Free Microsoft SC-200 Practice Questions & Answers 2026 Part1 | Microsoft Security Operations Analyst

You have a Microsoft 365 E5 subscription that uses Microsoft SharePoint Online.You delete users from the subscription.You need to be notified if the deleted users downloaded numerous documents from SharePoint Online sites during the month before their accounts were deleted.What should you use?

Your company uses Microsoft Defender XDR. You need to use Microsoft Defender XDR deception rules to detect attacks as early as possible. What Microsoft Defender XDR service should you use to create the deception rules?

Note: This section contains one or more sets of questions with the same scenario and problem. Eachquestion presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.You have a Microsoft 365 subscription.You have 1,000 Windows devices that have a third-party antivirus product installed and Microsoft Defender Antivirus in passive mode.You need to ensure that the devices are protected from malicious artifacts that were undetected by the third- party antivirus product.Solution: You enable automated investigation and response (AIR). Does this meet the goal?

You have a Microsoft 365 E5 subscription that contains 100 Windows 10 devices. You onboard the devices to Microsoft Defender 365.You need to ensure that you can initiate remote shell connections to the onboarded devices from the Microsoft 365 Defender portal.What should you do first?

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.You are configuring Microsoft Defender for Identity integration with Active Directory.From the Microsoft Defender portal, you need to configure several accounts for attackers to exploit. Solution: You add each account as a Sensitive account.Does this meet the goal?

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.You are configuring Microsoft Defender for Identity integration with Active Directory.From the Microsoft Defender portal, you need to configure several accounts for attackers to exploit. Solution: From Microsoft Entra ID Protection, you configure the sign-in risk policy.Does this meet the goal?

You have a Microsoft 365 subscription that uses Microsoft 365 Defender.A remediation action for an automated investigation quarantines a file across multiple devices. You need to mark the file as safe and remove the file from quarantine on the devices.What should you use in the Microsoft 365 Defender portal?

You need to configure Microsoft Defender for Cloud Apps to generate alerts and trigger remediation actions in response to external sharing of confidential files.Which two actions should you perform in the Microsoft Defender portal? Each correct answer presents part of the solution.NOTE: Each correct selection is worth one point.

What are two 1 Gb iSCSI best practices to set up and-to-end connectivity (servers, switch,and storage)? (Choose two.)

You have a Microsoft 365 E5 subscription that contains a database server named DB1. DB1 is onboarded to Microsoft Defender XDR.You need to ensure that DB1 appears on the attack surface map.What should you configure?

You need to configure event monitoring for Server1. The solution must meet the Microsoft Sentinel requirements. What should you create first?

Which rule setting should you configure to meet the Microsoft Sentinel requirements?

You need to modify the anomaly detection policy settings to meet the Microsoft Defender for Cloud Apps requirements and resolve the reported problem.Which policy should you modify?

You have an Azure subscription that uses Microsoft Defender for Endpoint. You need to ensure that you can allow or block a user-specified range of IP addresses and URLs. What should you enable first in the advanced features from the Endpoints Settings in the Microsoft 365 Defender portal?

You have a hybrid environment that includes an on-premises Active Directory Domain Services (AD DS) domain, a Microsoft Entra tenant, and a Microsoft 365 E5 subscription. All Windows 11 devices are onboarded to Microsoft Defender for Endpoint. You deploy Microsoft Defender for Identity sensors to domain controllers. You need to enable automatic attack disruption in Microsoft Defender XDR. The solution must meet the following requirements: - During an active attack, affected devices must be contained automatically, and compromised user accounts must be disabled. - User disruptions must be minimized. What should you configure?

An engineer has installed an SC4020 with four FC ports in each controller. This is a dual-fabric installation with four FC connections in each server. The servers use the OS built-inmulti-pathing capabilities.Which two configurations will cause the controller failover to fail? (Choose two.)

You have a Microsoft 365 subscription that uses Microsoft Defender XDR.You need to implement deception rules. The solution must ensure that you can limit the scope of the rules. What should you create first?

Case studyThis is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However, there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions included on this exam in the time provided.To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is independent of the other questions in this case study.At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to the next section of the exam. After you begin a new section, you cannot return to this section.To start the case study To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem statements. If the case study has an All Information tab, note that the information displayed is identical to the information displayed on the subsequent tabs. When you are ready to answer a question, click the Question button to return to the question.OverviewAdatum Corporation is a United States-based financial services company that has regional offices in New York, Chicago, and San Francisco.Existing EnvironmentIdentity EnvironmentThe on-premises network contains an Active Directory Domain Services (AD DS) forest named corp.adatum.com that syncs with an Azure AD tenant named adatum.com. All user and group management tasks are performed in corp.adatum.com. The corp.adatum.com domain contains a group named Group1 that syncs with adatum.com.Licensing StatusAll the users at Adatum are assigned a Microsoft 365 ES license and an Azure Active Directory Premium P2 license.Cloud EnvironmentThe cloud environment contains a Microsoft 365 subscription, an Azure subscription linked to the adatum.com tenant, and the resources shown in the following table.On-premises EnvironmentThe on-premises network contains the resources shown in the following table.RequirementsPlanned changesAdatum plans to perform the following changes:Implement a query named rulequery1 that will include the following KQL query.Implement a Microsoft Sentinel scheduled rule that generates incidents based on rulequery1.Microsoft Defender for Cloud RequirementsAdatum identifies the following Microsoft Defender for Cloud requirements:The members of Group1 must be able to enable Defender for Cloud plans and apply regulatory compliance initiatives.Microsoft Defender for Servers Plan 2 must be enabled on all the Azure virtual machines.Server2 must be excluded from agentless scanning.Microsoft Sentinel RequirementsAdatum identifies the following Microsoft Sentinel requirements:Implement an Advanced Security Information Model (ASIM) query that will return a count of DNS requests that results in an NXDOMAIN response from Infoblox1.Ensure that multiple alerts generated by rulequery1 in response to a single user launching Azure Cloud Shell multiple times are consolidated as a single incident.Implement the Windows Security Events via AMA connector for Microsoft Sentinel and configure it to monitor the Security event log of Server1.Ensure that incidents generated by rulequery1 are closed automatically if Azure Cloud Shell is launched by the companys SecOps team.Implement a custom Microsoft Sentinel workbook named Workbook1 that will include a query to dynamically retrieve data from Webapp1.Implement a Microsoft Sentinel near-real-time (NRT) analytics rule that detects sign-ins to a designated break glass account.Ensure that HuntingQuery1 runs automatically when the Hunting page of Microsoft Sentinel in the Azure portal is accessed.Ensure that higher than normal volumes of password resets for corp.adatum.com user accounts are detected.Minimize the overhead associated with queries that use ASIM parsers.Ensure that the Group1 members can create and edit playbooks.Use built-in ASIM parsers whenever possible.Business RequirementsAdatum identifies the following business requirements:Follow the principle of least privilege whenever possible.Minimize administrative effort whenever possible.You need to ensure that the processing of incidents generated by rulequery1 meets the Microsoft Sentinel requirements.What should you create first?

