Microsoft Security Operations Analyst (SC-200) Free Practice Test
Question 1
You plan to create a custom Azure Sentinel query that will provide a visual representation of the security alerts generated by Azure Security Center.
You need to create a query that will be used to display a bar graph. What should you include in the query?
You need to create a query that will be used to display a bar graph. What should you include in the query?
Correct Answer: B
Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).
Question 2
You have a Microsoft 365 E5 subscription.
You need to create a hunting query that will return every email that contains an attachment named Document.
pdf. The query must meet the following requirements:
* Only show emails sent during the last hour.
* Optimize query performance.
How should you complete the query? To answer, select the appropriate options in the answer area. NOTE:
Each correct selection is worth one point.
You need to create a hunting query that will return every email that contains an attachment named Document.
pdf. The query must meet the following requirements:
* Only show emails sent during the last hour.
* Optimize query performance.
How should you complete the query? To answer, select the appropriate options in the answer area. NOTE:
Each correct selection is worth one point.
Correct Answer:
Explanation:
For hunting in Microsoft 365 Defender , email attachment metadata is in EmailAttachmentInfo (fields include Timestamp , FileName , SHA256 , NetworkMessageId , etc.). To return every email that contains a specific attachment and optimize performance , apply time filters as early as possible and avoid unnecessary joins. Early filtering reduces the dataset to scan and speeds execution.
A performant query that meets "only last hour" and the attachment name requirement is:
EmailAttachmentInfo
| where Timestamp > ago(1h) // filter early for performance
| where Subject == " Document Attachment " and FileName == " Document.pdf "
| where Timestamp > ago(1h) // (idempotent second constraint; harmless) Using joins (e.g., to DeviceFileEvents on SHA256 ) is not required to answer the question and would add overhead. The key is to filter on Timestamp and FileName within EmailAttachmentInfo , ensuring only emails from the last hour with Document.pdf are returned while keeping the query efficient.
Question 3
You have 500 on-premises Windows 11 devices that use Microsoft Defender for Endpoint You enable Network device discovery.
You need to create a hunting query that will identify discovered network devices and return the identity of the onboarded device that discovered each network device.
Which built-in function should you use?
You need to create a hunting query that will identify discovered network devices and return the identity of the onboarded device that discovered each network device.
Which built-in function should you use?
Correct Answer: D
Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).
Question 4
You have a Microsoft 365 E5 subscription that uses Microsoft SharePoint Online.
You delete users from the subscription.
You need to be notified if the deleted users downloaded numerous documents from SharePoint Online sites during the month before their accounts were deleted.
What should you use?
You delete users from the subscription.
You need to be notified if the deleted users downloaded numerous documents from SharePoint Online sites during the month before their accounts were deleted.
What should you use?
Correct Answer: A
Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).
Question 5
You have a Microsoft Sentinel workspace named SW1.
In SW1, you investigate an incident that is associated with the following entities:
* Host
* IP address
* User account
* Malware name
Which entity can be labeled as an indicator of compromise (loC) directly from the incident s page?
In SW1, you investigate an incident that is associated with the following entities:
* Host
* IP address
* User account
* Malware name
Which entity can be labeled as an indicator of compromise (loC) directly from the incident s page?
Correct Answer: B
Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).
Question 6
You have an Azure subscription that contains the users shown in the following table.
The subscription contains instances of Azure Firewall as shown in the following table.
You have a Microsoft 365 E5 subscription that uses Microsoft Copilot for Security. You have the Copilot for Security role assignments shown in the following table.
Each user runs a Copilot for Security session.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
The subscription contains instances of Azure Firewall as shown in the following table.
You have a Microsoft 365 E5 subscription that uses Microsoft Copilot for Security. You have the Copilot for Security role assignments shown in the following table.
Each user runs a Copilot for Security session.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation:
Yes No Yes
According to Microsoft Copilot for Security and Defender for Cloud (Azure Firewall) integration guidance, Copilot can retrieve information from connected security data sources such as Log Analytics, Microsoft Sentinel, and Defender XDR. To access data via Copilot prompts, two conditions must be satisfied:
* The user must have the appropriate Copilot role (Owner or Contributor).
