Questions & answers (free, no sign-in needed)

10 beginner questions on the SC-200 skills measured: Sentinel automation rules, playbooks, NRT analytics rules and data connectors (Manage a security operations environment); Defender XDR incidents, device response actions and Microsoft Purview Audit (Respond to security incidents); and advanced hunting with KQL (Perform threat hunting).

Ready to test yourself? Take the graded Beginner test (free; sign in with Google, one click) to get your score.

1. A SOC team wants every new Microsoft Sentinel incident from one analytics rule to be assigned to a specific analyst and tagged automatically, using a simple rule-based setting rather than building a workflow. What should the team configure?

   • A. A workbook that filters incidents by rule name
   • B. A watchlist that lists the analyst and the tag
   • C. An automation rule triggered when an incident is created ✔ correct
   • D. A data collection rule on the Log Analytics workspace

   Answer: C. Automation rules handle incident triage centrally: they can assign owners, change status or severity, add tags and run playbooks. Workbooks visualize data, watchlists hold reference data and data collection rules control ingestion.

   Source: learn.microsoft.com/en-us/azure/sentinel/automate-incident-handling-with-automat · Domain: Manage a security operations environment

2. Which type of Microsoft Sentinel analytics rule is hard-coded to run its query once every minute for the fastest detection?

   • A. Near-real-time (NRT) rule ✔ correct
   • B. Scheduled rule with a daily frequency
   • C. Anomaly rule
   • D. Threat intelligence rule

   Answer: A. NRT rules run once every minute and look at events ingested in the preceding minute. Scheduled rules run on a configurable interval with a built-in delay, so they are not the fastest option.

   Source: learn.microsoft.com/en-us/azure/sentinel/near-real-time-rules · Domain: Manage a security operations environment

3. An organization wants to send Windows Security event logs from its Windows servers to Microsoft Sentinel by using the Azure Monitor Agent. Which data connector should it use?

   • A. Syslog via AMA
   • B. Common Event Format (CEF) via AMA
   • C. Microsoft Entra ID
   • D. Windows Security Events via AMA ✔ correct

   Answer: D. The Windows Security Events via AMA connector uses the Azure Monitor Agent and a data collection rule to choose which security events to collect. Syslog and CEF connectors are for Linux and network devices.

   Source: learn.microsoft.com/en-us/azure/sentinel/connect-services-windows-based · Domain: Manage a security operations environment

4. Microsoft Sentinel playbooks are automated workflows built on Azure Logic Apps.

   • A. True ✔ correct
   • B. False

   Answer: A. True. Playbooks are Logic Apps workflows that run remediation steps, such as blocking a user or opening a ticket. They can run manually or from an automation rule, and Logic Apps charges can apply.

   Source: learn.microsoft.com/en-us/azure/sentinel/automation/automate-responses-with-play · Domain: Manage a security operations environment

5. An analyst confirms that a laptop onboarded to Microsoft Defender for Endpoint is compromised and wants to stop lateral movement and data exfiltration immediately. Which response action should the analyst take on the device page?

   • A. Run antivirus scan
   • B. Isolate device ✔ correct
   • C. Add a device tag
   • D. Collect investigation package

   Answer: B. Isolating the device cuts it off from the network to prevent attacker control, lateral movement and exfiltration, while Defender for Endpoint can still manage it. A scan or package collection does not contain the threat.

   Source: learn.microsoft.com/en-us/defender-endpoint/respond-machine-alerts · Domain: Respond to security incidents

6. Which two response actions are available on a device page in Microsoft Defender for Endpoint? (Select TWO)

   • A. Initiate a live response session ✔ correct
   • B. Create a new Microsoft Sentinel workspace
   • C. Restrict app execution ✔ correct
   • D. Publish a Power BI app to the SOC
   • E. Change the tenant's Conditional Access policies

   Answer: A, C. Device response actions include live response, collecting an investigation package, running an antivirus scan, restricting app execution and isolating the device. Workspaces, Power BI apps and Conditional Access are managed elsewhere.

   Source: learn.microsoft.com/en-us/defender-endpoint/respond-machine-alerts · Domain: Respond to security incidents

7. During an investigation, an analyst must find out which user deleted files in SharePoint Online and when. Which Microsoft solution records these user and admin activities for investigation?

   • A. Microsoft Purview Compliance Manager
   • B. Microsoft Defender for Cloud secure score
   • C. Microsoft Purview Audit ✔ correct
   • D. Azure Monitor workbooks

   Answer: C. Microsoft Purview Audit records user and admin activities across Microsoft 365 services, so you can search for actions such as file deletions. Compliance Manager tracks compliance controls, not individual user activity.

   Source: learn.microsoft.com/en-us/purview/audit-solutions-overview · Domain: Respond to security incidents

8. In the Microsoft Defender portal, what is an incident?

   • A. A single suspicious event raised by one detection
   • B. A daily report of every device's health status
   • C. A KQL query saved for later threat hunting
   • D. A collection of related alerts that tells the story of an attack ✔ correct

   Answer: D. Alerts are individual detection signals. Defender correlates related alerts, from Defender products and Sentinel, into incidents so analysts can investigate the whole attack story in one place.

   Source: learn.microsoft.com/en-us/defender-xdr/incidents-overview · Domain: Respond to security incidents

9. A security analyst wants to proactively search raw endpoint, email and identity events from the last 30 days for signs of a new attack technique. Which Defender XDR capability should the analyst use?

   • A. Advanced hunting with Kusto Query Language (KQL) ✔ correct
   • B. Microsoft Secure Score recommendations
   • C. Attack simulation training campaigns
   • D. Device health and compliance reports

   Answer: A. Advanced hunting is a query-based tool that explores up to 30 days of raw Defender XDR data by using KQL, or a guided query builder. The same queries can become custom detection rules.

   Source: learn.microsoft.com/en-us/defender-xdr/advanced-hunting-overview · Domain: Perform threat hunting

10. In advanced hunting, the DeviceProcessEvents table contains information about process creation and related events on devices.

    • A. True ✔ correct
    • B. False

    Answer: A. True. DeviceProcessEvents holds process creation data, such as the file name and command line, which makes it a common starting table when hunting for malicious processes.

    Source: learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceprocessevents-tabl · Domain: Perform threat hunting

Original practice questions written by xOps School (DevOpsSchool Private Limited) from the public Microsoft exam objectives (SC-200 skills measured as of 2026-10-21), checked 2026-10-25. They are not actual exam questions. xOps School is not affiliated with or endorsed by Microsoft; exam names are trademarks of their owners. Official exam page: learn.microsoft.com/en-us/credentials/certifications/security-operatio.