Free Microsoft SC-200 Practice Questions & Answers 2026 Part3 | Microsoft Security Operations Analyst

You have a Microsoft 365 E5 subscription that is linked to a hybrid Microsoft Entra tenant. You need to identify all the changes made to Domain Admins group during the past 30 days. What should you use?

An engineer updates the SCOS version from 6.5.x to 6.6.x on an SC4020 via ISO. Theengineer uses the following credentials: admin / admin. The engineer calls Dell Support forfinal health checks and is informed that a newer SCOS 6.6.x version is available. Theengineer tries to perform another ISO update to the newest SCOS 6.6.x version. Theengineer is unable to log back in to the BMC interface to start the ISO update.What should the engineer do to update the newest SCOS version via ISO?

Your company uses Microsoft Defender for Endpoint.The company has Microsoft Word documents that contain macros. The documents are used frequently on the devices of the company's accounting team.You need to hide false positive in the Alerts queue, while maintaining the existing security posture.Which three actions should you perform? Each correct answer presents part of the solution.NOTE: Each correct selection is worth one point.

Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.You have a Microsoft 365 subscription.You have 1,000 Windows devices that have a third-party antivirus product installed and Microsoft Defender Antivirus in passive mode.You need to ensure that the devices are protected from malicious artifacts that were undetected by the third- party antivirus product.Solution: You configure Controlled folder access. Does this meet the goal?

Case studyThis is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However, there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions included on this exam in the time provided.To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is independent of the other questions in this case study.At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to the next section of the exam. After you begin a new section, you cannot return to this section.To start the case study To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem statements. If the case study has an All Information tab, note that the information displayed is identical to the information displayed on the subsequent tabs. When you are ready to answer a question, click the Question button to return to the question.OverviewAdatum Corporation is a United States-based financial services company that has regional offices in New York, Chicago, and San Francisco.Existing EnvironmentIdentity EnvironmentThe on-premises network contains an Active Directory Domain Services (AD DS) forest named corp.adatum.com that syncs with an Azure AD tenant named adatum.com. All user and group management tasks are performed in corp.adatum.com. The corp.adatum.com domain contains a group named Group1 that syncs with adatum.com.Licensing StatusAll the users at Adatum are assigned a Microsoft 365 ES license and an Azure Active Directory Premium P2 license.Cloud EnvironmentThe cloud environment contains a Microsoft 365 subscription, an Azure subscription linked to the adatum.com tenant, and the resources shown in the following table.On-premises EnvironmentThe on-premises network contains the resources shown in the following table.RequirementsPlanned changesAdatum plans to perform the following changes:Implement a query named rulequery1 that will include the following KQL query.Implement a Microsoft Sentinel scheduled rule that generates incidents based on rulequery1.Microsoft Defender for Cloud RequirementsAdatum identifies the following Microsoft Defender for Cloud requirements:The members of Group1 must be able to enable Defender for Cloud plans and apply regulatory compliance initiatives.Microsoft Defender for Servers Plan 2 must be enabled on all the Azure virtual machines.Server2 must be excluded from agentless scanning.Microsoft Sentinel RequirementsAdatum identifies the following Microsoft Sentinel requirements:Implement an Advanced Security Information Model (ASIM) query that will return a count of DNS requests that results in an NXDOMAIN response from Infoblox1.Ensure that multiple alerts generated by rulequery1 in response to a single user launching Azure Cloud Shell multiple times are consolidated as a single incident.Implement the Windows Security Events via AMA connector for Microsoft Sentinel and configure it to monitor the Security event log of Server1.Ensure that incidents generated by rulequery1 are closed automatically if Azure Cloud Shell is launched by the companys SecOps team.Implement a custom Microsoft Sentinel workbook named Workbook1 that will include a query to dynamically retrieve data from Webapp1.Implement a Microsoft Sentinel near-real-time (NRT) analytics rule that detects sign-ins to a designated break glass account.Ensure that HuntingQuery1 runs automatically when the Hunting page of Microsoft Sentinel in the Azure portal is accessed.Ensure that higher than normal volumes of password resets for corp.adatum.com user accounts are detected.Minimize the overhead associated with queries that use ASIM parsers.Ensure that the Group1 members can create and edit playbooks.Use built-in ASIM parsers whenever possible.Business RequirementsAdatum identifies the following business requirements:Follow the principle of least privilege whenever possible.Minimize administrative effort whenever possible.You need to ensure that the Group1 members can meet the Microsoft Sentinel requirements.Which role should you assign to Group1?

