Microsoft Security Operations Analyst (SC-200) Free Practice Test
Question 1
You need to modify the anomaly detection policy settings to meet the Microsoft Defender for Cloud Apps requirements and resolve the reported problem.
Which policy should you modify?
Which policy should you modify?
Correct Answer: B
Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).
Question 2
You need to implement the Defender for Cloud requirements.
Which subscription-level role should you assign to Group1?
Which subscription-level role should you assign to Group1?
Correct Answer: D
Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).
Question 3
You have an Azure subscription that has Azure Defender enabled for all supported resource types.
You need to configure the continuous export of high-severity alerts to enable their retrieval from a third-party security information and event management (SIEM) solution.
To which service should you export the alerts?
You need to configure the continuous export of high-severity alerts to enable their retrieval from a third-party security information and event management (SIEM) solution.
To which service should you export the alerts?
Correct Answer: B
Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).
Question 4
You have a Microsoft Entra tenant that has Microsoft Entra ID P1 licensing.
You collect Microsoft Graph activity logs from a Log Analytics workspace.
You are investigating suspected reconnaissance against Microsoft 365 groups. The following query results were captured from the MicrosoftGraphActivityLogs table during the same 15-minute window.
You suspect that an application is attempting to enumerate groups but is failing authorization checks. For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
You collect Microsoft Graph activity logs from a Log Analytics workspace.
You are investigating suspected reconnaissance against Microsoft 365 groups. The following query results were captured from the MicrosoftGraphActivityLogs table during the same 15-minute window.
You suspect that an application is attempting to enumerate groups but is failing authorization checks. For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation:
Question 5
You have a Microsoft 365 E5 subscription.
You plan to perform cross-domain investigations by using Microsoft 365 Defender.
You need to create an advanced hunting query to identify devices affected by a malicious email attachment.
How should you complete the query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
You plan to perform cross-domain investigations by using Microsoft 365 Defender.
You need to create an advanced hunting query to identify devices affected by a malicious email attachment.
How should you complete the query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation:
In Microsoft 365 Defender advanced hunting, email attachments are recorded in EmailAttachmentInfo and endpoint file activity is recorded in DeviceFileEvents. To correlate a malicious attachment to devices where the same file was observed, you join on the file hash (SHA256). The hunting guidance specifies using EmailAttachmentInfo to filter by sender and to ensure the attachment has a hash (isnotempty(SHA256)).
Then, a join with DeviceFileEvents on SHA256 links the email-borne file to endpoint observations.
Before joining, it's best practice to reduce the right-hand dataset with project to only needed fields (e.g., FileName, SHA256, DeviceName, DeviceId, Timestamp) to improve performance and limit data volume.
After the join, use project again to shape the final result set for investigation, including timeline and pivot identifiers: Timestamp, FileName, SHA256, DeviceName, DeviceId, plus email context such as NetworkMessageId, SenderFromAddress, and RecipientEmailAddress.
Therefore, the correct operator sequence is: join (subquery over DeviceFileEvents with project) on SHA256, then final project of the incident-relevant columns.
Question 6
You have a Microsoft 365 subscription
You need to identify all the security principals that submitted requests to change or delete groups. How should you complete the KQL query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
You need to identify all the security principals that submitted requests to change or delete groups. How should you complete the KQL query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation:
To find all security principals (users or service principals/apps) that changed or deleted groups, you should query MicrosoftGraphActivityLogs and filter for requests targeting the groups endpoint, then exclude read- only operations. The RequestUri field contains the full Graph URL that the principal called (e.g., /v1.0/groups/{id}), so filtering where RequestUri contains " /group " (or " /groups " ) isolates group-related operations.
Changes and deletions are non-read HTTP verbs such as POST, PATCH, PUT, and DELETE. The simplest way to capture all of them is to exclude reads: where RequestMethod != " GET " . Finally, projecting AppId, UserId, and ServicePrincipalId returns the identities (user or app) behind each request, which are the "security principals" you need to report.
So the completed KQL is:
MicrosoftGraphActivityLogs
| where RequestUri contains " /group "
| where RequestMethod != " GET "
| project AppId, UserId, ServicePrincipalId
Question 7
You have a Microsoft Sentinel workspace.
A Microsoft Sentinel incident is generated as shewn in the following exhibit.
Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.
NOTE: Each correct selection is worth one point.
A Microsoft Sentinel incident is generated as shewn in the following exhibit.
Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation:
In Microsoft Sentinel, analysts manage and investigate incidents through the Incident page, which provides multiple investigation and triage tools. The two core aspects of incident analysis relevant here are entity visualization and investigation audit tracking.
Entity Map (Investigate):
Selecting Investigate opens the Investigation Graph view in Microsoft Sentinel.
