SC-200: Microsoft Security Operations Analyst — Questions and Answers

Question 1: A company's security team wants to receive a Teams notification whenever a Critical incident is created in Microsoft Sentinel. What is the MOST efficient way to implement this?

Use a Logic App triggered by a custom webhook
Set up an email alert in Azure Monitor
Write a custom Azure Function
Configure an automation rule that triggers a playbook with a Teams connector (Correct answer)

Correct answer: Configure an automation rule that triggers a playbook with a Teams connector

An automation rule in Sentinel can trigger a Logic App (playbook) when an incident is created, and the playbook can use the Teams connector to post a message.

Question 2: A Golden Ticket attack is detected in the environment. Which two immediate remediation actions are MOST critical?

Remove all service principal names from the domain
Force password reset for all domain users and enable audit logging
Disable Kerberos and switch to NTLM authentication
Reset the KRBTGT account password twice and reboot all domain controllers (Correct answer)

Correct answer: Reset the KRBTGT account password twice and reboot all domain controllers

Resetting the KRBTGT password twice invalidates all existing Kerberos tickets, including forged Golden Tickets, eliminating the attacker's persistence.

Question 3: An analyst suspects credential dumping via lsass.exe on a Windows endpoint. Which Microsoft Defender for Endpoint detection would most directly confirm this activity?

An alert for 'Suspicious process accessed LSASS memory' (Correct answer)
A vulnerability finding for CVE-2021-34527
A network connection alert to a C2 domain
A software inventory entry for Mimikatz

Correct answer: An alert for 'Suspicious process accessed LSASS memory'

MDE detects and alerts on processes that read LSASS memory using techniques consistent with credential dumping tools like Mimikatz.

Question 4: In Microsoft Defender XDR, which table in Advanced Hunting contains information about email attachments that were found to contain malware?

EmailPostDeliveryEvents
EmailUrlInfo
EmailEvents
EmailAttachmentInfo (Correct answer)

Correct answer: EmailAttachmentInfo

The EmailAttachmentInfo table stores details about files attached to emails, including verdicts from threat analysis like malware detection.

Question 5: An analyst wants to correlate vulnerability findings from Defender Vulnerability Management with threat intelligence in Microsoft Sentinel. Which data connector enables this integration?

Microsoft Defender XDR data connector (streaming MDE vulnerability events to Sentinel) (Correct answer)
Office 365 Management Activity connector
Microsoft Entra ID Protection connector
Azure Policy data connector

Correct answer: Microsoft Defender XDR data connector (streaming MDE vulnerability events to Sentinel)

The Microsoft Defender XDR data connector streams Defender for Endpoint events, including DeviceTvmSoftwareVulnerabilities, into Microsoft Sentinel for correlation with other data sources.

Question 6: You need to ensure that identities accessing Azure resources from unmanaged devices must satisfy additional verification steps. Which Microsoft Entra feature enforces this requirement?

Microsoft Entra ID Protection risk remediation
Conditional Access policies with device compliance conditions (Correct answer)
Microsoft Entra Privileged Identity Management (PIM)
Azure AD Password Protection

Correct answer: Conditional Access policies with device compliance conditions

Conditional Access policies evaluate device compliance as a condition and can require MFA or block access when a device is unmanaged or non-compliant.

Question 7: During an incident response, an analyst discovers a malicious scheduled task set to run at user logon. Which Microsoft Defender for Endpoint live response command would remove the scheduled task from the compromised endpoint?

run schtasks /delete /tn <taskname> /f (Correct answer)
isolate-device
remediate-file
collect-investigation-package

Correct answer: run schtasks /delete /tn <taskname> /f

Using the Live Response console, the analyst can run native Windows commands like 'schtasks /delete' to remove the malicious scheduled task directly on the endpoint.

Question 8: A Microsoft Sentinel incident is classified as a False Positive after investigation. What is the recommended action to improve future detection accuracy without deleting the analytics rule?

Add an exception (entity exclusion) or tuning condition to the analytics rule (Correct answer)
Delete the incident and take no further action
Increase the rule's severity to Critical
Disable the data connector that generated the alert

Correct answer: Add an exception (entity exclusion) or tuning condition to the analytics rule

Adding entity exclusions or tuning conditions to the analytics rule reduces false positives for known-good entities while keeping the detection active for true threats.

