SC-200 · Sample questions

SC-200 sample questions with answers and explanations

10 real questions from the CertifyDeck SC-200 bank, spread across the domains of the official Microsoft Certified: Security Operations Analyst Associate skills outline, with the correct answer and a full explanation of why the other options are wrong. They are original questions written from the public syllabus, not exam dumps, and they are the same style you will find in the practice tests and mock exams.

1. Question 1Domain: Perform threat huntingMedium

   An alert shows a workstation enumerating users, groups and domains in Active Directory. The analyst wants the raw record of those lookups. Which table holds queries for Active Directory objects?

   • A.IdentityLogonEvents
   • B.DeviceNetworkEvents
   • C.IdentityDirectoryEvents
   • D.IdentityQueryEvents
   Show answer and explanation

   Correct answer: D. IdentityQueryEvents

   Explanation

   IdentityQueryEvents contains queries for Active Directory objects such as users, groups, devices and domains, which is exactly what enumeration produces. IdentityLogonEvents records authentication, IdentityDirectoryEvents covers identity-related and system events on the domain controller, and DeviceNetworkEvents records network connections made by devices.

   Official references

   • Data tables in the Microsoft Defender XDR advanced hunting schema
2. Question 2Domain: Perform threat huntingMedium

   After a phishing wave, the SOC needs to know which users actually clicked a malicious link, whether it came from an email message, Teams or an Office app. Which table should the query start from?

   • A.EmailPostDeliveryEvents
   • B.UrlClickEvents
   • C.CloudAppEvents
   • D.EmailUrlInfo
   Show answer and explanation

   Correct answer: B. UrlClickEvents

   Explanation

   UrlClickEvents records Safe Links clicks from email messages, Teams and Office 365 apps, so it shows who clicked. EmailUrlInfo only lists the URLs found in emails, EmailPostDeliveryEvents records security actions after delivery, and CloudAppEvents tracks activities in cloud apps rather than link clicks.

   Official references

   • Data tables in the Microsoft Defender XDR advanced hunting schema
3. Question 3Domain: Perform threat huntingMedium

   An analyst runs all hunting queries every Monday and wants to spot the queries whose result volume jumped most over the last day compared with the days before. What should the analyst sort or filter on?

   • A.The Results delta or Results delta percentage columns of the queries table
   • B.The MITRE ATT&CK tactic bar above the table, which counts queries per tactic
   • C.The Techniques column, grouped by the MITRE ATT&CK technique of each query
   • D.The Bookmarks tab, ordered by the creation time of each saved bookmark entry
   Show answer and explanation

   Correct answer: A. The Results delta or Results delta percentage columns of the queries table

   Explanation

   Results delta and Results delta percentage compare the results of the last 24 hours with the previous 24 to 48 hours, which highlights spikes in query volume. The tactic bar and the Techniques column only show how many queries map to each tactic or technique, and the Bookmarks tab lists saved findings rather than query result trends.

   Official references

   • Hunting Capabilities in Microsoft Sentinel
4. Question 4Domain: Respond to security incidentsMedium

   A cloud team wants a Teams message posted automatically each time Defender for Cloud raises a high-severity alert on its production subscriptions. Which capability should they configure inside Defender for Cloud?

   • A.Workflow automation with an alert trigger filtered by severity that runs a logic app
   • B.The Trigger logic app option, run by hand from the details of every new alert
   • C.A suppression rule scoped to the production subscriptions, set to expire after thirty days
   • D.Continuous export of security alerts to a Log Analytics workspace in each subscription
   Show answer and explanation

   Correct answer: A. Workflow automation with an alert trigger filtered by severity that runs a logic app

   Explanation

   Workflow automation can start a consumption logic app when a Defender for Cloud alert is created, and the trigger can be limited to the severities of interest. Trigger logic app also runs a logic app, but only manually per alert, so it fails the requirement to post automatically. Continuous export only streams data to Log Analytics or Event Hubs and sends no Teams message.

   Official references

   • Workflow automation in Microsoft Defender for Cloud
   • Security alerts and incidents - Microsoft Defender for Cloud
5. Question 5Domain: Respond to security incidentsMedium

   Automatic attack disruption suspended a user during a business email compromise incident. After finishing the investigation, an analyst must restore the account. What should the analyst do?

   • A.Select the suspended user in the incident and choose enable user
   • B.Close the AIR investigation, which re-enables the account automatically
   • C.Add the user to the attack disruption exclusions, which reverts the action
   • D.Remove the Attack Disruption tag from the incident so the action expires
   Show answer and explanation

   Correct answer: A. Select the suspended user in the incident and choose enable user

   Explanation

   Automatic actions can be undone by the security team: select the suspended user on the incident, or in the Action center, and choose enable user, after mitigating the risk and finishing the investigation. Exclusions only stop assets from being contained automatically in future, and tags are labels that do not control the action.