This interactive map visually displays all the entities (users, IPs, hosts, accounts, files, etc.) related to the alert and their relationships.
It helps analysts understand how alerts are connected, uncover lateral movements, and explore correlated suspicious activities.
Microsoft documentation describes this as:
"The investigation graph provides a visual representation of the entities involved in the incident, showing relationships between them to aid root-cause analysis." Hence, to view a map of connected entities, choose Investigate.
Investigation Activities (Comments):
The Comments tab tracks the activities and analyst notes during the incident lifecycle.
This includes changes to status, assignments, and documented investigation steps - essentially functioning as an activity log for the incident.
Microsoft's official Sentinel documentation states:
"The Comments section in the incident pane provides a timeline of analyst interactions, investigation notes, and changes performed on the incident." Therefore, to view the list of investigation activities, select Comments.
Question 8
You have an Azure subscription named Sub1 that is linked to a Microsoft Entra tenant named contoso.com.
Contoso.com contains a user named User1. Sub1 contains a Microsoft Sentinel workspace.
You provision a Microsoft Copilot for Security capacity.
You need to ensure that User1 can use Copilot for Security to perform the following tasks:
. Update the data sharing and feedback options.
. Investigate Microsoft Sentinel incidents.
The solution must follow the principle of least privilege.
Which role should you assign to User1 for each task? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point
Contoso.com contains a user named User1. Sub1 contains a Microsoft Sentinel workspace.
You provision a Microsoft Copilot for Security capacity.
You need to ensure that User1 can use Copilot for Security to perform the following tasks:
. Update the data sharing and feedback options.
. Investigate Microsoft Sentinel incidents.
The solution must follow the principle of least privilege.
Which role should you assign to User1 for each task? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point
Correct Answer:
Explanation:
Task
Role
Update the data sharing and feedback options
Security Administrator
Investigate Microsoft Sentinel incidents
Microsoft Sentinel Responder
Microsoft Sentinel built-in roles documentation defines:
Microsoft Sentinel Responder - Can view incidents and perform incident response operations such as assigning, changing severity, or closing incidents.
This role grants the ability to investigate and act on incidents, which includes collaboration with Microsoft Copilot for Security to analyze incidents and run queries within Sentinel.
The Microsoft Sentinel Reader role, on the other hand, can only view incidents but cannot investigate or modify them, making it too restrictive.
The Cloud App Security Administrator role is unrelated to Sentinel incident investigation.
Thus, for investigating Sentinel incidents using Copilot for Security, Microsoft Sentinel Responder is the correct and least-privileged role.
Task
Role to Assign
Update the data sharing and feedback options
Security Administrator
Investigate Microsoft Sentinel incidents
Microsoft Sentinel Responder
Security Administrator # Required to configure Copilot for Security settings (data sharing & feedback).
Microsoft Sentinel Responder # Required to actively investigate incidents (least privilege for Sentinel operations).
These align with Microsoft Copilot for Security, Microsoft Sentinel, and Microsoft Entra role-based access control (RBAC) documentation.
Question 9
You have an Azure subscription that contains a virtual machine named VM1 and uses Azure Defender. Azure Defender has automatic provisioning enabled.
You need to create a custom alert suppression rule that will supress false positive alerts for suspicious use of PowerShell on VM1.
What should you do first?
You need to create a custom alert suppression rule that will supress false positive alerts for suspicious use of PowerShell on VM1.
What should you do first?
Correct Answer: A
Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).
Question 10
You have an Azure subscription that contains the following resources:
* A virtual machine named VM1 that runs Windows Server
* A Microsoft Sentinel workspace named Sentinel1 that has User and Entity Behavior Analytics (UEBA) enabled You have a scheduled query rule named Rule1 that tracks sign-in attempts to VM1.
You need to update Rule 1 to detect when a user from outside the IT department of your company signs in to VM1. The solution must meet the following requirements:
* Utilize UEBA results.
* Maximize query performance.
* Minimize the number of false positives.
How should you complete the rule definition? To answer select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
* A virtual machine named VM1 that runs Windows Server
* A Microsoft Sentinel workspace named Sentinel1 that has User and Entity Behavior Analytics (UEBA) enabled You have a scheduled query rule named Rule1 that tracks sign-in attempts to VM1.
You need to update Rule 1 to detect when a user from outside the IT department of your company signs in to VM1. The solution must meet the following requirements:
* Utilize UEBA results.
* Maximize query performance.
* Minimize the number of false positives.
How should you complete the rule definition? To answer select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation:
To detect sign-ins to VM1 by users outside the IT department while leveraging UEBA, you should enrich Windows security events with identity attributes from UEBA's enrichment tables. In Microsoft Sentinel, UEBA writes organizational attributes (e.g., Department, Title, AAD object IDs/SIDs) to the IdentityInfo table. Joining SecurityEvent (Event IDs 4624/4625) with IdentityInfo on the user SID lets you filter with where Department != " IT " -meeting the requirement to utilize UEBA results.