Question 9: A company deploys Microsoft Defender for Cloud across a multi-cloud environment including AWS and GCP. Which feature provides unified security posture management across all three clouds?

Cloud Security Posture Management (CSPM) (Correct answer)
Microsoft Secure Score for Devices
Defender for DevOps
Defender for Servers

Correct answer: Cloud Security Posture Management (CSPM)

Defender CSPM extends across Azure, AWS, and GCP to provide a unified view of misconfigurations, compliance, and security posture with cross-cloud recommendations.

Question 10: During incident triage in Microsoft Defender XDR, an analyst wants to correlate alerts from Defender for Endpoint, Defender for Office 365, and Defender for Identity into a single view. Which feature provides this unified correlation?

Threat Analytics reports
Incidents page in the Microsoft Defender portal (Correct answer)
Individual product alert queues
Microsoft Entra ID Protection risk events

Correct answer: Incidents page in the Microsoft Defender portal

The Incidents page in the Microsoft Defender portal correlates alerts across all Defender products into unified incidents showing the full attack chain.

Question 11: A security engineer is configuring Microsoft Defender for Identity. Which on-premises component is required to collect and forward Active Directory signals?

Azure Arc agent
Microsoft Monitoring Agent
MDI sensor (Correct answer)
Log Analytics agent

Correct answer: MDI sensor

The Microsoft Defender for Identity sensor is installed on domain controllers to capture AD traffic and forward it to the Defender for Identity cloud service.

Question 12: Your security team wants visibility into shadow IT and unsanctioned cloud app usage by employees. Which Microsoft solution discovers and assesses cloud app usage from network traffic logs?

Microsoft Defender for Cloud Apps (Cloud Discovery) (Correct answer)
Microsoft Sentinel UEBA
Microsoft Entra ID Conditional Access
Azure Monitor Network Watcher

Correct answer: Microsoft Defender for Cloud Apps (Cloud Discovery)

Defender for Cloud Apps Cloud Discovery analyzes network traffic logs to identify unsanctioned cloud applications and assess their risk score.

Question 13: During a ransomware incident, a security analyst needs to isolate a compromised Windows device from the network while preserving the ability to manage it remotely via Microsoft Defender for Endpoint. Which action should be taken?

Delete the device from Azure AD
Contain the device using the Isolate Device action in the MDE portal (Correct answer)
Disable the device's NIC via Group Policy
Power off the device immediately

Correct answer: Contain the device using the Isolate Device action in the MDE portal

The Isolate Device action in Microsoft Defender for Endpoint blocks all network traffic except the MDE management channel, enabling continued remote investigation.

Question 14: A vulnerability scan of an AKS cluster reveals that a pod is running as root. Which Microsoft Defender for Containers check would flag this as a misconfiguration?

CIS Docker Benchmark: Ensure Docker content trust is enforced
CIS Kubernetes Benchmark: Containers should not run with allowPrivilegeEscalation
CIS Kubernetes Benchmark: Containers should not run as root user (Correct answer)
NIST SP 800-190: Container image vulnerabilities should be remediated

Correct answer: CIS Kubernetes Benchmark: Containers should not run as root user

Defender for Containers maps to CIS Kubernetes Benchmark controls, and running containers as root violates the control 'Containers should not run as root user (UID 0).'

Question 15: The MITRE ATT&CK framework's 'Defense Evasion' tactic is most relevant to which compliance control objective?

Ensuring encryption of data at rest
Detecting and preventing attackers from disabling security monitoring (Correct answer)
Managing user access privileges
Maintaining audit log retention

Correct answer: Detecting and preventing attackers from disabling security monitoring

Defense Evasion techniques, such as disabling security tools or clearing logs, directly threaten security monitoring capabilities, making detection of these techniques critical for compliance.

Question 16: A red team operator uses the PrintNightmare exploit (CVE-2021-34527) against a Windows print server. Which Microsoft Defender for Endpoint alert category best describes this activity?