You have a Microsoft 365 E5 subscription that uses Microsoft SharePoint Online. You delete users from the subscription.You need to be notified if the deleted users downloaded numerous documents from SharePoint Online sites during the month before their accounts were deleted.What should you use?

You have an Azure subscription that uses Microsoft Defender for Servers Plan 1 and contains a server named Server1.You enable agentless scanning.You need to prevent Server1 from being scanned. The solution must minimize administrative effort. What should you do?

The SAS chain starts in port 1 controller 1 and ends at controller 2 at port 3.What are the correct connections in a 4-port SAS IO card?

You have a Microsoft 365 subscription that uses Microsoft Defender for Office 365.You have Microsoft SharePoint Online sites that contain sensitive documents. The documents contain customer account numbers that each consists of 32 alphanumeric characters.You need to create a data loss prevention (DLP) policy to protect the sensitive documents. What should you use to detect which documents are sensitive?

When replacing a defective SC4020 controller with a new controller, the engineer noticesthat the new controller does NOT fully initialize. The system runs SCOS version 6.5.30.Which three actions should the engineer take? (Choose three.)

You have a Microsoft 365 subscription that uses Microsoft 365 Defender. You need to identify all the entities affected by an incident.Which tab should you use in the Microsoft 365 Defender portal?

You have a Microsoft 365 subscription. The subscription uses Microsoft Purview and has data loss prevention (DLP) policies that have aggregated alerts configured.You need to identify the impacted entities in an aggregated alert.What should you review in the DLP alert management dashboard of the Microsoft Purview compliance portal?

You have a Microsoft 365 subscription that uses Microsoft Defender for Office 365.You have Microsoft SharePoint Online sites that contain sensitive documents. The documents contain customer account numbers that each consists of 32alphanumeric characters.You need to create a data loss prevention (DLP) policy to protect the sensitive documents.What should you use to detect which documents are sensitive?

You have a Microsoft Sentinel workspace named Workspace1. Workspace1 contains a table named Table1 that stores security events from a custom application. Table1 is used by the analytics rules in Microsoft Sentinel to generate incidents. You discover that the security events in Table1 are inaccurate. You need to ensure that future incidents are NOT generated by the analytics rules until the security events in Table1 are resolved. The solution must minimize effort. What should you do in Microsoft Sentinel?

Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.You have a Microsoft 365 subscription.You have 1,000 Windows devices that have a third-party antivirus product installed and Microsoft Defender Antivirus in passive mode.You need to ensure that the devices are protected from malicious artifacts that were undetected by the third- party antivirus product.Solution: You configure Controlled folder access. Does this meet the goal?

You have a Microsoft 365 subscription that uses Microsoft Defender XDR.You discover that when Microsoft Defender for Endpoint generates alerts for a commonly used executable file, it causes alert fatigue.You need to tune the alerts.Which two actions can an alert tuning rule perform for the alerts? Each correct answer presents a complete solution.NOTE: Each correct selection is worth one point.

The issue for which team can be resolved by using Microsoft Defender for Endpoint?

You create an Azure subscription named sub1. In sub1, you create a Log Analytics workspace named workspace1. You enable Azure Security Center and configure Security Center to use workspace1. You need to ensure that Security Center processes events from the Azure virtual machines that report to workspace1. What should you do?

Your company uses Microsoft Defender for Endpoint.The company has Microsoft Word documents that contain macros. The documents are used frequently on the devices of the company’s accounting team.You need to hide false positive in the Alerts queue, while maintaining the existing security posture. Which three actions should you perform? Each correct answer presents part of the solution.NOTE: Each correct selection is worth one point.

