Free Microsoft SC-200 Practice Questions & Answers 2026 Part2 | Microsoft Security Operations Analyst

Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.You have a Microsoft 365 subscription.You have 1,000 Windows devices that have a third-party antivirus product installed and Microsoft Defender Antivirus in passive mode.You need to ensure that the devices are protected from malicious artifacts that were undetected by the third- party antivirus product.Solution: You configure Controlled folder access. Does this meet the goal?

Note: This section contains one or more sets of questions with the same scenario and problem. Eachquestion presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.You have a Microsoft 365 subscription.You have 1,000 Windows devices that have a third-party antivirus product installed and Microsoft Defender Antivirus in passive mode.You need to ensure that the devices are protected from malicious artifacts that were undetected by the third- party antivirus product.Solution: You enable automated investigation and response (AIR). Does this meet the goal?

Case studyThis is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However, there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions included on this exam in the time provided.To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is independent of the other questions in this case study.At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to the next section of the exam. After you begin a new section, you cannot return to this section.To start the case study To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem statements. If the case study has an All Information tab, note that the information displayed is identical to the information displayed on the subsequent tabs. When you are ready to answer a question, click the Question button to return to the question.OverviewFabrikam, Inc. is a financial services company.The company has branch offices in New York, London, and Singapore. Fabrikam has remote users located across the globe. The remote users access company resources, including cloud resources, by using a VPN connection to a branch office.Existing EnvironmentIdentity EnvironmentThe network contains an Active Directory Domain Services (AD DS) forest named fabrikam.com that syncs with an Azure AD tenant named fabrikam.com. To sync the forest, Fabrikam uses Azure AD Connect with pass-through authentication enabled and password hash synchronization disabled.The fabrikam.com forest contains two global groups named Group1 and Group2.Microsoft 365 EnvironmentAll the users at Fabrikam are assigned a Microsoft 365 E5 license and an Azure Active Directory Premium Plan 2 license.Fabrikam implements Microsoft Defender for Identity and Microsoft Defender for Cloud Apps and enables log collectors.Azure EnvironmentFabrikam has an Azure subscription that contains the resources shown in the following table.Amazon Web Services (AWS) EnvironmentFabrikam has an Amazon Web Services (AWS) account named Account1. Account1 contains 100 Amazon Elastic Compute Cloud (EC2) instances that run a custom Windows Server 2022. The image includes Microsoft SQL Server 2019 and does NOT have any agents installed.Current IssuesWhen the users use the VPN connections, Microsoft 365 Defender raises a high volume of impossible travel alerts that are false positives.Defender for Identity raises a high volume of Suspected DCSync attack alerts that are false positives.RequirementsPlanned changesFabrikam plans to implement the following services:Microsoft Defender for CloudMicrosoft SentinelBusiness RequirementsFabrikam identifies the following business requirements:Use the principle of least privilege, whenever possible.Minimize administrative effort.Microsoft Defender for Cloud Apps RequirementsFabrikam identifies the following Microsoft Defender for Cloud Apps requirements:Ensure that impossible travel alert policies are based on the previous activities of each user.Reduce the amount of impossible travel alerts that are false positives.Microsoft Defender for Identity RequirementsMinimize the administrative effort required to investigate the false positive alerts.Microsoft Defender for Cloud RequirementsFabrikam identifies the following Microsoft Defender for Cloud requirements:Ensure that the members of Group2 can modify security policies.Ensure that the members of Group1 can assign regulatory compliance policy initiatives at the Azure subscription level.Automate the deployment of the Azure Connected Machine agent for Azure Arc-enabled servers to the existing and future resources of Account1.Minimize the administrative effort required to investigate the false positive alerts.Microsoft Sentinel RequirementsFabrikam identifies the following Microsoft Sentinel requirements:Query for NXDOMAIN DNS requests from the last seven days by using built-in Advanced Security Information Model (ASIM) unifying parsers.From AWS EC2 instances, collect Windows Security event log entries that include local group membership changes.Identify anomalous activities of Azure AD users by using User and Entity Behavior Analytics (UEBA).Evaluate the potential impact of compromised Azure AD user credentials by using UEBA.Ensure that App1 is available for use in Microsoft Sentinel automation rules.Identify the mean time to triage for incidents generated during the last 30 days.Identify the mean time to close incidents generated during the last 30 days.Ensure that the members of Group1 can create and run playbooks.Ensure that the members of Group1 can manage analytics rules.Run hunting queries on Pool1 by using Jupyter notebooks.Ensure that the members of Group2 can manage incidents.Maximize the performance of data queries.Minimize the amount of collected data.You need to identify which mean time metrics to use to meet the Microsoft Sentinel requirements.Which workbook should you use?