Persistence
Credential access
Privilege escalation (Correct answer)
Execution

Correct answer: Privilege escalation

PrintNightmare exploits the Windows Print Spooler service to load a malicious DLL with SYSTEM privileges, making it a privilege escalation technique (MITRE T1068).

Question 17: Microsoft Defender for Identity raises a 'Suspected Golden Ticket usage' alert. What does this indicate about the attacker's access level?

The attacker captured an NTLM hash from the network
The attacker used a phished OAuth token to access cloud resources
The attacker forged a Kerberos TGT using the KRBTGT account hash (Correct answer)
The attacker exploited a weak service principal secret

Correct answer: The attacker forged a Kerberos TGT using the KRBTGT account hash

A Golden Ticket attack involves forging a TGT using the KRBTGT hash, giving the attacker persistent, domain-wide Kerberos authentication capabilities.

Question 18: A threat actor used OAuth application consent phishing to gain persistent access to a Microsoft 365 tenant. Which remediation step revokes the attacker's delegated permissions?

Enable Microsoft Defender for Cloud Apps
Disable legacy authentication protocols
Reset the global administrator password
Remove the malicious OAuth app's enterprise application and revoke its granted permissions in Microsoft Entra ID (Correct answer)

Correct answer: Remove the malicious OAuth app's enterprise application and revoke its granted permissions in Microsoft Entra ID

Removing the enterprise application and revoking granted OAuth permissions in Entra ID eliminates the attacker's delegated access obtained through consent phishing.

Question 19: During post-incident analysis of a Business Email Compromise (BEC) attack, an analyst reviews the Microsoft 365 Unified Audit Log. Which activity type indicates the attacker created a mail forwarding rule to exfiltrate email?

MailItemsAccessed
FileDownloaded
New-InboxRule (Correct answer)
UserLoggedIn

Correct answer: New-InboxRule

The New-InboxRule audit event records creation of inbox rules, which attackers commonly use to forward or delete emails to cover tracks.

Question 20: What is the first step in an incident response process?

Recover affected systems
Identify the incident (Correct answer)
Eradicate the threat
Contain the incident

Correct answer: Identify the incident

The first crucial step in any incident response process is identification, which involves detecting and confirming that a security incident has occurred. This includes monitoring systems for anomalies, analyzing alerts, and determining the scope and nature of the potential breach. Without proper identification, no further effective response actions can be taken.

Question 21: Which Microsoft service provides a unified compliance score that aggregates assessments across Microsoft 365 services against multiple regulatory frameworks?

Microsoft Defender for Cloud Secure Score
Microsoft Purview Compliance Manager (Correct answer)
Microsoft Sentinel compliance workbook
Azure Security Benchmark

Correct answer: Microsoft Purview Compliance Manager

Microsoft Purview Compliance Manager provides a compliance score and tracks improvement actions across frameworks like GDPR, HIPAA, and ISO 27001 for M365 services.

Question 22: A compromised account sent thousands of spam emails before being detected. Which Microsoft 365 action should the analyst take to prevent further sending while investigation continues?

Block the user from signing in and remove the account from the Restricted Senders list after remediation (Correct answer)
Set the user's mailbox to shared
Remove the user from all distribution groups
Disable the user's mailbox archive

Correct answer: Block the user from signing in and remove the account from the Restricted Senders list after remediation

Blocking sign-in stops active sessions, and removing the account from the Restricted Senders list (after cleanup) restores normal mail flow once remediation is confirmed.

Question 23: An organization's compliance policy requires that all Azure storage accounts have secure transfer (HTTPS) enabled. Which approach automatically remediates non-compliant accounts?

Microsoft Sentinel playbook triggered on alert
Azure Policy with DeployIfNotExists effect (Correct answer)
Defender for Cloud manual remediation
Azure Blueprints artifact

Correct answer: Azure Policy with DeployIfNotExists effect

Azure Policy with the DeployIfNotExists effect can automatically deploy configurations to remediate non-compliant resources, such as enabling HTTPS on storage accounts.

Question 24: What is the role of documentation in Threat Intelligence & Analysis for Microsoft Security Operations Analyst?

It is unnecessary paperwork
It provides an accurate record for accountability and reference (Correct answer)
It should only be done monthly
It is only for management review

Correct answer: It provides an accurate record for accountability and reference

Proper documentation in Threat Intelligence & Analysis ensures accountability, traceability, and serves as a reference for future decisions.

