CertsPoint
Sign In Get Started
See all results for ""
Exams About Us
Sign In Get Started
Exam Overview
Exam Code SC-200
Exam Name Microsoft Security Operations Analyst
Vendor Microsoft
Total Questions 370
Last Updated 26-Oct, 2026
Free SC-200 Questions Get Premium Access
Why CertsPoint?
  • Latest & Verified Questions
  • Detailed Explanations
  • Regular Updates
  • Full-Length Practice Tests
  • Boost Your Exam Confidence

PDF Study Materials

Downloadable guides and resources

Practice Tests

Full-length tests with real exam experience

Progress Tracking

Monitor your performance and improvement

Study Anywhere

Access on desktop, tablet, and mobile

Excellent
4.6 (398 Up Votes)
Secure Payment Privacy Protected Money Back Guarantee

Free SC-200 Practice Questions

Explore 5 free practice questions for the Microsoft SC-200 exam and review the answers and explanations to support your preparation.

  1. Question 1

    Drag & Drop

    HOTSPOT You need to create an advanced hunting query to investigate the executive team issue. How should you complete the query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

    Show Answer & Explanation Hide Answer & Explanation

    Correct Answer

    CloudAppEvents
    | where TimeStamp > ago(2d)
    | summarize activityCount = count() by FolderPath, FileName, ActionType, AccountDisplayName
    | where activityCount > 5

    Explanation

    Selected Drop-Down Values
    Drop-Down SectionCorrect SelectionReason
    First Drop-down (Table)CloudAppEventsThis table tracks cloud application activities and includes specific columns like FolderPath, FileName, and AccountDisplayName required by the query.
    Second Drop-down (Aggregation)count()The query assigns the result to a variable named activityCount and subsequently filters for occurrences greater than 5 (where activityCount > 5), which requires counting rows rather than averaging or summing values.

  2. Question 2

    Single answer

    Question: 4 You need to recommend a solution to meet the technical requirements for the Azure virtual machines. What should you include in the recommendation?

    • Option A:
      just-in-time (JIT) access
      Correct
    • Option B:
      Azure Defender
      Correct
    • Option C:
      Azure Firewall
      Correct
    • Option D:
      Azure Application Gateway
      Correct
    Show Answer & Explanation Hide Answer & Explanation

    Correct Answer: B

    Explanation

    For Azure Virtual Machines, Azure Defender provides:
    • Advanced threat protection
    • Vulnerability assessment
    • Security monitoring and recommendations
    • Detection of suspicious activities and attacks
    • Integration with Microsoft Defender for Endpoint
    If the technical requirement is to improve the security posture of Azure VMs, Azure Defender is the appropriate solution.
    Why the others are incorrect
    • A. Just-in-time (JIT) access ❌
    • Limits exposure of management ports (RDP/SSH) but does not provide comprehensive VM security and threat protection.
    • C. Azure Firewall ❌
    • Protects network traffic but does not provide VM-level threat detection and vulnerability management.
    • D. Azure Application Gateway ❌
    • A web traffic load balancer for web applications, not a VM security solution.

  3. Question 3

    Drag & Drop

    HOTSPOT for the Azure virtual You need to recommend remediation actions for the Azure Defender alerts for Fabrikam. What should you recommend for each threat? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

    Show Answer & Explanation Hide Answer & Explanation

    Correct Answer

    Threat CategoryCorrect Action Selection
    Internal threat:Modify the role-based access control (RBAC) settings for the key vault.
    External threat:Modify the Key Vault firewall settings.

    Explanation

  4. Internal Threat: Granting or restricting specific user permissions internally is best handled using Azure Role-Based Access Control (RBAC). This allows you to enforce the principle of least privilege for administrators and internal applications interacting with the Key Vault.
    External Threat: Restricting access coming from outside the organization's trusted boundary requires network isolation. Modifying the Key Vault firewall settings allows you to limit traffic specifically to trusted virtual networks or specific public IP addresses, effectively blocking malicious external actors.

  5. Question 4

    Single answer

    The issue for which team can be resolved by using Microsoft Defender for Office 365?

    • Option A:
       executive
      Correct
    • Option B:
       marketing
      Correct
    • Option C:
      security
      Correct
    • Option D:
      sales
      Correct
    Show Answer & Explanation Hide Answer & Explanation

    Correct Answer: B

    Explanation

    Microsoft Defender for Office 365 protects against:
    • Phishing attacks
    • Malicious links (Safe Links)
    • Malicious attachments (Safe Attachments)
    • Business email compromise
    • Email-borne threats
    In many exam scenarios, the Marketing team is the group most likely to be affected by phishing emails, malicious attachments, or external communications, making Defender for Office 365 the appropriate solution.
    Why the others are incorrect
    • A. Executive ❌
    • While executives can benefit from Defender for Office 365, the scenario's issue is typically associated with marketing users receiving external email content.
    • C. Security ❌
    • The security team manages security tools; Defender for Office 365 is not specifically resolving their issue.
    • D. Sales ❌
    • Sales users can benefit from email protection, but the described issue aligns with the marketing team's requirements.

  6. Question 5

    Single answer

    The issue for which team can be resolved by using Microsoft Defender for Endpoint?

    • Option A:
      executive
      Correct
    • Option B:
      saleS
      Correct
    • Option C:
       marketing
      Correct
    Show Answer & Explanation Hide Answer & Explanation

    Correct Answer: C

    Explanation

    Microsoft Defender for Endpoint provides:
    • Endpoint protection for devices
    • Threat and vulnerability management
    • Attack surface reduction
    • Endpoint detection and response (EDR)
    • Investigation and remediation of device-based threats
    If the issue affecting the Marketing team involves compromised devices, malware, suspicious activity on endpoints, or device security, then Microsoft Defender for Endpoint would resolve it.
    Quick distinction for exams
    • Microsoft Defender for Office 365 → Protects email, links, attachments, and collaboration tools.
    • Microsoft Defender for Endpoint → Protects devices/endpoints such as laptops, desktops, and servers.