You have a Microsoft 365 subscription that contains a user named User1. You need to identify whether User1 signed in to Microsoft 365 and shared a document stored in Microsoft OneDrive during the last 30 days. What should you use?

You need to receive a security alert when a user attempts to sign in from a location that was never used by the other users in your organization to sign in.Which Microsoft Defender for Cloud Apps anomaly detection policy should you use?

You are configuring Microsoft Defender for Cloud Apps.You have a custom threat detection policy based on the IP address ranges of your company’s United States- based offices.You receive many alerts related to impossible travel and sign-ins from risky IP addresses. You determine that 99% of the alerts are legitimate sign-ins from your corporate offices. You need to prevent alerts for legitimate sign-ins from known locations.Which two actions should you perform? Each correct answer presents part of the solution.NOTE: Each correct selection is worth one point.

Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.You have a Microsoft 365 subscription.You have 1,000 Windows devices that have a third-party antivirus product installed and Microsoft Defender Antivirus in passive mode.You need to ensure that the devices are protected from malicious artifacts that were undetected by the third- party antivirus product.Solution: You configure endpoint detection and response (EDR) in block mode. Does this meet the goal?

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that mightmeet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.You are configuring Microsoft Defender for Identity integration with Active Directory.From the Microsoft Defender for identity portal, you need to configure several accounts for attackers to exploit.Solution: From Entity tags, you add the accounts as Honeytoken accounts.Does this meet the goal?

Your company uses Microsoft Defender for Cloud. You need to configure the continuous export of Defender for Cloud data. To which two destinations can you export the data? Each correct answer presents a complete solution.

You have an existing Azure logic app that is used to block Azure Active Directory (Azure AD) users. The logic app is triggered manually.You deploy Azure Sentinel.You need to use the existing logic app as a playbook in Azure Sentinel. What should you do first?

Your company has a single office in Istanbul and a Microsoft 365 subscription.The company plans to use conditional access policies to enforce multi-factor authentication (MFA). You need to enforce MFA for all users who work remotely.What should you include in the solution?

You have a Microsoft Sentinel workspace named Workspace1. You need to create and customize a workbook based on an Identity & Access template in Workspace1. What should you do first?

How are replay scheduling rules applied to a particular volume?

You have a Microsoft 365 E5 subscription that uses Microsoft Defender for Endpoint.You need to identify any devices that triggered a malware alert and collect evidence related to the alert. The solution must ensure that you can use the results to initiate device isolation for the affected devices.What should you use in the Microsoft 365 Defender portal?

You have a Microsoft 365 subscription that uses Microsoft Defender XDR.You need to implement deception rules. The solution must ensure that you can limit the scope of the rules. What should you create first?

Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.You have a Microsoft 365 subscription.You have 1,000 Windows devices that have a third-party antivirus product installed and Microsoft Defender Antivirus in passive mode.You need to ensure that the devices are protected from malicious artifacts that were undetected by the third- party antivirus product.Solution: You configure Controlled folder access. Does this meet the goal?

You have a Microsoft 365 subscription that uses Microsoft Defender for Endpoint.You need to add threat indicators for all the IP addresses in a range of 171.23.34.32-171.23.34.63. The solution must minimize administrative effort.What should you do in the Microsoft 365 Defender portal?

You have five on-premises Linux servers.You have an Azure subscription that uses Microsoft Defender for Cloud.You need to use Defender for Cloud to protect the Linux servers.What should you install on the servers first?

You have a Microsoft 365 subscription that uses Microsoft Purview and Microsoft Teams. You have a team named Team1 that has a project named Project1.You need to identify any Project1 files that were stored on the team site of Team1 between February 1, 2023, and February 10, 2023.Which KQL query should you run?

An engineer has installed a Storage Array with a Tier 1 consisting of SSDs.What should the engineer do to optimize performance for I/O workloads utilizing this Tier?

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.You are configuring Microsoft Defender for Identity integration with Active Directory.From the Microsoft Defender portal, you need to configure several accounts for attackers to exploit. Solution: From Entity tags, you add the accounts as Honeytoken accounts.Does this meet the goal?

