if the sequence occurs within a 10-minute window and must be able to reference data from the previous query step. Which rule type should you use? For a deeper dive, check out 10 SC-900 Questions Most Candidates Get Wrong.
A. Scheduled query rule
B. Microsoft Security incident creation rule
C. Anomaly detection rule
D. Near-real-time (NRT) query rule
Answer: A
Explanation: Scheduled query rules are the only type that supports complex multi-table joins, time-based conditions, and referencing data from previous query steps (via let statements). NRT rules are limited to simple queries on a single table and lack the advanced sequencing capabilities. Anomaly rules are ML-based, and incident creation rules link alerts to incidents.
Question 2
Your organization uses Microsoft 365 Defender. A user reports receiving a phishing email that bypassed the security filters. You need to manually trigger an automated investigation and response (AIR) playbook on that specific email to remediate the threat. What is the most direct method to accomplish this?
A. Create a new custom detection rule in Microsoft 365 Defender.
B. Use the Threat Explorer to locate the email and click "Initiate investigation."
C. Submit the email to Microsoft for analysis using the Submission API.
D. Modify the quarantine policy to block the sender's domain.
Answer: B
Explanation: Threat Explorer allows security analysts to deep-dive into email threats and directly trigger automated investigation actions on a selected message. Creating a detection rule is for future threats, not immediate manual response. Submitting the email is for improving filters, not immediate remediation. Modifying quarantine policies is a broad, preventative step, not a targeted response.
Question 3
A security analyst is configuring a Data Collection Rule (DCR) in Azure Monitor to send Windows Security Events to a Log Analytics workspace. The requirement is to collect only specific event IDs (e.g., 4624, 4625, 4720) to minimize storage costs. What is the most efficient way to achieve this?
A. Configure the workspace's daily cap to limit data ingestion.
B. Use the Windows Event Logs data source in the DCR and specify the exact event IDs.
C. Connect the Windows machine to Microsoft Defender for Cloud and rely on its default collection.
D. Create a custom script that runs on the machine to filter events before sending them.
Answer: B
Explanation: DCRs allow granular filtering at the source. You specify the XPath queries for the Windows Event Log data source (e.g., Security!*[System[(EventID=4624 or EventID=4625)]]) to collect only required events. The daily cap is a cost management tool, not a filtering mechanism. Defender for Cloud has its own, less granular collection plans. Custom scripts are inefficient and error-prone compared to the native DCR capabilities.
Question 4
You are investigating a potential data exfiltration incident using Microsoft Defender for Endpoint (MDE). You need to identify all network connections made by a specific process (powershell.exe) on a specific device over the last 24 hours. Which KQL query should you use in advanced hunting?
A. DeviceProcessEvents | where FileName == "powershell.exe" | where DeviceName == "target-device" | project Timestamp, FileName, ProcessId
B. DeviceNetworkEvents | where DeviceName == "target-device" | where InitiatingProcessFileName == "powershell.exe" | where Timestamp > ago(24h) | project Timestamp, RemoteIP, RemotePort, InitiatingProcessFileName We cover this in depth in 8 CISM Questions Most Candidates Get Wrong.
C. DeviceFileEvents | where DeviceName == "target-device" | where InitiatingProcessFileName == "powershell.exe" | where Timestamp > ago(24h) | project Timestamp, FileName, FolderPath
D. DeviceLogonEvents | where DeviceName == "target-device" | where InitiatingProcessFileName == "powershell.exe" | where Timestamp > ago(24h) | project Timestamp, AccountName, LogonType
Answer: B
Explanation: To find network connections, you must query the DeviceNetworkEvents table. The query correctly filters by the device name and the initiating process (powershell.exe) to show outbound connections. Option A is process events, C is file events, and D is logon events, none of which directly provide network connection data.
Question 5
Your organization has enabled Microsoft Defender for Identity (MDI). You need to configure a sensitive group to monitor for lateral movement path attacks. Which action should you take?
A. Create a new role in Azure AD and assign the group to it.
B. Add the group to the "Sensitive groups" list in the MDI settings.
C. Enable the "Lateral movement path" report in Microsoft Defender for Cloud Apps.
D. Configure a conditional access policy in Azure AD requiring MFA for the group.
Answer: B
Explanation: MDI specifically allows you to tag groups as "sensitive" to prioritize monitoring and alerting on lateral movement paths targeting those high-value accounts. Creating a role or conditional access policy is an Azure AD function, not an MDI configuration. Defender for Cloud Apps does not have this specific lateral movement path report for on-premises AD.
