Microsoft SC-200 Practice Test

SC-200 practice test: what's covered

• Security Operations Analyst Associate

Free SC-200 sample questions

1. Your organisation has just licensed Microsoft Defender XDR. You need the SOC team to view incidents from Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps in a SINGLE unified queue. Which portal should the team primarily use?

   • A. Microsoft Sentinel portal under "Incidents"
   • B. Microsoft Defender portal (security.microsoft.com) under "Incidents & alerts"
   • C. Microsoft Purview compliance portal
   • D. Azure portal → Microsoft Defender for Cloud blade
   Show answer

   Correct: B. Microsoft Defender XDR unifies MDE, MDO, MDI, and MDA incidents at security.microsoft.com. Sentinel (Azure portal / unified portal when integrated) can ingest these via the Microsoft Defender XDR connector but the native single-pane queue for the XDR products is the Defender portal. A common trap is to assume Sentinel is the primary console — Sentinel is the SIEM/SOAR layer above XDR.

2. You enable the Microsoft Defender XDR data connector in Microsoft Sentinel. By default, which data tables become available for KQL hunting in Sentinel after connector setup is complete?

   • A. Only the SecurityAlert table
   • B. SecurityIncident, SecurityAlert, and the full set of advanced-hunting tables (DeviceEvents, DeviceProcessEvents, EmailEvents, IdentityLogonEvents, CloudAppEvents, etc.) when "Connect events" is enabled per workload
   • C. No tables until you author custom DCRs
   • D. Only the Heartbeat and Usage tables
   Show answer

   Correct: B. The Microsoft Defender XDR connector streams SecurityIncident and SecurityAlert by default. You must toggle "Connect events" for each workload (Endpoint, Office, Identity, Cloud Apps) to also stream the advanced-hunting tables into Sentinel. Beware of egress cost — these tables can be voluminous; many SOCs leave hunting on the Defender side and only forward alerts.

3. A junior analyst should be able to view alerts in Microsoft Defender XDR but must NOT be able to take live response actions on endpoints or change settings. Following least-privilege using Microsoft Defender XDR's Unified RBAC, which role assignment is correct?

   • A. Global Administrator
   • B. Security Operator (legacy) or a custom Unified RBAC role with "Alerts (read)" + "Security data basics (read)" only
   • C. Security Administrator
   • D. Defender for Endpoint Live Response Administrator
   Show answer

   Correct: B. Defender XDR Unified RBAC lets you compose permissions across MDE/MDO/MDI/MDA. The "Security Operator" Entra role grants alert read but no settings or response actions. Global Administrator violates least privilege and would also grant write to identity. Security Administrator can change settings — too broad. Always prefer the smallest scoped custom Unified RBAC role in production.

4. You are creating a Microsoft Sentinel workspace for production. Which TWO design decisions have direct downstream impact on COST and CANNOT be cheaply reversed later? (Choose 2)

   • A. Choosing the Azure region for the Log Analytics workspace
   • B. Choosing the commitment tier (pay-as-you-go vs 100 GB/day vs higher) — although tier is changeable, mis-sized retention/archive choices accrue cost daily
   • C. Setting the default table-level retention beyond the included 90 days (Sentinel) and beyond the included 31 days (Log Analytics)
   • D. Naming convention for analytic rules
   Show answer

   Correct: A and C. Region cannot be changed after creation — you must migrate to a new workspace. Retention beyond the included free period costs per GB-month for every table and is the silent budget killer. Commitment tier CAN be changed easily. Naming has no cost impact. Best practice: turn on per-table retention overrides and push cold data to Archive tier or Basic Logs.

5. You need to onboard Azure Activity logs for an entire management group (250 subscriptions) into your Sentinel workspace, with minimum manual effort. The BEST approach is:

   • A. Run a script that creates a diagnostic setting on each subscription
   • B. Use the "Azure Activity" data connector in Sentinel with the "Apply" option at the management-group scope, which provisions an Azure Policy assignment that auto-configures every current AND future subscription
   • C. Install MMA agent on every VM
   • D. Enable Defender for Cloud and rely on its data connector
   Show answer

   Correct: B. The Azure Activity connector's recommended path is a built-in Azure Policy assignment scoped at a management group. This automatically targets all child subscriptions and any new ones added later — exactly the requirement. Scripts are brittle and miss new subscriptions. MMA is for VM logs, not Activity log. Defender for Cloud streams its own alerts but not raw Activity log.

Last updated: 2026-10-19

SC-200 practice test FAQ

Related practice tests

• Microsoft SC-300 practice test
• Microsoft SC-100 practice test
• Microsoft SC-900 practice test
• Microsoft Sentinel practice test
• Microsoft Defender XDR practice test
• CySA+ CS0-003 practice test