Microsoft SC-200 Exam Questions

Exam Name: Microsoft Security Operations Analyst

Exam Code: SC-200

Related Certification(s): Microsoft Azure Certification

Certification Provider: Microsoft

Actual Exam Duration: 100 Minutes

Number of SC-200 Practice Questions: 370 (updated: )

Microsoft Recommended Focus Areas for the SC-200 Exam:
Topic 1: Mitigate threats using Microsoft Defender solutions:
This section evaluates identifying and mitigating threats using Microsoft Defender tools. It includes endpoint, identity, and cloud threat protection capabilities.
Topic 2: Configure and manage Microsoft Sentinel:
This section focuses on deploying and managing Microsoft Sentinel. It includes configuring data connectors, analytics rules, and monitoring security incidents.
Topic 3: Investigate and respond to security incidents:
This section covers investigating alerts, analyzing incidents, and responding to security threats. It includes incident management and remediation techniques.
Topic 4: Manage security operations and threat intelligence:
This section evaluates integrating threat intelligence, automating responses, and improving security operations. It ensures effective SOC processes and monitoring.
Free Microsoft SC-200 Exam Actual Questions
Note: Microsoft SC-200 Premium Questions were last updated on

Q1: You have an Azure subscription that has Microsoft Defender for Cloud enabled.

You have a virtual machine named Server! that runs Windows Server 2022 and is hosted in Amazon Web Services (AWS).

You need to collect logs and resolve vulnerabilities for Server1 by using Defender for Cloud.

What should you install first on Server1?

Q2: You have an Azure subscription that contains a Microsoft Sentinel workspace named Workspace1 and a user named User1.

You need to ensure that User1 can investigate incidents by using Workspace1. The solution must follow the principle of least privilege.

Which role should you assign to User1?

Q3: You have an Azure subscription that has Azure Defender enabled for all supported resource types.

You need to configure the continuous export of high-severity alerts to enable their retrieval from a third-party security information and event management (SIEM) solution.

To which service should you export the alerts?

Q4: What is Microsoft Sentinel primarily used for?

Q5: What is the primary purpose of Microsoft Defender for Cloud?