Note: This section contains one or more sets of questions with the same scenario and problem. Eachquestion presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.You have a Microsoft 365 subscription.You have 1,000 Windows devices that have a third-party antivirus product installed and Microsoft Defender Antivirus in passive mode.You need to ensure that the devices are protected from malicious artifacts that were undetected by the third- party antivirus product.Solution: You enable automated investigation and response (AIR). Does this meet the goal?

Note: This section contains one or more sets of questions with the same scenario and problem. Eachquestion presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.You have a Microsoft 365 subscription.You have 1,000 Windows devices that have a third-party antivirus product installed and Microsoft Defender Antivirus in passive mode.You need to ensure that the devices are protected from malicious artifacts that were undetected by the third- party antivirus product.Solution: You enable automated investigation and response (AIR). Does this meet the goal?

You need to modify the anomaly detection policy settings to meet the Cloud App Security requirements. Which policy should you modify?

An engineer has mapped a volume to an existing Windows 2012 server. The engineer has configured zoning and confirmed that all paths are correctly configured.The operating system can only see one path within the MPIO software.Which step should the engineer take so that all paths are presented to the server?

You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR.You need to ensure that you can investigate threats by using data in the unified audit log of Microsoft Defender for Cloud Apps.What should you configure first?

You need to configure Microsoft Defender for Cloud Apps to generate alerts and trigger remediation actions in response to external sharing of confidential files.Which two actions should you perform in the Microsoft Defender for Cloud Apps portal? Each correct answer presents part of the solution.NOTE: Each correct selection is worth one point.

You have a Microsoft Sentinel workspace. You enable User and Entity Behavior Analytics (UFBA) by using Audit logs and Signin logs. The following entities are detected in the Azure AD tenant: * App name: App1 * IP address: 192.168.1.2 * Computer name: Device1 * Used client app: Microsoft Edge * Email address: user1@company.com * Sign-in URL: https://www.company.com Which entities can be investigated by using UEBA? Microsoft Sentinel UEBA (User and Entity Behavior Analytics) focuses on users and hosts (devices) and enriches data with contextual information. When enabling UEBA with Audit logs and Signin logs, the only entities supported for investigation are: User accounts (email addresses) Hosts or devices (including IP addresses) Other values like App name, Used client app, and Sign-in URL are attributes in log data but not tracked entities in UEBA investigations. Answe r: B. IP address and email address only

On the first day after the Storage Center is installed, the engineer begins copying data to it.The engineer uses the default Replay Profile and Data Progression settings. The engineernotices that the system did take replays, but no data has been restriped in Tier 1.What is the cause of the problem?

You have an Azure virtual machine named VM1 that runs Windows Server. You onboard VM1 to Microsoft Sentinel by connecting VM1 to a Log Analytics workspace. You plan to run an automated response playbook based on an Azure logic app named LA1 directly from an incident in Microsoft Sentinel. You discover that the playbook fails to run against VM1. You need to ensure that the playbook can successfully execute actions on VM1. The solution must minimize administrative effort. What should you do?

You have a Microsoft 365 subscription that uses Microsoft Defender XDR.You discover that when Microsoft Defender for Endpoint generates alerts for a commonly used executable file, it causes alert fatigue.You need to tune the alerts.Which two actions can an alert tuning rule perform for the alerts? Each correct answer presents a complete solution.NOTE: Each correct selection is worth one point.

You need to receive a security alert when a user attempts to sign in from a location that was never used by the other users in your organization to sign in.Which anomaly detection policy should you use?

An engineer has installed a Storage Array with a Tier 1 consisting of SSDs.What should the engineer do to optimize performance for I/O workloads utilizing this Tier?

You have a Microsoft 365 subscription that uses Microsoft Defender XDR.You are investigating an attacker that is known to use the Microsoft Graph API as an attack vector. The attacker performs the tactics shown the following table.You need to search for malicious activities in your organization.Which tactics can you analyze by using the MicrosoftGraphActivityLogs table?

You have a Microsoft 365 subscription that uses Microsoft Defender XDR.You need to implement deception rules. The solution must ensure that you can limit the scope of the rules. What should you create first?

You have an Azure subscription that contains an Azure logic app named app1 and a Microsoft Sentinel workspace that has an Azure AD connector. You need to ensure that app1 launches when Microsoft Sentinel detects an Azure AD-generated alert. What should you create first?

You need to minimize the effort required to investigate the Microsoft Defender for Identity false positive alerts. What should you review?

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.You use Azure Security Center.You receive a security alert in Security Center.You need to view recommendations to resolve the alert in Security Center.Solution: From Security alerts, you select the alert, select Take Action, and then expand the Prevent future attacks section.Does this meet the goal?

You have the following advanced hunting query in Microsoft Defender XDR.You need to receive an alert when any process disables System Restore on a device managed by Microsoft Defender XDR during the last 24 hours.Which two actions should you perform? Each correct answer presents part of the solution.NOTE: Each correct selection is worth one point.