Question 6
You are an analyst using Microsoft Sentinel. You need to create a workbook that visualizes the number of security incidents by severity over the last 30 days. The data source is the SecurityIncident table. Which step is NOT required to build this workbook?
A. Create a new workbook and add a query.
B. Write a KQL query like SecurityIncident | summarize Count = count() by Severity.
C. Set the time range for the query to "Last 30 days".
D. Create an automation rule to run the workbook daily.
Answer: D
Explanation: Workbooks are interactive visualizations that render on-demand; they do not require automation rules to execute. Creating the workbook, adding a query, and setting the time range are all necessary steps to display the data. Automation rules are used for incident management tasks, not for refreshing workbooks.
Question 7
A security operations team wants to automatically disable a user account in Microsoft Entra ID (Azure AD) when Microsoft Sentinel detects a brute-force attack against that account. What is the recommended method to achieve this automated response?
A. Create a playbook using Microsoft Power Automate and link it to an automation rule in Sentinel.
B. Manually create a remediation script and run it on a scheduled basis.
C. Configure a conditional access policy in Azure AD to block the user.
D. Use a logic app from the Sentinel content hub and attach it directly to the analytics rule.
Answer: A Our post on 10 CRISC Questions Most Candidates Get Wrong covers this further.
Explanation: The standard approach is to use an automation rule in Sentinel that triggers a playbook (built in Power Automate or Azure Logic Apps) when an alert is created. The playbook contains the logic to call Microsoft Graph API to disable the user. Conditional access blocks sign-ins but doesn't disable the account. Logic apps from the content hub need to be configured and invoked via automation rules, not attached directly.
Question 8
You are using Microsoft Defender for Cloud Apps. You need to create a policy that detects anomalous behavior, such as impossible travel, for your users. Which policy type should you select?
A. Access policy
B. Session policy
C. Activity policy
D. File policy
Answer: C
Explanation: Activity policies in Defender for Cloud Apps allow you to monitor user activities for anomalies like impossible travel, suspicious IPs, and unusual data downloads. Access and session policies are for real-time control of access and sessions. File policies are for monitoring and controlling file sharing and data exfiltration.
Question 9
An analyst is investigating a malware outbreak. They have identified a malicious file hash. To find all devices that have seen this file, which Microsoft 365 Defender table should they query in advanced hunting?
A. DeviceProcessEvents
B. DeviceFileEvents
C. DeviceImageLoadEvents
D. DeviceEvents
Answer: B
Explanation: DeviceFileEvents contains information about file creation, modification, and other file system events. Querying this table for the specific SHA1 or SHA256 hash will reveal which devices have encountered the file. DeviceProcessEvents shows process creation, and DeviceImageLoadEvents shows when a module is loaded, which are secondary indicators.
Question 10
You are configuring Microsoft Sentinel to ingest data from a third-party security appliance using Common Event Format (CEF). After setting up the connector and forwarding logs to the Log Analytics agent (legacy), where will the collected data be stored?
A. In a custom table named ThirdPartyApp_CL.
B. In the CommonSecurityLog table.
C. In the Syslog table.
D. In a new table created specifically by the connector.
Answer: B
Explanation: CEF data sent to the Log Analytics agent is parsed and normalized into the CommonSecurityLog table. While the source is syslog, the agent specifically transforms CEF messages into this structured table. The Syslog table is used for raw syslog messages. Custom tables (_CL) are for custom APIs, not standard CEF connectors.
This set of questions covers core areas like KQL hunting, incident response, Sentinel configuration, and Defender 365 suite management. Remember to focus on the specific tool designed for each task, as the exam often tests your ability to distinguish between similar services (e.g., Activity vs. Access policies).
To organize the remaining preparation around your available time, a free SC-200 study plan can lay out a week-by-week schedule.
See how your preparation compares to the passing standard on Microsoft Security Operations Analyst (SC-200) sample questions.
Before you sit the exam, the free SC-200 readiness check offers a quick look at which topics need more review.