Free Microsoft SC-200 Practice Questions & Answers 2026 Part4 | Microsoft Security Operations Analyst

Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.You have a Microsoft 365 subscription.You have 1,000 Windows devices that have a third-party antivirus product installed and Microsoft Defender Antivirus in passive mode.You need to ensure that the devices are protected from malicious artifacts that were undetected by the third- party antivirus product.Solution: You configure endpoint detection and response (EDR) in block mode. Does this meet the goal?

Your company uses Microsoft Defender for Endpoint.The company has Microsoft Word documents that contain macros. The documents are used frequently on the devices of the company's accounting team.You need to hide false positive in the Alerts queue, while maintaining the existing security posture.Which three actions should you perform? Each correct answer presents part of the solution.NOTE: Each correct selection is worth one point.

You have a Microsoft 365 subscription that contains 1,000 Windows 10 devices. The devices have Microsoft Office 365 installed.You need to mitigate the following device threats:Microsoft Excel macros that download scripts from untrusted websitesUsers that open executable attachments in Microsoft OutlookOutlook rules and forms exploitsWhat should you use?

Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.You have a Microsoft 365 subscription.You have 1,000 Windows devices that have a third-party antivirus product installed and Microsoft Defender Antivirus in passive mode.You need to ensure that the devices are protected from malicious artifacts that were undetected by the third- party antivirus product.Solution: You configure endpoint detection and response (EDR) in block mode. Does this meet the goal?

You have a Microsoft 365 subscription that uses Microsoft Purview. Your company has a project named Project1.You need to identify all the email messages that have the word Project1 in the subject line. The solution must search only the mailboxes of users that worked on Project1.What should you do?

Your company deploys the following services:Microsoft Defender for Identity Microsoft Defender for Endpoint Microsoft Defender for Office 365You need to provide a security analyst with the ability to use the Microsoft 365 security center. The analyst must be able to approve and reject pending actions generated by Microsoft Defender for Endpoint. The solution must use the principle of least privilege.Which two roles should assign to the analyst? Each correct answer presents part of the solution.NOTE: Each correct selection is worth one point.

Note: This section contains one or more sets of questions with the same scenario and problem. Eachquestion presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.You have a Microsoft 365 subscription.You have 1,000 Windows devices that have a third-party antivirus product installed and Microsoft Defender Antivirus in passive mode.You need to ensure that the devices are protected from malicious artifacts that were undetected by the third- party antivirus product.Solution: You enable automated investigation and response (AIR). Does this meet the goal?

You need to implement the Azure Information Protection requirements. What should you configure first?

You are investigating a potential attack that deploys a new ransomware strain.You have three custom device groups. The groups contain devices that store highly sensitive information.You plan to perform automated actions on all devices.You need to be able to temporarily group the machines to perform actions on the devices.Which three actions should you perform? Each correct answer presents part of the solution.NOTE: Each correct selection is worth one point.

You have a Microsoft 365 E5 subscription that contains 1,000 computers. You discover that users are downloading and sharing sensitive files from Microsoft SharePoint Online. You need to view Microsoft Purview data loss prevention (DLP) alerts. What should you use in the Microsoft Defender portal?

You implement Safe Attachments policies in Microsoft Defender for Office 365.Users report that email messages containing attachments take longer than expected to be received.You need to reduce the amount of time it takes to deliver messages that contain attachments without compromising security. The attachments must be scanned for malware, and any messages that contain malware must be blocked.What should you configure in the Safe Attachments policies?

An engineer needs to configure a server. The server is connected to a Storage Center via iSCSI using or more hardware iSCSI host bus adapters. If connectivity is lost due to controller failover, the server needs to reconnect to the Storage Center iSCSI target ports.Which HBA feature must be enabled to meet the requirement?

You have a Microsoft 365 subscription that uses Microsoft Defender XDR.You need to implement deception rules. The solution must ensure that you can limit the scope of the rules. What should you create first?

Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.You have a Microsoft 365 subscription.You have 1,000 Windows devices that have a third-party antivirus product installed and Microsoft Defender Antivirus in passive mode.You need to ensure that the devices are protected from malicious artifacts that were undetected by the third- party antivirus product.Solution: You configure endpoint detection and response (EDR) in block mode. Does this meet the goal?

You have a Microsoft 365 subscription that uses Microsoft Defender XDR.You discover that when Microsoft Defender for Endpoint generates alerts for a commonly used executable file, it causes alert fatigue.You need to tune the alerts.Which two actions can an alert tuning rule perform for the alerts? Each correct answer presents a complete solution.NOTE: Each correct selection is worth one point.

A customer plans to use an SC8000 unit for long-term storage of CCTV security video recordings. Thus system consists of 84 - 4TB 7k disks. The customer does not plan to take any replays on the system.Which setup should be recommended to meet the customer's requirements?

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.You are configuring Microsoft Defender for Identity integration with Active Directory.From the Microsoft Defender for identity portal, you need to configure several accounts for attackers to exploit.Solution: From Entity tags, you add the accounts as Honeytoken accounts.Does this meet the goal?