* The user must have the necessary Azure permissions (RBAC) to access the underlying data source or workspace (e.g., Log Analytics, Sentinel, or Azure Firewall logs).
User1 - Has the Contributor role at the subscription level , meaning full access to all resource groups and Log Analytics workspaces. As a Copilot Owner , User1 can query Copilot and retrieve data from AFW1 logs (which are in Log Analytics). Hence, Yes .
User2 - Also has Contributor rights at the subscription level but is only a Copilot Contributor . A Copilot Contributor can collaborate in sessions but cannot initiate or run data retrieval prompts independently.
Therefore, No for AFW2.
User3 - Has the Security Reader role at the resource group level, providing read access to security data for that group, and is a Copilot Owner , enabling prompt access to connected security sources. Since AFW3 logs are in Log Analytics within the same resource group, User3 can retrieve data using Copilot. Thus, Yes .
Therefore, the correct answers are:
* User1 # Yes
* User2 # No
* User3 # Yes
Question 7
You have four Azure subscriptions. One of the subscriptions contains a Microsoft Sentinel workspace.
You need to deploy Microsoft Sentinel data connectors to collect data from the subscriptions by using Azure Policy. The solution must ensure that the policy will apply to new and existing resources in the subscriptions.
Which type of connectors should you provision, and what should you use to ensure that all the resources are monitored? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
You need to deploy Microsoft Sentinel data connectors to collect data from the subscriptions by using Azure Policy. The solution must ensure that the policy will apply to new and existing resources in the subscriptions.
Which type of connectors should you provision, and what should you use to ensure that all the resources are monitored? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation:
In Microsoft Sentinel , data connectors are the mechanisms that collect logs and telemetry from various Azure and non-Azure sources into a Log Analytics workspace .
When your goal is to automatically connect multiple Azure subscriptions (both existing and new resources ) to Sentinel, the correct approach is to use Azure Policy with connectors that rely on diagnostic settings .
Why Diagnostic Settings Many Azure resources (e.g., Key Vaults, Storage Accounts, Azure Firewall, and Activity Logs) send logs to Sentinel via diagnostic settings . This connector type allows logs to be exported directly to the Sentinel workspace without requiring agents or manual configuration.
By using Azure Policy , you can automatically enforce and deploy these diagnostic settings across all current and future resources - ensuring continuous log ingestion with minimal administrative overhead.
Why a Remediation Task When applying the Azure Policy, existing resources might not yet have diagnostic settings configured. To fix this, you create a remediation task . This instructs Azure Policy to apply the compliance settings to existing resources , not just new ones. Without a remediation task, only newly created resources would comply automatically.
* Connector type: Diagnostic settings # used for policy-based deployment across subscriptions.
* Use: A remediation task # ensures policy applies to both existing and new resources for full coverage.
Therefore: # Final Answer:
* Connector type: Diagnostic settings
* Use: A remediation task
Question 8
Your company has an on-premises network that uses Microsoft Defender for Identity.
The Microsoft Secure Score for the company includes a security assessment associated with unsecure Kerberos delegation.
You need remediate the security risk.
What should you do?
The Microsoft Secure Score for the company includes a security assessment associated with unsecure Kerberos delegation.
You need remediate the security risk.
What should you do?
Correct Answer: C
Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).
Question 9
You have a Microsoft Sentinel workbook that contains the following KQL query.
You need to create a visual that will change the color of the errCount column based on the value returned.
How should you configure the visual? To answer, select the appropriate options in the answer area. NOTE:
Each correct selection is worth one point.
You need to create a visual that will change the color of the errCount column based on the value returned.
How should you configure the visual? To answer, select the appropriate options in the answer area. NOTE:
Each correct selection is worth one point.
Correct Answer:
Explanation:
In Microsoft Sentinel workbooks , when you want to display query results in a tabular format and visually emphasize numeric values through color intensity (such as counts or frequencies), you use the Grid visualization type combined with the Heatmap column renderer .
In this scenario, the query aggregates failed sign-in events from SigninLogs and AADNonInteractiveUserSignInLogs , summarizing them by ErrorCode , FailureReason , and Category with a calculated count ( errCount ). The errCount column holds numeric data that indicates how many times each unique failure pattern occurred.
