SC-200 Exam Questions & Answers
Microsoft Security Operations Analyst • Microsoft
100% money-back guarantee
Sample SC-200 Questions
Practice with real exam-style questions, each with the verified correct answer and explanation.
You have an Azure subscription that uses Microsoft Defender XDR.
From the Microsoft Defender portal, you perform an audit search and export the results as a file named Filel.csv that contains 10,000 rows.
You use Microsoft Excel to perform Get & Transform Data operations to parse the AuditData column from Filel.csv. The operations fail to generate columns for specific JSON properties.
You need to ensure that Excel generates columns for the specific JSON properties in the audit search results.
Solution: From Excel, you apply filters to the existing columns in Filel.csv to reduce the number of rows, and then you perform the Get & Transform Data operations to parse the AuditData column.
Does this meet the requirement?
This solution also does not meet the requirement. Applying filters to the already-imported worksheet rows in Excel (or attempting to reduce rows in the workbook UI) does not change how Power Query initially samples and infers the JSON schema during the Get & Transform steps. Power Query's schema detection typically happens on a preview/sample of the source data when the query is first evaluated. If the JSON property you need does not appear in that sampled subset, Power Query will not create a column for it even if you later filter the data to include rows that do contain that property. In short, post-export filtering in Excel is not a reliable way to force Power Query to detect and expand missing JSON properties.
The reliable approaches are to increase the number of rows Power Query uses for schema detection (Query Options / Data Load / preview/sample settings) or to explicitly parse each AuditData cell with JSON.Document (or equivalent M functions) and then expand the record fields---these approaches ensure the specific JSON properties are surfaced as columns. Reducing rows via Excel filters does not address the sampling/schema-detection behavior and therefore fails to satisfy the requirement.
You have the following advanced hunting query in Microsoft 365 Defender.
You need to receive an alert when any process disables System Restore on a device managed by Microsoft Defender during the last 24 hours.
Which two actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
In Microsoft 365 Defender advanced hunting, if you want to automatically receive alerts based on a KQL query---such as detecting when a process disables System Restore---you must convert that query into a custom detection rule. According to Microsoft's official documentation, custom detection rules ''run hunting queries on a schedule and create alerts and incidents when results are found.''
In order for the detection rule to function properly and correlate results across devices and incidents, the query must output DeviceId and ReportId. These fields are mandatory for any advanced hunting query that you want to convert into a detection rule because they uniquely identify the device and event instance. Without them, the rule cannot properly generate correlated alerts.
Therefore:
Create a detection rule (A) -- ensures the query runs automatically and alerts are generated.
Add DeviceId and ReportId (E) -- required for detection rule creation and accurate device/event correlation.
Other options are incorrect:
Suppression rule (B) filters alerts, not generate them.
Order by Timestamp (C) is optional for display, not alerting.
DeviceNetworkEvents (D) is unrelated to this process query.
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You are configuring Azure Sentinel.
You need to create an incident in Azure Sentinel when a sign-in to an Azure virtual machine from a malicious IP address is detected.
Solution: You create a scheduled query rule for a data connector.
Does this meet the goal?
A scheduled query rule in Azure Sentinel is the correct method to detect and generate alerts/incidents based on specific data patterns such as sign-ins from malicious IPs. The scheduled rule can run periodically (e.g., every 5 minutes or hour), execute a KQL query filtering for malicious IPs, and create incidents automatically when matches are found. This satisfies the goal of automatically creating incidents for suspicious sign-ins.
You have a Microsoft 365 subscription.
You have 1,000 Windows devices that have a third-party antivirus product installed and Microsoft Defender Antivirus in passive mode. You need to ensure that the devices are protected from malicious artifacts that were undetected by the third-party antivirus product Solution: You enable automated investigation and response (AIR).
Does this meet the goal?
Automated Investigation and Response (AIR) automates investigation and remediation actions for alerts that Defender already detects: it triages alerts, runs investigation playbooks, and can execute remediation (quarantine files, terminate processes, remove persistence) based on the investigation outcome. AIR is powerful for reducing analyst load and quickly remediating detected threats. However, AIR only runs in response to detections/alerts it receives---if the third-party AV completely misses an artifact and no EDR/behavioral detection generates an alert, AIR will not be triggered. In contrast, EDR in block mode is specifically built to catch post-breach detections that the primary AV missed and to remediate them. Therefore, enabling AIR alone does not guarantee protection from artifacts missed by the third-party antivirus; AIR helps remediate once a detection exists but does not itself create the missed detection coverage that EDR in block mode provides.
You have an Azure subscription that contains an Microsoft Sentinel workspace.
You need to create a playbook that will run automatically in response to an Microsoft Sentinel alert.
What should you create first?
To create a playbook in Microsoft Sentinel, you must first create an Azure Logic App. Playbooks in Sentinel are built on top of Logic Apps---they define automated workflows that can be triggered by alerts or incidents. Once the Logic App exists, you can connect it to Sentinel via an automation rule or directly from an analytic rule.
A (Azure Function trigger): Used for custom code execution, not for Sentinel automation.
C (Hunting query): Used for threat hunting, not automation.
D (Automation rule): Connects an alert to a playbook but can't exist before a playbook (Logic App) is created.
Answe r: B. an Azure Logic App
Get access to all 391 verified questions with detailed answers.
Unlock All SC-200 Questions