   Official references

   • Details and Results of an Automatic Attack Disruption Action
   • Automatic attack disruption in Microsoft Defender
6. Question 6Domain: Respond to security incidentsEasy

   Nadia is working an incident in which a mailbox is suspected of being compromised. From the incident she wants the events involving that mailbox across the relevant advanced hunting tables, limited to this incident's context. What should she use?

   • A.The Similar incidents tab, which lists incidents with comparable alerts, entities and properties
   • B.The go hunt action on the mailbox, which queries the relevant tables for that entity
   • C.The Investigations tab, which lists automated investigations triggered by the alerts
   • D.The Activities tab, which shows manual and automated actions taken on the incident
   Show answer and explanation

   Correct answer: B. The go hunt action on the mailbox, which queries the relevant tables for that entity

   Explanation

   The go hunt action runs an advanced hunting query that checks the relevant schema tables for events involving the selected entity, scoped to the incident that contains it. The Activities tab is tempting, but it logs actions performed on the incident (assignments, tag changes, automation), not the telemetry events of the mailbox.

   Official references

   • Get relevant info about an entity with go hunt
   • Investigate incidents in the Microsoft Defender portal (Legacy)
7. Question 7Domain: Manage a security operations environmentMedium

   A retailer wants to ingest only process creation events (4688) and failed logons (4625) from a group of file servers, and to avoid paying to ingest everything else. How should it configure the Windows Security Events via AMA data collection rule?

   • A.Select Common and exclude the unwanted events with a workbook filter
   • B.Select All events and delete the unwanted rows after ingestion
   • C.Select Minimal and filter the unwanted events out with a KQL query when analysts read the table
   • D.Select Custom and add XPath queries that match only those two event IDs
   Show answer and explanation

   Correct answer: D. Select Custom and add XPath queries that match only those two event IDs

   Explanation

   The Custom option lets you choose exactly which events to collect by entering XPath queries in the DCR, and the agent filters at the source so only matching events are ingested and billed. Filtering with KQL, workbooks or deletions happens after ingestion, so it does not avoid the ingestion cost.

   Official references

   • Connect Microsoft Sentinel to other Microsoft services with a Windows agent-based data connector
   • Windows security event sets that can be sent to Microsoft Sentinel
8. Question 8Domain: Manage a security operations environmentMedium

   Defender XDR suppresses a benign alert on a device through a built-in alert tuning rule. During that time, automated investigation and response finds malicious activity tied to the alert. What is the documented outcome?

   • A.The built-in rule is removed permanently, because malicious evidence invalidates its conditions
   • B.The alert stays hidden, and the finding is only available through advanced hunting tables
   • C.The suppressed alert is reactivated, because built-in rules do not block automated investigation
   • D.The investigation is cancelled, because suppressed alerts are excluded from every automation until the rule is removed
   Show answer and explanation

   Correct answer: C. The suppressed alert is reactivated, because built-in rules do not block automated investigation

   Explanation

   Built-in alert tuning rules suppress alerts without affecting other features such as AIR investigations and email notifications, and if AIR detects malicious or suspicious activity the alert is reactivated. The rule itself is not removed and the investigation is not cancelled.

   Official references

   • Investigate alerts in Microsoft Defender XDR
9. Question 9Domain: Manage a security operations environmentMedium

   An engineer adds a column to a DCR-based custom table in the schema editor. Weeks later the column is still empty, although the source now sends the value. What is the most likely missing step?

   • A.Rename the column so it ends in _CF, the suffix required for custom columns
   • B.Wait for Azure Monitor to propagate the schema change to the rule automatically
   • C.Switch the table to the Basic plan so schema changes can propagate to the source
   • D.Update the data collection rule that sends data so it includes the new column
   Show answer and explanation

   Correct answer: D. Update the data collection rule that sends data so it includes the new column

   Explanation

   The schema defined in the data collection rule determines how data is streamed to the table, and Azure Monitor does not update data collection rules when you change a table schema. You must update the rule yourself. The _CF suffix applies to custom columns in Azure tables, not to columns of a custom table.

   Official references

   • Add or Delete Tables and Columns in Azure Monitor Logs
10. Question 10Domain: Manage a security operations environmentEasy

    A health-sector SOC joins an information sharing community that publishes indicators on a TAXII 2.1 server. Besides credentials when required, which two items does the provider give it to configure the Threat Intelligence - TAXII data connector?

    • A.The Event Hubs namespace and the shared access policy name
    • B.The API root URL and the collection ID
    • C.The Microsoft Entra application ID and its client secret
    • D.The Log Analytics workspace key and the data collection endpoint URI
    Show answer and explanation

    Correct answer: B. The API root URL and the collection ID

    Explanation

    To use the TAXII data connector you need a TAXII 2.0 or 2.1 API root URI and a collection ID, plus a username and password if the server requires them, and you enter them with a friendly name in the connector page. Application ID and secret are what the upload API or TIP integrations use, and workspace keys or Event Hubs details are unrelated to a TAXII client.

    Official references

    • Use STIX/TAXII to import and export threat intelligence in Microsoft Sentinel