You have a Microsoft 365 E5 subscription. You plan to create a Microsoft Defender XDR hunting query to identify users that have been affected by clicking a suspicious URL. You need to create a detection rule that will mark the user as compromised. Which two properties should you include in the rule? Each answer presents part of the solution. Select all answers that apply.

You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR.You need to review new attack techniques discovered by Microsoft and identify vulnerable resources in the subscription. The solution must minimize administrative effort.Which blade should you use in the Microsoft Defender portal?

You have the following advanced hunting query in Microsoft 365 Defender.You need to receive an alert when any process disables System Restore on a device managed by Microsoft Defender during the last 24 hours.Which two actions should you perform? Each correct answer presents part of the solution.NOTE: Each correct selection is worth one point.

You have a Microsoft 365 tenant that uses Microsoft Exchange Online and Microsoft Defender for Office 365.What should you use to identify whether zero-hour auto purge (ZAP) moved an email message from the mailbox of a user?

You have a Microsoft Sentinel workspace. You need to view a visual representation of the data in the workspace. What should you use?

You have an Azure subscription that has Azure Defender enabled for all supported resource types.You need to configure the continuous export of high-severity alerts to enable their retrieval from a third-party security information and event management (SIEM) solution.To which service should you export the alerts?

Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.You have a Microsoft 365 subscription.You have 1,000 Windows devices that have a third-party antivirus product installed and Microsoft Defender Antivirus in passive mode.You need to ensure that the devices are protected from malicious artifacts that were undetected by the third- party antivirus product.Solution: You configure endpoint detection and response (EDR) in block mode. Does this meet the goal?

You have a Microsoft Sentinel workspace named Workspace1 that contains the AzureActivity table.You need to configure the retention period for the AzureActivity table. The solution must meet the following requirements:* Maximize the period during which you can run interactive queries.* Minimize retention costs.To what should you set the retention period? To answer, select the appropriate options in the answer area.NOTE: Each correct selection is worth one point.

Your company uses Azure Sentinel to manage alerts from more than 10,000 IoT devices.A security manager at the company reports that tracking security threats is increasingly difficult due to the large number of incidents.You need to recommend a solution to provide a custom visualization to simplify the investigation of threats and to infer threats by using machine learning.What should you include in the recommendation?

You have a Microsoft 365 subscription that contains 1,000 Windows 11 devices.The devices have Microsoft 365 Apps installed and are onboarded to Microsoft Defender for Endpoint. You need to mitigate the following device threats:Microsoft Excel macros that download scripts from untrusted websites Users that open executable attachments in Microsoft OutlookOutlook rules and forms exploits What should you use?

You have a Microsoft 365 subscription that uses Microsoft Defender XDR.You discover that when Microsoft Defender for Endpoint generates alerts for a commonly used executable file, it causes alert fatigue.You need to tune the alerts.Which two actions can an alert tuning rule perform for the alerts? Each correct answer presents a complete solution.NOTE: Each correct selection is worth one point.

The issue for which team can be resolved by using Microsoft Defender for Endpoint?

You have an Azure Sentinel deployment in the East US Azure region.You create a Log Analytics workspace named LogsWest in the West US Azure region.You need to ensure that you can use scheduled analytics rules in the existing Azure Sentinel deployment to generate alerts based on queries to LogsWest.What should you do first?

An engineer has installed an SC8000 with 15K drives in Tier 1, and 7K drives in Tier 3. Thevolume is created using the recommended storage profile. A replay is taken after the initialdata is imported, which results in On Demand Data Progression running.What is going to happen to the data?

You need to configure Microsoft Defender for Cloud Apps to generate alerts and trigger remediation actions in response to external sharing of confidential files.Which two actions should you perform in the Microsoft Defender portal? Each correct answer presents part of the solution.NOTE: Each correct selection is worth one point.

You have a Microsoft 365 subscription that uses Microsoft Defender XDR.You discover that when Microsoft Defender for Endpoint generates alerts for a commonly used executable file, it causes alert fatigue.You need to tune the alerts.Which two actions can an alert tuning rule perform for the alerts? Each correct answer presents a complete solution.NOTE: Each correct selection is worth one point.