Microsoft Security Operations Analyst

Here you have the best Microsoft SC-200 practice exam questions

You have 410 total questions to study from
Each page has 5 questions, making a total of 82 pages
You can navigate through the pages using the buttons at the bottom
This questions were last updated on December 13, 2025
This site is not affiliated with or endorsed by Microsoft.

Question 1 of 410

DRAG DROP -
You are investigating an incident by using Microsoft 365 Defender.
You need to create an advanced hunting query to count failed sign-in authentications on three devices named CFOLaptop, CEOLaptop, and COOLaptop.
How should you complete the query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Select and Place:
Exam SC-200: Question 1 - Image 1

Correct Answer:

Question 2 of 410

You need to receive a security alert when a user attempts to sign in from a location that was never used by the other users in your organization to sign in.
Which anomaly detection policy should you use?

Impossible travel

Activity from anonymous IP addresses

Activity from infrequent country

Malware detection

Correct Answer: C

You need to use an anomaly detection policy that identifies when a user attempts to sign in from a location that has never been used by other users in the organization. The 'Activity from infrequent country' policy checks for sign-ins from locations that have not been previously used by any user in the organization, making it the most appropriate choice for this requirement.

Question 3 of 410

You have a Microsoft 365 subscription that uses Microsoft Defender for Office 365.
You have Microsoft SharePoint Online sites that contain sensitive documents. The documents contain customer account numbers that each consists of 32 alphanumeric characters.
You need to create a data loss prevention (DLP) policy to protect the sensitive documents.
What should you use to detect which documents are sensitive?

SharePoint search

a hunting query in Microsoft 365 Defender

Azure Information Protection

RegEx pattern matching

Correct Answer: D

To detect which documents are sensitive, especially when looking for a specific pattern like a 32-character alphanumeric account number, RegEx pattern matching is the appropriate tool. Regular expressions allow you to define and search for specific patterns within text, making it possible to identify documents containing the sensitive information required. SharePoint search is more general and wouldn't necessarily recognize specific patterns like a 32-character alphanumeric string. A hunting query in Microsoft 365 Defender is designed for threat detection, not specific data patterns in documents. Azure Information Protection focuses on labeling and classifying documents rather than detecting them based on character patterns.

Question 4 of 410

Your company uses line-of-business apps that contain Microsoft Office VBA macros.
You need to prevent users from downloading and running additional payloads from the Office VBA macros as additional child processes.
Which two commands can you run to achieve the goal? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.
A.

Correct Answer:

To prevent users from downloading and running additional payloads from Office VBA macros as additional child processes, you should enable the specific attack surface reduction (ASR) rule related to blocking Office applications from creating child processes. Both commands 'Add-MpPreference' and 'Set-MpPreference' can be used to achieve this, but each serves a different purpose. 'Add-MpPreference' adds a new rule without affecting existing rules, while 'Set-MpPreference' sets the rule and overwrites any existing rules. Therefore, the correct choices are: A. Add-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled and D. Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled. These commands prevent users from running additional payloads as child processes, aligning with the requirement to prevent, not just audit.

Question 5 of 410

Your company uses Microsoft Defender for Endpoint.
The company has Microsoft Word documents that contain macros. The documents are used frequently on the devices of the company's accounting team.
You need to hide false positive in the Alerts queue, while maintaining the existing security posture.
Which three actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.

Resolve the alert automatically.

Hide the alert.

Create a suppression rule scoped to any device.

Create a suppression rule scoped to a device group.

Generate the alert.

Correct Answer: B, D, E

To hide false positives in the Alerts queue while maintaining the existing security posture, you need to hide the alert, create a suppression rule scoped to a device group, and generate the alert. Hiding the alert removes it from view without affecting the security settings. Suppressing alerts scoped to a device group ensures that specific devices, such as those used by the accounting team, aren't inundated with false positives. Generating the alert is necessary because without generating it, you cannot hide or create suppression rules for it.