Free Exam SC-200: Microsoft Security Operations Analyst Practice Questions

Sample Practice Questions

Try these 10 sample questions from the Exam SC-200: Microsoft Security Operations Analyst practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1A Defender XDR incident email rule should notify analysts once for each incident, rather than send further notifications for that incident. Which setting meets this requirement?

   1. A. Include tenant-specific portal link
   2. B. Send only one notification per incident
   3. C. Include organization name in the email
   4. D. Device group scope: all device groups

   Answer: B

   Explanation: The notification rule setting states, "Send only one notification per incident - Select if you want one notification per incident." This controls repeat notifications; the other settings control links, email content, or device scope.

   Reference: Get incident notifications by email in Microsoft Defender XDR — Create a rule for email notifications

2. 2In the available legacy Defender incident experience, an analyst investigates relationships and attack progression across users, devices, and mailboxes. Which operation directly displays this cross-entity attack chronology?

   1. A. Sort the alert list by severity and review the highest-severity item.
   2. B. Play the incident graph's alerts and entity nodes in time order.
   3. C. Open one affected device's timeline and review its local events.
   4. D. Filter the incident to one alert source and inspect that source's alerts.

   Answer: B

   Explanation: The attack-story graph "connects the different suspicious entities that are part of the attack with their related assets such as users, devices, and mailboxes." It also lets analysts "Play the alerts and the nodes on the graph as they occurred over time to understand the chronology of the attack." Severity sorting, one-device timelines, and one-source filters do not directly present the full cross-entity sequence.

   Reference: Investigate incidents in the Microsoft Defender portal (legacy) — Attack story / incident graph

3. 3A Defender XDR hunter needs process creation events to investigate a suspicious command-line execution chain. Which advanced hunting table is the appropriate starting point?

   1. A. DeviceInfo
   2. B. DeviceNetworkInfo
   3. C. DeviceFileEvents
   4. D. DeviceProcessEvents

   Answer: D

   Explanation: The schema describes DeviceProcessEvents as "Process creation and related events". DeviceFileEvents concerns filesystem activity, DeviceNetworkInfo describes network configuration, and DeviceInfo contains machine information rather than the requested execution events.

   Reference: Understand the advanced hunting schema — Learn the schema tables / DeviceProcessEvents

4. 4An analyst uses Defender XDR RBAC and can manage only the Finance device group. How does this affect incident email notifications the analyst configures?

   1. A. The analyst can configure notifications for every device group in the tenant.
   2. B. The analyst can receive notifications for other groups but cannot edit their rules.
   3. C. The analyst's notification operations are limited to device groups they can manage.
   4. D. The analyst gains access to other groups by adding their own recipient address.

   Answer: C

   Explanation: Microsoft states, "you can only create, edit, delete, and receive notifications based on device groups that you are allowed to manage." Notification recipients and rule creation do not bypass the analyst’s RBAC device scope.

   Reference: Get incident notifications by email in Microsoft Defender XDR — Get incident notifications by email in Microsoft Defender XDR

5. 5While investigating an entity in the Defender portal's legacy incident experience, an analyst selects Go hunt > Related Alerts. What result should the analyst expect?

   1. A. All actions awaiting administrator approval for that entity
   2. B. Only incidents assigned to the currently signed-in analyst
   3. C. All available query templates without executing any search
   4. D. Security alerts involving the entity being investigated

   Answer: D

   Explanation: The Go hunt option is documented as "Related Alerts – searches for and returns all security alerts that involve a specific entity, so you don't miss any information." It targets entity-linked alerts rather than approval actions, ownership, or a template listing.

   Reference: Investigate incidents in the Microsoft Defender portal (legacy) — Go hunt / Related Alerts

6. 6A hunter wants recorded network connection events involving endpoints, rather than a snapshot of their adapters and IP configuration. Which Defender XDR table should be queried?

   1. A. DeviceNetworkEvents
   2. B. DeviceNetworkInfo
   3. C. DeviceInfo
   4. D. DeviceLogonEvents

   Answer: A

   Explanation: DeviceNetworkEvents contains "Network connection and related events". DeviceNetworkInfo stores network properties such as adapters and IP addresses, while DeviceInfo and DeviceLogonEvents cover machine metadata and authentication.

   Reference: Understand the advanced hunting schema — Learn the schema tables / DeviceNetworkEvents

7. 7A Defender for Endpoint device matches two device groups: Servers at rank 1 and Production at rank 3. Which membership is assigned?

   1. A. Production only, because the larger rank takes precedence
   2. B. Both groups, with their remediation settings combined
   3. C. Ungrouped devices, because multiple matches are ambiguous
   4. D. Servers only, because the highest ranked match takes precedence

   Answer: D

   Explanation: The device group documentation states, "A device group with a rank of 1 is the highest ranked group. When a device is matched to more than one group, it's added only to the highest ranked group." Therefore the device belongs to Servers only.

   Reference: Create and manage device groups in Microsoft Defender for Endpoint — Manage device groups

8. 8An Entra ID Protection sign-in risk policy requires MFA. A user whose sign-in meets that policy successfully completes the MFA challenge. What happens to that sign-in risk?

   1. A. It is remediated after successful MFA.
   2. B. It remains unchanged until a password is also changed.
   3. C. It is converted into a confirmed-compromised user designation.
   4. D. It is deferred until an administrator manually dismisses the alert.

   Answer: A

   Explanation: For sign-in risk self-remediation, Microsoft states, "If they successfully complete the MFA challenge, the sign-in risk is remediated." A secure password change addresses a different user-risk flow and is not an additional requirement in this stated sign-in-risk policy.

   Reference: Remediate risks and unblock users in Microsoft Entra ID Protection — Self-remediation of sign-in risk

9. 9An email hunt needs URLs embedded in email messages, rather than recipient click events or attachment metadata. Which advanced hunting table supplies the URL information?

   1. A. EmailAttachmentInfo
   2. B. EmailPostDeliveryEvents
   3. C. EmailUrlInfo
   4. D. UrlClickEvents

   Answer: C

   Explanation: The schema lists EmailUrlInfo as "Information about URLs on emails". Attachment information, post-delivery security events, and URL clicks represent related but different observations.

   Reference: Understand the advanced hunting schema — Learn the schema tables / EmailUrlInfo

10. 10A Defender for Endpoint device group specifies a device-name condition and an OS-platform condition. What must a device satisfy to be added to this group?

    1. A. Both the device-name and OS-platform conditions
    2. B. Either the device-name or OS-platform condition
    3. C. The device-name condition, with OS platform used only for ranking
    4. D. The OS-platform condition, with device name used only for display

    Answer: A

    Explanation: The group configuration guidance says, "Devices that match all specified conditions are added to the group." Conditions across these different properties are cumulative; matching just one is insufficient.

    Reference: Create and manage device groups in Microsoft Defender for Endpoint — Create a device group / Devices page