You have a Microsoft 365 E5 subscription that contains 100 Linux devices. The devices are onboarded to Microsoft Defender XDR.You need to initiate the collection of investigation packages from the devices by using the Microsoft Defenderportal.Which response action should you use?

According to the best practices, what are the correct values for the following parameters on a QLogic HBA?

You have a Microsoft 365 subscription that uses Microsoft Defender for Endpoint. You need to add threat indicators for all the IP addresses in a range of 171.23.3432-171.2334.63. The solution must minimize administrative effort. What should you do in the Microsoft 365 Defender portal? This will add all the IP addresses in the range of 171.23.34.32/27 as threat indicators. This is the simplest and most efficient way to add all the IP addresses in the range.

An engineer needs to configure a VMware host. According to best practice, the engineer needs to enable a feature by changing the variables QFullSampleSize and QFullThreshold. The engineer sets those two parameters to the value of 0 in VMware ESXi 5.1 Patch 1 and later versions.Which feature is enabled?

An engineer receives an alert that the Storage Center has entered Conservation mode.How should the engineer respond to the alert?

Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.You have a Microsoft 365 subscription.You have 1,000 Windows devices that have a third-party antivirus product installed and Microsoft Defender Antivirus in passive mode.You need to ensure that the devices are protected from malicious artifacts that were undetected by the third- party antivirus product.Solution: You configure Controlled folder access. Does this meet the goal?

Your company has an on-premises network that uses Microsoft Defender for Identity.The Microsoft Secure Score for the company includes a security assessment associated with unsecure Kerberos delegation.You need remediate the security risk. What should you do?

Your organization has a Microsoft 365 subscription and uses Microsoft Defender XDR and Microsoft Purview. You need to identify all the changes made to sensitivity labels during the past seven days.What should you use?

You have a Microsoft 365 subscription that uses Microsoft 365 Defender. You plan to create a hunting query from Microsoft Defender.You need to create a custom tracked query that will be used to assess the threat status of the subscription. From the Microsoft 365 Defender portal, which page should you use to create the query?

During failover testing, an engineer finds that the iSCSI connection failed over properlywhen a physical link was disconnected. The FC connection did NOT failover when aphysical link was disconnected.Which configuration is causing this issue?

You receive a security bulletin about a potential attack that uses an image file.You need to create an indicator of compromise (IoC) in Microsoft Defender for Endpoint to prevent the attack. Which indicator type should you use?

You have a Microsoft 365 subscription that uses Microsoft Defender XDR.You need to implement deception rules. The solution must ensure that you can limit the scope of the rules. What should you create first?

You need to recommend a solution to meet the technical requirements for the Azure virtual machines. What should you include in the recommendation?

You have a Microsoft 365 E5 subscription that uses Microsoft Defender for Endpoint.You need to create a query that will link the AlertInfo, AlertEvidence, and DeviceLogonEvents tables. The solution must return all the rows in the tables.Which operator should you use?

You are investigating a potential attack that deploys a new ransomware strain.You have three custom device groups. The groups contain devices that store highly sensitive information. You plan to perform automated actions on all devices.You need to be able to temporarily group the machines to perform actions on the devices. Which three actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.You are configuring Microsoft Defender for Identity integration with Active Directory.From the Microsoft Defender portal, you need to configure several accounts for attackers to exploit. Solution: You add the accounts to an Active Directory group and add the group as a Sensitive group. Does this meet the goal?

You have an Azure subscription that uses Microsoft Sentinel and contains 100 Linux virtual machines. You need to monitor the virtual machines by using Microsoft Sentinel. The solution must meet the fallowing requirements: * Minimize administrative effort * Minimize the parsing required to read log data What should you configure?

Your company uses line-of-business apps that contain Microsoft Office VBA macros.You plan to enable protection against downloading and running additional payloads from the Office VBA macros as additional child processes.You need to identify which Office VBA macros might be affected.Which two commands can you run to achieve the goal? Each correct answer presents a complete solution.NOTE: Each correct selection is worth one point.