logo

Microsoft SC-200 Exam Questions & Verified Answers

Prepare for Security Operations Analyst Associate with expert-reviewed SC-200 questions and answers. Try free samples, strengthen your understanding and rehearse your timing in the simulator.

291
Practice questions
Previews from the SC-200 free simulator sample

Try Free SC-200 Practice Questions

Explore the questions below, browse the question library or try a free five-question simulator sample to find the study format that works for you.

View 145 free questions
Question 1
You need to meet the Microsoft Sentinel requirements for Group1. Which role should you assign to Group1?
Question 2
You need to configure event monitoring for Server1. The solution must meet the Microsoft Sentinel requirements. What should you create first?
Question 3
You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR. You have a Microsoft Sentinel workspace. Microsoft Sentinel data connectors are configured as shown in the following table. Data connector Collected log Microsoft Entra ID Audit logs Microsoft Graph activity logs Microsoft 365 Microsoft Exchange Online Microsoft SharePoint Online Microsoft Teams You use Microsoft Sentinel to investigate suspicious Microsoft Graph API activity related to Conditional Access policies. You need to search for the following activities: Downloads of the Conditional Access policies by using PowerShell Updates to the Conditional Access policies by using the Microsoft Entra admin center Which tables should you query for each activity? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point
Question 4
You have 100 on-premises servers that run Windows Server and do NOT have internet connectivity. You have an Azure subscription that contains a dedicated monitoring server. You have a Microsoft Sentinel workspace named Workspace1. You need to ingest Windows event logs from the on-premises servers into Workspace1. What should you do? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.
Question 5
You have an Azure subscription that contains two resource groups named RG1 and RG2. The subscription is linked to a Microsoft Entra tenant that contains a group named Group1. RG1 contains a Microsoft Sentinel workspace named Workspace1. RG2 contains an incident-trigger playbook named Playbook1. You need to ensure that the members of Group1 can view incidents and update incident status in Workspace1. The solution must meet the following requirements: Ensure that the Group1 members can run Playbook1 manually. Prevent the Group1 members from editing analytics rules. Prevent the Group1 members from editing Playbook1. Follow the principle of least privilege. Which role-based access control (RBAC) role should you assign to each resource group? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.
Question 6
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You are configuring Microsoft Sentinel. You need to create an incident in Microsoft Sentinel when a sign-in to an Azure virtual machine from a malicious IP address is detected. Solution: You create a livestream from a query. Does this meet the goal?

Download SC-200 Sample Questions

Download up to 10 single-answer or multiple-answer questions with recorded answers from the latest five captured sessions. The sample uses questions from the free half first, then the paid half if needed.

Study Tools for Your SC-200 Preparation

Start with a sample, then choose the study tools that fit your revision. Paid access covers this exam for the duration of your selected plan.

Check Your Knowledge with Verified Answers

Work through questions checked by expert trainers before publication. Review your answers to identify what you understand and where to spend more time.

Practise Exam Timing in the Simulator

Use learning, practice or timed exam mode to build familiarity and work on pacing. Vendor-style layouts and supported interactions vary by exam.

Choose How You Read and Review

With paid access, display 6, 10, 25, 50 or 100 questions per page, choose a question range, focus on hot questions and show answers while reading.

Discuss Individual Questions

Ask about a question, compare perspectives and contribute an answer vote. Use the discussion to explore reasoning alongside the expert-reviewed answer.

Download Questions for Offline Revision

Try a PDF sample of up to 10 questions. Paid reading access also offers PDF export for supported single- and multiple-choice questions, answers and images. Interactive formats stay on the website.

Keep Track of Your Exam Access

Unlock the full question bank and simulation features without CAPTCHA checks. Find purchased exams, direct study links and expiry dates in your profile.

Security Operations Analyst Associate

SC-200 Exam Topics and Study Plan

Skills Covered by the Exam

Use these topics from the linked official guide to plan your preparation for SC-200. Check the current guide before booking, because objectives can change.

  • Manage a security operations environment40–45%
  • Respond to security incidents35–40%
  • Perform threat hunting20–25%

Official exam weights describe the vendor’s blueprint. They do not measure coverage in this question bank.

Recommended Experience Before You Start

Before preparing for SC-200, check Microsoft's current eligibility and experience guidance. Compare the published objectives with work you have completed and plan hands-on practice for gaps.

Plan Your Revision

Suggested preparation sequence; adjust the pace to your experience.

  1. 1

    Check the current objectives

    Make a checklist from the official SC-200 objectives and mark the skills you can already demonstrate.

  2. 2

    Build understanding

    Study one objective at a time. Use official documentation and practical exercises to work on gaps.

  3. 3

    Practise and review

    Use the SC-200 question library to check your understanding. Review why each answer is correct before moving on.

  4. 4

    Rehearse and revisit

    With paid access, run a timed simulation. Revisit weaker topics and repeat practical exercises before booking your exam.

Official Microsoft Study Resources

This date refers to the exam guide, not the review date of every question.

SC-200 Practice and Access FAQs

Understand review, study tools and access before choosing your next step.

Who verifies the questions and answers?

Subject matter expert trainers in each niche review every question and answer before it enters the ExamPrepare database. Answer votes and discussions add perspectives after publication; they do not replace this review. Learn more on our methodology page.

How closely does the simulator match an exam?

The simulator uses vendor-style layouts and supported question interactions to help you practise navigation and pacing. Choose learning, practice or timed exam mode. Formats vary by exam; try the five-question sample to see the experience available for your certification.

What are hot questions?

Hot questions help you prioritise questions with stronger reporting or answer-vote activity. In the reading library, the filter selects questions with at least three recorded sightings or at least three votes for an answer. It has no recency cutoff and does not predict your exam questions. Use it alongside weaker topics and the exam objectives.

Can I read questions without starting a simulation?

Yes. Paid reading access lets you display 6, 10, 25, 50 or 100 questions per page, select a question range, filter for hot questions and show answers while reading. Choose the simulator whenever you want a learning, practice or timed exam session.

Can I download questions and answers as a PDF?

Each exam overview offers a free PDF sample of up to 10 supported questions. With paid reading access, you can also export supported single- and multiple-choice questions with their answers and images. Interactive question formats need the website and are not included as interactive PDF exercises.

How do votes and discussions relate to verified answers?

SME trainers review the questions and answers before publication. Imported answer reports show aggregate responses, while on-site votes and comments reflect participation on ExamPrepare. Use discussion to compare reasoning and investigate disagreements; a majority vote alone does not prove an answer correct.

What does a purchase unlock?

A purchase unlocks the complete question bank for the selected exam, access without CAPTCHA checks, reading controls, supported PDF exports and full learning, practice and timed simulation features. It covers that exam for the duration of the plan you choose, rather than every certification in the catalogue.

Where can I find my purchased exams and expiry dates?

Sign in to the account used for your purchase and open your profile. Your purchased exam library shows study links and access expiry dates so you can return to an exam and check how much access time remains.

View all feature FAQs
bg

Find Your Next Certification Practice Exam

Choose your certification to explore verified answers, free question samples and exam simulations.