About these questions
These five questions are original. We wrote them in the style of the SC-200 skills measured, with two from the first domain, two from the second, and one from the third, roughly following the domain weightings. They are not real exam questions, and the real exam will word things differently and often uses longer scenarios.
How to use these
Try each question without looking at your notes, and pick an answer before you open the explanation. Then read the explanation even when you were right, because the reason the closest wrong option fails is where the learning is. Note any domain where you slipped and revisit it on the domains explained page.
Question 1 (Manage a security operations environment)
A night-shift analyst at a logistics company must read data in a Microsoft Sentinel workspace and assign and close incidents. The analyst must not be able to create or edit analytics rules. Which role follows least privilege?
- A. Microsoft Sentinel Contributor
- B. Microsoft Sentinel Reader
- C. Microsoft Sentinel Automation Contributor
- D. Microsoft Sentinel Responder
Show the answer and explanation
Correct answer: D. Microsoft Sentinel Responder includes everything Reader can do and adds incident management, such as assigning and closing incidents. It does not allow editing analytics rules. Reader is the closest wrong option: it can view data and incidents but cannot manage them. Contributor adds the ability to create and edit rules and workbooks, which is more than the task needs. Automation Contributor is meant for letting Sentinel run playbooks from automation rules, not for analysts.
Question 2 (Manage a security operations environment)
You enable the Windows Security Events via AMA connector for your domain controllers and create a data collection rule that collects the Security event set. Into which Log Analytics table do the Security events arrive?
- A. Event
- B. WindowsEvent
- C. SecurityEvent
- D. Syslog
Show the answer and explanation
Correct answer: C. The Windows Security Events via AMA connector writes the events it collects to the SecurityEvent table. The Event table is the closest wrong option. It receives Windows event logs collected through a plain Azure Monitor Agent data collection rule that uses the Windows event logs data source, which is a different collection path. WindowsEvent is used for events that arrive through Windows Event Forwarding, and Syslog holds messages from Linux machines and network appliances.
Question 3 (Respond to security incidents)
Defender for Endpoint raised a high-severity alert on a file server. Analysts must keep reaching the server over the network to continue the investigation, but unknown tools must stop running on it. Which response action should you use?
- A. Isolate device
- B. Collect investigation package
- C. Contain device
- D. Restrict app execution
Show the answer and explanation
Correct answer: D. Restrict app execution applies a code integrity policy that lets only files signed by a Microsoft-issued certificate run. Unknown attacker tools are blocked while the server stays on the network. Isolate device is the closest wrong option because it cuts the device off from the network, which breaks the requirement to keep reaching it. Contain device makes other onboarded devices block traffic with a device, so it also reduces connectivity. Collect investigation package only gathers forensic data and does not stop anything from running.
Question 4 (Respond to security incidents)
A phishing message was delivered to the mailboxes of several finance employees. In Microsoft Defender for Office 365, which two actions can you take to remediate the delivered message? Choose two.
- A. Isolate device
- B. Hard delete
- C. Restrict app execution
- D. Move to deleted items
- E. Stop and quarantine file
Show the answer and explanation
Correct answers: B and D. Defender for Office 365 offers email remediation actions that move or delete a delivered message, including Move to junk folder, Move to inbox, Move to deleted items, Soft delete, and Hard delete. Hard delete purges the message, and Move to deleted items relocates it. The closest wrong options are Stop and quarantine file and Restrict app execution. They sound like remediation, but they are Defender for Endpoint actions that act on files and devices, not on a message sitting in a mailbox. Isolate device is a device action as well.
Question 5 (Perform threat hunting)
A file server shows documents whose names were changed by a script that added a new extension to each file. During a ransomware investigation you need a list of these files with both the new name and the name before the change. Which advanced hunting table should you query?
- A. DeviceRegistryEvents
- B. DeviceFileEvents
- C. DeviceImageLoadEvents
- D. DeviceFileCertificateInfo
Show the answer and explanation
Correct answer: B. DeviceFileEvents records file system activity such as file creation, modification, renaming, and deletion. For a rename, it also keeps the name the file had before the change, which is exactly what you need here. DeviceFileCertificateInfo is the closest wrong option because it also has “file” in its name, but it holds certificate information about signed files, not file system events. DeviceRegistryEvents covers registry changes, and DeviceImageLoadEvents covers DLL loads.
More guides for SC-200
- SC-200 Exam Format, Scoring and Retakes
- SC-200 Study Plan: 4-Week and 8-Week
- Is the SC-200 Exam Hard?
- SC-200 Prerequisites and Skills Check
- SC-200 Renewal and Retakes Explained
- Is SC-200 Worth It? An Honest Look
- SC-200 Cheat Sheet: Key Facts to Review
- SC-200 vs SC-401: Which First?
Next step
Want to see how you do across more topics? Read the domains explained page, or try the full set of SC-200 practice tests. Each answer there comes with an explanation for every option.