To visually represent the severity or frequency of these counts, you configure:
* Visualization = Grid - Displays tabular data in a workbook. It's the standard view type for showing multiple columns of query output (such as error codes and counts).
* Column renderer = Heatmap - Applies a gradient color scheme to the selected numeric column ( errCount ) so that higher values are highlighted with darker or more intense colors, making patterns or anomalies easier to spot.
Microsoft Sentinel workbook documentation explains:
"Heatmap rendering can be applied to numerical columns in Grid visualizations to provide color-coded representation of value ranges." Alternative renderers like Text or Big number do not provide dynamic color intensity, and Thresholds are used for conditional formatting rather than continuous color gradients.
# Final configuration:
* Visualization: Grid
* Column renderer: Heatmap
Question 10
Your company deploys Azure Sentinel.
You plan to delegate the administration of Azure Sentinel to various groups.
You need to delegate the following tasks:
* Create and run playbooks
* Create workbooks and analytic rules.
The solution must use the principle of least privilege.
Which role should you assign for each task? To answer, drag the appropriate roles to the correct tasks. Each role may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
You plan to delegate the administration of Azure Sentinel to various groups.
You need to delegate the following tasks:
* Create and run playbooks
* Create workbooks and analytic rules.
The solution must use the principle of least privilege.
Which role should you assign for each task? To answer, drag the appropriate roles to the correct tasks. Each role may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation:
In Microsoft Sentinel (Defender XDR SIEM), access control is based on Azure RBAC (Role-Based Access Control) to ensure least privilege operations. According to Microsoft's Sentinel role documentation:
* Logic App Contributor: This role is required to create and run playbooks (automated workflows built on Azure Logic Apps). Although Sentinel integrates with Logic Apps, playbook creation and execution permissions are governed by the Logic App Contributor role at the resource group or subscription level where playbooks are deployed. Without this role, a user cannot design or execute automated responses.
* Azure Sentinel Contributor: This role grants permission to create, edit, and delete analytic rules, workbooks, and hunting queries within the Sentinel workspace. It does not allow modifying playbooks or executing automation unless combined with Logic App Contributor. It's the appropriate role for analysts or engineers who manage detection content (rules and visualizations).
The Azure Sentinel Reader role only allows viewing incidents, workbooks, and rules but not editing or creating them. The Sentinel Responder role focuses on handling and closing incidents, not authoring content or automation.
# Final Mapping:
* Create and run playbooks # Logic App Contributor
* Create workbooks and analytic rules # Azure Sentinel Contributor
Question 11
You have a Microsoft 365 subscription that uses Microsoft Defender for Endpoint Plan 2 and contains a Windows device named Device!.
You initiated a live response session on Device1.
You need to run a command that will download a 250-MB file named File! .exe from the live response library to Device1. The solution must ensure that Filel.exe is downloaded as a background process.
How should you complete the live response command? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
You initiated a live response session on Device1.
You need to run a command that will download a 250-MB file named File! .exe from the live response library to Device1. The solution must ensure that Filel.exe is downloaded as a background process.
How should you complete the live response command? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation:
< putfile and &
To push (download) a file from the Live Response library onto an endpoint you use the PutFile (often shown as putfile ) Live Response command. Microsoft's Live Response command set documents that PutFile "puts a file from the library to the device" and the file is saved to a working folder on the endpoint (and removed on restart by default). This is the operation that transfers a tenant-level library file (for example, an executable you uploaded) onto the target machine for execution or inspection. blog.sec-labs.com+1 When you need the transfer to run as a background job so the live-response session is not blocked waiting for command completion, the Live Response shell supports running commands asynchronously by appending the ampersand operator. Microsoft's Live Response guidance and examples show that background execution is used to avoid blocking the interactive session while large files or long-running operations complete; using & runs the command in the background. Combining these two yields the correct command to download a 250- MB executable from the library to Device1 as a background process: use putfile for the library#device transfer and append & to run it in the background.
Therefore: choose putfile and & .
Question 12
A company uses Azure Sentinel.
You need to create an automated threat response.
What should you use?
You need to create an automated threat response.
What should you use?
Correct Answer: A
Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).