SC-200 practice questions

Question 1. A marketing agency legitimately sends newsletters as your domain, and EOP keeps flagging them as spoofing. What's the cleanest, properly-scoped fix?

1. Add their domain to every user's Outlook Safe Senders
2. Create a transport rule that skips filtering for their IP
3. Add their IP to the connection-filter allow list
4. Allow them as a permitted spoof pair in spoof intelligence

Question 2. Which Safe Attachments policy action delivers the message body immediately but withholds attachments until scanning completes, then reattaches clean ones?

1. Monitor
2. Dynamic Delivery
3. Replace
4. Block

Question 3. A SOC lead questions why grounding matters so much in a security AI tool. Why is grounding particularly important in Security Copilot?

1. It reduces the amount of compute required to run the LLM
2. It ensures responses are based on current, specific environment data rather than generic training knowledge
3. It prevents the tool from accessing the internet during prompt processing
4. It replaces the need for human analyst review of AI outputs

Question 4. A colleague asks how a Security Copilot agent differs from a promptbook. What's the difference?

1. Agents don't consume SCUs but promptbooks do
2. A promptbook is autonomous; an agent must be run manually
3. They are the same feature
4. An agent is an autonomous, adaptive automation that acts on tasks; a promptbook replays a fixed prompt sequence you trigger

Question 5. Which insider risk detection identifies a departing user slowly leaking data over many days, where no single day is anomalous?

1. Sequence detection
2. Cumulative exfiltration detection
3. Adaptive Protection
4. Priority content scoring

Question 6. Investigating BEC persistence, which audit activity do you search for to find mailboxes where the attacker granted themselves access?

1. UserLoggedIn
2. Set-MailboxPermission
3. FileDownloaded
4. New-RetentionPolicy

Question 7. An attacker takes the bait and interacts with a deception lure on an endpoint. What does that interaction generate?

1. An automatic Secure Score increase
2. A routine informational event analysts ignore
3. A high-confidence alert indicating likely attacker activity
4. A licensing warning

Question 8. You grab the local onboarding script to quickly test MDE on a few machines. Roughly how many devices is that script intended for?

1. Unlimited
2. Exactly 50
3. Up to 1,000
4. Up to about 10 (for testing)

Question 9. A Defender for SQL alert fires: 'Potential SQL injection: unusual string observed'. What is the most appropriate immediate response?

1. Disable the affected database temporarily by taking it offline
2. Dismiss the alert as SQL injection alerts are typically false positives from application testing
3. Investigate the alert details to identify the source IP and the specific query pattern, then assess whether the web application has a SQL injection vulnerability to patch
4. Enable Defender for Storage to gain additional visibility into the attack

Question 10. An Azure VM is exfiltrating data via DNS tunnelling. Which plan detects this?

1. Microsoft Defender for Storage
2. Microsoft Defender for App Service
3. Microsoft Defender for DNS
4. Microsoft Defender for SQL

Question 11. Use DisplayName, but fall back to UPN, then 'unknown', when earlier ones are empty. Users | extend Name = ___(DisplayName, UserPrincipalName, 'unknown')

1. isnotempty
2. iff
3. coalesce
4. case

Question 12. Bucket each event to midnight of its day. SecurityEvent | extend Day = ___(TimeGenerated)

1. format_datetime
2. startofday
3. datetime_diff
4. bin

Question 13. A Sentinel deployment stops receiving logs from the AWS connector without generating any visible alerts or incidents. How should this ingestion gap be detected?

1. Monitor the SecurityAlert table for AWS-sourced alerts, their absence indicates an ingestion problem
2. Check the ThreatIntelIndicators table for AWS-specific indicators
3. Query the SentinelHealth table or review the Sentinel Health workbook for connector status and last ingestion time
4. Set up a custom analytics rule that alerts when no AWS events are received for 4 hours

Question 14. You're building a Scheduled analytics rule and the wizard has several tabs. Which elements define such a rule?

1. Only a KQL query
2. Only a data connector
3. Only a severity and a name
4. A KQL query, run schedule/lookback, alert threshold, entity mapping, and incident-creation settings

Question 15. After enabling the Microsoft Defender XDR connector in Sentinel with Advanced Hunting data enabled, an analyst wants to write a Sentinel analytics rule that detects when a device that received a phishing email later shows suspicious process execution. Which tables are needed?

1. SecurityAlert and SecurityEvent, standard alert and Windows event correlation
2. EmailEvents and DeviceProcessEvents, email delivery and endpoint process execution
3. OfficeActivity and CommonSecurityLog, M365 audit and network events
4. ThreatIntelIndicators and SigninLogs, TI matching against authentication

Question 16. The Microsoft Defender XDR connector has three independent toggles. Which one integrates on-premises Active Directory identities (via Defender for Identity) into UEBA?

1. Connect events
2. Connect playbooks
3. Connect entities
4. Connect incidents & alerts

Question 17. An analyst investigating a compromised account incident wants to see all other incidents that have involved this same user account — without writing a KQL query. Which Sentinel feature provides this?

1. The Hunting interface — allows searching for incidents by entity
2. The IdentityInfo table — shows all identity attributes for the account
3. The SentinelHealth table — shows all health events for entities
4. The incident investigation graph — visually maps related incidents sharing the same Account entity

Question 18. You need alert-level routing in a playbook rather than the whole incident. Which Sentinel trigger passes a single alert?

1. The schedule trigger
2. The alert trigger
3. The entity trigger
4. The incident trigger

Question 19. An organisation needs complex iterative KQL analysis of 12-month-old network logs over a 2-week investigation. What is most appropriate?

1. Use MSTICPy to query cold tier directly
2. Restore the archived table for 14 days
3. Extend interactive retention retroactively
4. Multiple Search Jobs for each query

Question 20. A SOC leader reviews the Hunts metrics bar to justify the hunting programme. What can they demonstrate from it?

1. Hunts run, hypotheses validated, and the analytics rules and incidents produced
2. The number of licensed users
3. Total data-ingestion cost
4. The workspace's Azure region