Microsoft Security Operations Analyst (SC-200) Exam Practice Questions & Study Guide 2026

Question 1

You have an on-premises virtual machine named VM1 that runs Windows Server. You have a Microsoft Sentinel workspace named Workspacel. You install the Azure Connected Machine agent on VM1. You need to collect events from VM1 and send the events to Workspacel. Which two actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct answer is worth one point. 

A. From the Microsoft Defender portal, add the Windows Security Events via AMA data connector.
 B. From the Microsoft Defender portal, add the Syslog via AMA data connector. 
C. On VM1, install the Log Analytics agent. 
D. On VM1, enable the Azure Monitor Agent extensions. 
E. On VM1, install the Microsoft Monitonng Agent. 
F. From the Microsoft Defender portal, create a data collection rule (DCR) that targets VM1.

Show Answer

Question 2

You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR and contains a user named User1. You need to ensure that User1 can manage Microsoft Defender XDR custom detection rules and Endpoint security policies. The solution must follow the principle of least privilege. Which role should you assign to User1?

A. Desktop Analytics Administrator 
B. Security Operator 
C. Security Administrator 
D. Cloud Device Administrator 

Show Answer

Question 3

Your company stores the data of every project in a different Azure subscription. All the subscriptions use the same Microsoft Entra tenant. Every project consists of multiple Azure virtual machines that run Windows Server. The Windows events of the virtual machines are stored in a Log Analytics workspace in each machine's respective subscription. You deploy Microsoft Sentinel to a new Azure subscription. You need to perform hunting queries in Microsoft Sentinel to search across all the Log Analytics workspaces of all the subscriptions. Which two actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point. 

A. Create a query that uses the resource expression and the alias operator.
 B. Use the alias statement. 
C. Add the Microsoft Sentinel solution to each workspace. 
D. Create a query that uses the workspace expression and the union operator. 
E. Add the Security Events connector to the Microsoft Sentinel workspace. 

Show Answer

Question 4

You have a Microsoft 365 E5 subscription that contains a database server named DB1. DB1 is onboarded to Microsoft Defender XDR. You need to ensure that DB1 appears on the attack surface map. What should you configure? 

A. a critical asset rule 
B. an asset rule 
C. a honeytoken entity tag 
D. a sensitive entity tag 

Show Answer

Question 5

You have a Microsoft 365 E5 subscription. You need to search the Microsoft Purview audit log by using PowerShell on a Windows device. What should you do first?

A. Modify the TrustedHosts list 
B. Install the Microsoft Exchange Online PowerShell module. 
C. Install the Microsoft Graph PowerShell module. 
D. Enable PowerShell remoting. 

Show Answer

Question 6

You have a Microsoft 365 subscription that uses Microsoft Defender for Endpoint Plan 2 and contains 500 Windows devices. As part of an incident investigation, you identify the following suspected malware files: • sys • pdf • docx • xlsx You need to create indicator hashes to block users from downloading the files to the devices. Which files can you block by using the indicator hashes?

A. File1.sysonly 
B. File1.sysand File3.docxonly 
C. File1.sys. File3.docx, and File4jclsx only 
D. File2.pdf. File3.docxr and File4.xlsx only 
E. File1.sys, File2.pdf, File3.dooc, and File4.xlsx 

Show Answer

Question 7

You need to update the threat intelligence list to include the entities. Which entities can you add on the Incident page?

A. 175.45.176.99 only 
B. Host1 only 
C. Used only 
D. 175.45.176.99 and Host1 only 
E. Host1 and User1 only 
F. 175.45.176.99, Host1, and User1 

Show Answer

Question 8

You have an Azure subscription that uses Microsoft Defender XDR. From the Microsoft Defender portal, you perform an audit search and export the results as a file named Filel.csv that contains 10,000 rows. You use Microsoft Excel to perform Get & Transform Data operations to parse the AuditData column from Filel.csv. The operations fail to generate columns for specific JSON properties. You need to ensure that Excel generates columns for the specific JSON properties in the audit search results. Solution: From Defender, you modify the search criteria of the audit search to reduce the number of returned records, and then you export the results. From Excel, you perform the Get & Transform Data operations by using the new export. Does this meet the requirement? 

A. Yes
 B. No 

Show Answer

Question 9

You have an Azure subscription that uses Microsoft Defender for Cloud. You have an Amazon Web Services (AWS) account that contains an Amazon Elastic Compute Cloud (EC2) instance named EC2-1. You need to onboard EC2-1 to Defender for Cloud. What should you install on EC2-1?

A. the Log Analytics agent 
B. the Azure Connected Machine agent 
C. the unified Microsoft Defender for Endpoint solution package 
D. Microsoft Monitoring Agent 

Show Answer

Question 10

You have an Azure subscription that uses Microsoft Defender for Cloud. You need to configure Defender for Cloud to mitigate the following risks: • Vulnerabilities within the application source code • Exploitation toolkits in declarative templates • Operations from malicious IP addresses • Exposed secrets Which two Defender for Cloud services should you use? Each correct answer presents part of the solution. NOTE: Each correct answer is worth one point.

A. Microsoft Defender for APIs 
B. Microsoft Defender for Resource Manager 
C. Microsoft Defender for App Service 
D. Microsoft Defender for DevOps 
E. Microsoft Defender for Servers 

Show Answer