You need to receive a security alert when a user attempts to sign in from a location that was never used by the other users in your organization to sign in.Which anomaly detection policy should you use?

You have an Azure subscription that uses Microsoft Defender for Endpoint.You need to ensure that you can allow or block user-specified IP addresses and URLs.What should you enable first in the Advanced features from the Endpoints Settings in the Microsoft Defender portal?

You are investigating a potential attack that deploys a new ransomware strain.You have three custom device groups. The groups contain devices that store highly sensitive information.You plan to perform automated actions on all devices.You need to be able to temporarily group the machines to perform actions on the devices.Which three actions should you perform? Each correct answer presents part of the solution.NOTE: Each correct selection is worth one point.

You have a Microsoft 365 subscription that uses Microsoft Defender for Endpoint.You need to add threat indicators for all the IP addresses in a range of 171.23.34.32-171.23.34.63. The solution must minimize administrative effort.What should you do in the Microsoft 365 Defender portal?

The issue for which team can be resolved by using Microsoft Defender for Office 365?

You have an existing Azure logic app that is used to block Azure Active Directory (Azure AD) users. The logic app is triggered manually. You deploy Azure Sentinel. You need to use the existing logic app as a playbook in Azure Sentinel. What should you do first? In Microsoft Sentinel, playbooks are Azure Logic Apps that automate responses to alerts or incidents. To use an existing Logic App as a playbook in Sentinel, it must start with the ''Microsoft Sentinel alert'' trigger. This trigger allows Sentinel to call and pass alert details to the Logic App automatically. When an existing Logic App has a manual trigger, it cannot be invoked directly by Sentinel. Therefore, the first step is to modify the trigger to replace the manual trigger with the ''When a response to an Azure Sentinel alert is triggered'' trigger. After that, you can link it within Sentinel incidents or automation rules. This process is detailed in Microsoft Defender XDR and Sentinel documentation under ''Connect a Logic App to Sentinel as a playbook.'' Hence, the correct answer is D. Modify the trigger in the logic app.

An engineer needs to use a set of commands to initialize a new SC8000 with serial numbers 12345 & 12346 from the CLI.Which initial set of commands should the engineer choose?

How are replay scheduling rules applied to a particular volume?

You have the following advanced hunting query in Microsoft 365 Defender.You need to receive an alert when any process disables System Restore on a device managed by Microsoft Defender during the last 24 hours.Which two actions should you perform? Each correct answer presents part of the solution.NOTE: Each correct selection is worth one point.

You have a Microsoft 365 subscription that uses Microsoft Defender for Office 365.You have Microsoft SharePoint Online sites that contain sensitive documents. The documents contain customer account numbers that each consists of 32 alphanumeric characters.You need to create a data loss prevention (DLP) policy to protect the sensitive documents.What should you use to detect which documents are sensitive?

A storage array is configured with four front-end ports on each controller (in a dual-controller configuration) for server connectivity. The storage array runs in Legacy Portmode. An engineer needs to provide multi-pathed (2 fabrics) connectivity from the storagearray to the server.What is the minimum number of fault domains required?

The issue for which team can be resolved by using Microsoft Defender for Office 365?

You have a third-party security information and event management (SIEM) solution.You need to ensure that the SIEM solution can generate alerts for Azure Active Directory (Azure AD) sign- events in near real time.What should you do to route events to the SIEM solution?

You create a hunting query in Azure Sentinel.You need to receive a notification in the Azure portal as soon as the hunting query detects a match on the query. The solution must minimize effort.What should you use?

You receive an alert from Azure Defender for Key Vault. You discover that the alert is generated from multiple suspicious IP addresses. You need to reduce the potential of Key Vault secrets being leaked while you investigate the issue. The solution must be implemented as soon as possible and must minimize the impact on legitimate users. What should you do first? When Azure Defender for Key Vault (now part of Microsoft Defender for Cloud) raises an alert about suspicious access attempts from multiple unknown IP addresses, the immediate mitigation step---before deeper investigation---is to restrict network access to the Key Vault to reduce exposure. The Azure Key Vault firewall allows you to restrict access by: Allowing access only from trusted IP addresses, VNets, or private endpoints. Blocking all other traffic by enabling the firewall and disabling ''Allow access from all networks.'' Microsoft's official recommendation states: ''To reduce the likelihood of secrets being compromised while you investigate an alert, enable the Key Vault firewall and restrict access to trusted networks or specific virtual networks.'' ''Firewall and virtual network configuration can be applied immediately without affecting existing permissions or access policies.'' This step: Minimizes exposure to malicious IP addresses. Is quick to implement (through the Azure Portal or CLI). Has minimal impact on legitimate users if you properly whitelist trusted networks or VNets. Other options: A (Modify access control settings) or D (Modify access policy) would affect permissions and could disrupt legitimate users or service principals. C (Create an application security group) applies to network interfaces, not directly to Key Vault. Answe r: B. Enable the Key Vault firewall