Question 25: An organization must ensure no user can disable audit logging in Azure. Which governance control enforces this?

Azure Blueprints
Microsoft Defender for Cloud recommendation
Conditional Access policy
Azure Policy with Deny effect (Correct answer)

Correct answer: Azure Policy with Deny effect

An Azure Policy with a Deny effect can block actions that would disable diagnostic settings or audit logging, enforcing continuous compliance.

Question 26: A security operations team needs to ensure that Azure resource configurations remain compliant with organizational policy continuously. Which Azure service provides this capability?

Azure Policy with continuous compliance evaluation (Correct answer)
Azure Blueprints one-time deployment
Azure Monitor alerts
Microsoft Defender for Cloud weekly scans

Correct answer: Azure Policy with continuous compliance evaluation

Azure Policy continuously evaluates resources against defined policy rules and reports compliance status, automatically flagging non-compliant resources as they are created or modified.

Question 27: An analyst wants Microsoft Sentinel to automatically assign a severity of High to any incident involving a watchlist match. Which feature enables this?

Playbook
Analytics Rule
Fusion Rule
Automation Rule (Correct answer)

Correct answer: Automation Rule

Automation rules in Microsoft Sentinel can modify incident properties such as severity, owner, and status based on trigger conditions.

Question 28: What does the 'beaconing' behavior pattern indicate when observed in network flow data?

Normal software update checks
BGP keepalive messages
Malware communicating with a C2 server at regular intervals (Correct answer)
Load balancer health checks

Correct answer: Malware communicating with a C2 server at regular intervals

Beaconing is the regular, timed outbound communication that malware uses to check in with its command-and-control infrastructure.

Question 29: A security team wants to measure the average time to close incidents in Microsoft Sentinel over the past 30 days. Which KQL function calculates the duration between two datetime fields?

totimespan()
datediff()
datetime_add()
datetime_diff() (Correct answer)

Correct answer: datetime_diff()

datetime_diff() computes the difference between two datetime values in a specified unit such as hours or minutes.

Question 30: A SOC team must ensure log retention meets both HIPAA and SOX requirements. When these requirements conflict, what approach should the team take?

Apply the longer retention period to satisfy both frameworks (Correct answer)
Apply the shorter period to reduce storage costs
Apply the HIPAA retention period as it is healthcare-focused
Apply the SOX retention period as it is financially focused

Correct answer: Apply the longer retention period to satisfy both frameworks

When multiple compliance frameworks apply, organizations should retain logs for the longest required period to satisfy all applicable regulations simultaneously.

Question 31: A playbook needs to add a tag to a Microsoft Sentinel incident when a specific entity IP is found in a threat intelligence watchlist. Which Logic Apps trigger should initiate this playbook?

Microsoft Sentinel — When Microsoft Sentinel incident creation rule was triggered (Correct answer)
Recurrence trigger every 15 minutes
Microsoft Sentinel — When a new alert is created
Microsoft Sentinel — When a response to a Microsoft Sentinel alert is triggered

Correct answer: Microsoft Sentinel — When Microsoft Sentinel incident creation rule was triggered

The 'When Microsoft Sentinel incident creation rule was triggered' trigger fires when an automation rule invokes the playbook at incident creation.

Question 32: Which algorithm is used by Azure Information Protection (Microsoft Purview Information Protection) to encrypt document content?

3DES
ChaCha20-Poly1305
AES-128 or AES-256 (Correct answer)
RSA-4096

Correct answer: AES-128 or AES-256

Azure Information Protection uses AES (128-bit or 256-bit) for document content encryption, with RSA used to protect the AES key.

Question 33: In Microsoft Defender Threat Intelligence, what does the 'PDNS' (Passive DNS) data reveal about a domain?

The domain's SSL certificate chain
Active DNS queries from your network to the domain
Historical IP address resolutions for the domain over time (Correct answer)
The domain's current MX record configuration

Correct answer: Historical IP address resolutions for the domain over time

Passive DNS (PDNS) data shows the historical record of IP addresses that a domain has resolved to over time, which is valuable for tracking infrastructure changes by threat actors.