For performance and fewer false positives, use join kind=inner. An inner join only returns rows where the user in SecurityEvent has a corresponding identity record in IdentityInfo, avoiding unmatched and potentially noisy events. Options like fullouter would introduce non-matching rows (increasing noise), and anti would return only unmatched rows (the opposite of what's needed).
BehaviorAnalytics contains anomaly scores/events rather than static attributes like department, and SigninLogs is raw AAD sign-in telemetry (not the UEBA-enriched identity inventory needed for department filtering). Therefore, IdentityInfo is the correct enrichment source.
Thus, to satisfy use UEBA, maximize performance, and minimize false positives: join kind=inner with IdentityInfo and then filter Department != " IT " .
Question 11
You have a Microsoft 365 subscription that uses Microsoft Defender for Endpoint Plan 2 and contains a Windows device named Device!.
You initiated a live response session on Device1.
You need to run a command that will download a 250-MB file named File! .exe from the live response library to Device1. The solution must ensure that Filel.exe is downloaded as a background process.
How should you complete the live response command? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
You initiated a live response session on Device1.
You need to run a command that will download a 250-MB file named File! .exe from the live response library to Device1. The solution must ensure that Filel.exe is downloaded as a background process.
How should you complete the live response command? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation:
< putfile and &
To push (download) a file from the Live Response library onto an endpoint you use the PutFile (often shown as putfile) Live Response command. Microsoft's Live Response command set documents that PutFile "puts a file from the library to the device" and the file is saved to a working folder on the endpoint (and removed on restart by default). This is the operation that transfers a tenant-level library file (for example, an executable you uploaded) onto the target machine for execution or inspection. blog.sec-labs.com+1 When you need the transfer to run as a background job so the live-response session is not blocked waiting for command completion, the Live Response shell supports running commands asynchronously by appending the ampersand operator. Microsoft's Live Response guidance and examples show that background execution is used to avoid blocking the interactive session while large files or long-running operations complete; using & runs the command in the background. Combining these two yields the correct command to download a 250- MB executable from the library to Device1 as a background process: use putfile for the library#device transfer and append & to run it in the background.
Therefore: choose putfile and & .
Question 12
You use Azure Defender.
You have an Azure Storage account that contains sensitive information.
You need to run a PowerShell script if someone accesses the storage account from a suspicious IP address.
Which two actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
You have an Azure Storage account that contains sensitive information.
You need to run a PowerShell script if someone accesses the storage account from a suspicious IP address.
Which two actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
Correct Answer: B,E
Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).
Question 13
You have an Azure subscription that uses Microsoft Defender for Cloud and contains 100 virtual machines that run Windows Server.
You need to configure Defender for Cloud to collect event data from the virtual machines. The solution must minimize administrative effort and costs.
Which two actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
You need to configure Defender for Cloud to collect event data from the virtual machines. The solution must minimize administrative effort and costs.
Which two actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
Correct Answer: C,D
Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).
Question 14
You have a custom detection rule that includes the following KQL query.
For each of the following statements, select Yes if True. Otherwise select No.
NOTE: Each correct selection is worth one point.
For each of the following statements, select Yes if True. Otherwise select No.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation:
Question 15
You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR and contains a Windows device named Device1.
You detect malicious activity on Device1.
You initiate a live response session on Device1.
You need to perform the following actions:
* Download a file from the live response library.
* Stop a process that is running on Device1.
Which live response command should you run for each action? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
You detect malicious activity on Device1.
You initiate a live response session on Device1.
You need to perform the following actions:
* Download a file from the live response library.
* Stop a process that is running on Device1.
Which live response command should you run for each action? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation:
In Microsoft Defender for Endpoint live response sessions, specific commands are provided to perform investigation and remediation tasks directly on a device. According to the official Defender for Endpoint documentation:
The getfile command is used to download a file from the live response library to the local analyst's session.
This command enables investigators to retrieve files that are stored in the Defender live response library for examination or comparison. The command is explicitly documented as "Retrieves a file from the library or from the device." The remediate command is used to take action against threats detected on the endpoint, such as stopping processes, deleting files, or quarantining malware. The remediation commands are part of the live response toolkit and provide direct control over running processes or malicious files during an active incident response session.
Other commands serve different purposes:
library lists the available files in the live response library.
putfile uploads files to the library.
analyze runs advanced analysis tasks.
services lists or manages Windows services but is not used to stop arbitrary processes.
Therefore, for this scenario, the correct live response commands are:
Download a file from the live response library: getfile
Stop a process that is running on Device1: remediate