Question 34: An analyst needs to run a live response session on a compromised Linux endpoint enrolled in Microsoft Defender for Endpoint to collect a memory dump. Which MDE feature enables this?

Device health report
Vulnerability assessment scan
Live Response console in the MDE portal (Correct answer)
Advanced Hunting with DeviceProcessEvents

Correct answer: Live Response console in the MDE portal

The Live Response console in MDE allows analysts to remotely run scripts, collect files, and execute forensic commands on enrolled endpoints including Linux.

Question 35: What is the importance of staying current with trends in Network Security Fundamentals for Microsoft Security Operations Analyst?

It is only required for new professionals
It is not necessary once certified
Trends do not affect professional practice
It ensures practices remain effective and relevant (Correct answer)

Correct answer: It ensures practices remain effective and relevant

Staying current with industry trends ensures that professional practices remain effective, relevant, and aligned with evolving standards.

Question 36: During a threat hunt in Microsoft Sentinel, an analyst wants to find connections between a suspicious domain and known threat actor infrastructure in MDTI. Which MDTI capability should they use?

Intel Profiles to search for the domain name
Trackers to identify JavaScript library fingerprints
Article search to find published reports mentioning the domain
Host pair analysis to see the domain's co-hosted infrastructure (Correct answer)

Correct answer: Host pair analysis to see the domain's co-hosted infrastructure

MDTI's host pair analysis shows domains that share infrastructure, helping analysts identify related malicious domains and map threat actor infrastructure networks.

Question 37: Which of the following is a key strategy in incident remediation?

Deleting all logs permanently
Reinstalling all company software
Applying security patches and updates (Correct answer)
Ignoring the affected systems

Correct answer: Applying security patches and updates

Incident remediation focuses on eliminating the root cause of the incident and restoring affected systems to a secure state. A key strategy involves applying security patches and updates to fix vulnerabilities that were exploited, ensuring that systems are hardened against future attacks and preventing re-infection. This step is crucial for long-term security and system integrity.

Question 38: What is the role of machine learning in security analytics?

Identify patterns and detect anomalies (Correct answer)
Automatically fix all security vulnerabilities
Replace the need for human analysts
Ignore false positive alerts

Correct answer: Identify patterns and detect anomalies

Machine learning in security analytics is primarily used to process vast amounts of data to identify unusual patterns and detect anomalies. By learning from historical data, ML algorithms can flag deviations from normal behavior, which often indicate potential security threats or breaches that might otherwise go unnoticed by traditional rule-based systems.

Question 39: A phishing campaign delivered a malicious macro-enabled document to multiple users. An analyst needs to remove the malicious file from all affected mailboxes in Microsoft 365. Which tool should be used?

Microsoft Defender portal Content Search and Purge (Correct answer)
Microsoft Entra ID Conditional Access
Exchange Admin Center Message Trace
Microsoft Sentinel Watchlist

Correct answer: Microsoft Defender portal Content Search and Purge

The Content Search and Purge capability in the Microsoft Defender portal (or Compliance center) allows soft- or hard-deleting messages from multiple mailboxes at once.

Question 40: What is a fundamental principle of Threat Intelligence & Analysis in Microsoft Security Operations Analyst practice?

Ignoring industry guidelines
Working in isolation without guidance
Using outdated methods
Following established standards and best practices (Correct answer)

Correct answer: Following established standards and best practices

Following established standards and best practices ensures quality and consistency in Threat Intelligence & Analysis.

Question 41: A SOC team wants to automatically enrich incidents in Microsoft Sentinel with threat intelligence data from MDTI. Which feature should they configure?

Workbook with threat intelligence template
Microsoft Sentinel Fusion analytics rule
Azure Logic Apps with MDTI connector (Correct answer)
TAXII server data connector

Correct answer: Azure Logic Apps with MDTI connector

Azure Logic Apps with the MDTI connector can be used to automate enrichment of Sentinel incidents with threat intelligence context from MDTI.

Question 42: What is the role of a code of conduct in Microsoft Security Operations Analyst practice?

It replaces all laws and regulations
It establishes expected behavioral and professional standards (Correct answer)
It only applies to new employees
It is optional and rarely enforced

Correct answer: It establishes expected behavioral and professional standards

A code of conduct sets clear expectations for professional behavior, guiding practitioners in their daily activities and decisions.

Question 43: An organization must comply with CMMC (Cybersecurity Maturity Model Certification) Level 2. Which framework does CMMC Level 2 primarily align with?

NIST SP 800-171 (Correct answer)
HIPAA Security Rule
ISO 27001
PCI DSS

Correct answer: NIST SP 800-171

CMMC Level 2 aligns with NIST SP 800-171, which defines 110 security practices for protecting Controlled Unclassified Information (CUI) in non-federal systems.

Question 44: An analyst needs to remediate a compromised account in Microsoft Entra ID Protection. Which combination of actions fully remediates the risk?

Enable MFA and dismiss sign-in risk
Reset password, revoke all sessions, and confirm user is compromised (Correct answer)
Delete and recreate the user account
Dismiss user risk and unblock the account

Correct answer: Reset password, revoke all sessions, and confirm user is compromised

Full remediation requires resetting credentials to evict the attacker, revoking active sessions to terminate existing access, and confirming compromise to feed the risk engine.

Question 45: An analyst wants to hunt for OAuth app consent grants that may indicate an illicit consent grant attack. Which Microsoft 365 Defender table should they query?

DeviceLogonEvents
EmailEvents
CloudAppEvents (Correct answer)
IdentityLogonEvents

Correct answer: CloudAppEvents

CloudAppEvents in Microsoft 365 Defender logs cloud app activity including OAuth app consent grants, which can indicate illicit consent grant phishing attacks.

Question 46: Which Microsoft Sentinel feature allows you to import external threat intelligence feeds and use those indicators in analytics rules?

Entity behavior analytics
Watchlists
UEBA
Threat Intelligence data connectors (Correct answer)

Correct answer: Threat Intelligence data connectors

Threat Intelligence data connectors in Sentinel ingest IoC feeds (TAXII or flat file) into the ThreatIntelligenceIndicator table for use in detection rules.

Question 47: A security operations team wants to measure the mean time to respond (MTTR) to incidents handled through Microsoft Sentinel. Where would an analyst find this metric natively within Sentinel?

The Threat Intelligence blade
The Efficiency workbook in Microsoft Sentinel Workbooks (Correct answer)
The Analytics rules audit log
The Data Connectors health dashboard

Correct answer: The Efficiency workbook in Microsoft Sentinel Workbooks

The Microsoft Sentinel Efficiency workbook provides built-in SOC metrics including MTTR, incidents closed, and analyst performance over selectable time ranges.

Question 48: What is the importance of staying current with trends in Security Operations & Monitoring for Microsoft Security Operations Analyst?

Trends do not affect professional practice
It is only required for new professionals
It is not necessary once certified
It ensures practices remain effective and relevant (Correct answer)

Correct answer: It ensures practices remain effective and relevant

Staying current with industry trends ensures that professional practices remain effective, relevant, and aligned with evolving standards.

Question 49: Which Microsoft Defender XDR feature allows analysts to run ad-hoc KQL queries across endpoints, identities, emails, and cloud apps in a unified interface?

Advanced hunting (Correct answer)
Secure Score
Threat analytics
Attack simulation training

Correct answer: Advanced hunting

Advanced hunting in Microsoft Defender XDR provides a unified KQL query interface spanning all XDR data domains for proactive threat hunting.

Question 50: Which Microsoft Purview feature enables organizations to implement retention schedules that satisfy regulatory requirements like SEC Rule 17a-4 for financial records?

Communication compliance
Sensitivity labels
Retention labels and policies (Correct answer)
Insider risk management

Correct answer: Retention labels and policies

Microsoft Purview retention labels and policies allow organizations to define and enforce retention schedules that align with specific regulatory requirements such as SEC Rule 17a-4 for immutable financial records.

SC-200: Microsoft Security Operations Analyst

The SC-200 exam validates skills in threat management, monitoring, and response using Microsoft security solutions including Microsoft Sentinel, Microsoft Defender XDR, and Microsoft Defender for Cloud. It leads to the Microsoft Certified: Security Operations Analyst Associate certification.

Questions

100 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds