[Dec-2025] SC-200 Pre-Exam Practice Tests Exam Questions and Answers for Microsoft Certified: Security Operations Analyst Associate Study Guide [Q130-Q153]

Rate this post

[Dec-2025] SC-200 Pre-Exam Practice Tests | Exam Questions and Answers for Microsoft Certified: Security Operations Analyst Associate Study Guide

Microsoft Security Operations Analyst Certification Sample Questions

Microsoft SC-200 (Microsoft Security Operations Analyst) Certification Exam is a professional exam that measures one’s expertise in security operations analysis. It is an important certification for those who want to build a career in the field of cybersecurity. SC-200 exam measures the candidate’s ability to identify, investigate, and respond to security incidents and threats using a variety of security tools and technologies.

A brief introduction of Microsoft SC-200 Exam

Microsoft Security Operations Analyst Certification, often referred to as Microsoft SC-200 Exam is one of the most important courses among other courses provided by Microsoft. The course focuses on Security Analysis and Design, which is a very important factor in Network Administration. This helps us to create a secure environment for our organization. This certification provides you with the skills necessary to plan, deploy and monitor security solutions in an enterprise environment and also the skills required to administer and manage the computer security infrastructure. It gives you an edge over other candidates in terms of skill set and makes you more competitive in the job market of today’s time. The course helps you understand how to plan, deploy and monitor security solutions in an enterprise environment and also how to administer and manage the computer security infrastructure. SC-200 Dumps is designed to make your Microsoft SC-200 certification preparation easy and fast.

It gives you an edge over other candidates in terms of skill-set and makes you more competitive in the job market of today’s time. SC-200 exam validates your ability to design, deploy, manage and monitor a security infrastructure for a private or public organization. The exam measures your knowledge of risk management; incident response; compliance with privacy laws; data protection; cryptography, access control; business continuity planning; auditing & monitoring; intrusion detection & prevention systems (IDS/IPS); web application firewall.

QUESTION 130
Your company stores the data of every project in a different Azure subscription. All the subscriptions use the same Microsoft Entra tenant.
Every project consists of multiple Azure virtual machines that run Windows Server. The Windows events of the virtual machines are stored in a Log Analytics workspace in each machine’s respective subscription.
You deploy Microsoft Sentinel to a new Azure subscription.
You need to perform hunting queries in Microsoft Sentinel to search across all the Log Analytics workspaces of all the subscriptions.
Which two actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.

Create a query that uses the resource expression and the alias operator.

Use the alias statement.

Add the Microsoft Sentinel solution to each workspace.

Create a query that uses the workspace expression and the union operator.

Add the Security Events connector to the Microsoft Sentinel workspace.

QUESTION 131
You are informed of an increase in malicious email being received by users.
You need to create an advanced hunting query in Microsoft 365 Defender to identify whether the accounts of the email recipients were compromised. The query must return the most recent 20 sign-ins performed by the recipients within an hour of receiving the known malicious email.
How should you complete the query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

QUESTION 132
You create a custom analytics rule to detect threats in Azure Sentinel.
You discover that the rule fails intermittently.
What are two possible causes of the failures? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.

The rule query takes too long to run and times out.

The target workspace was deleted.

Permissions to the data sources of the rule query were modified.

There are connectivity issues between the data sources and Log Analytics

QUESTION 133
You have a Microsoft 365 E5 subscription that uses Microsoft Defender for Endpoint.
You have the on-premises devices shown in the following table.

You are preparing an incident response plan for devices infected by malware. You need to recommend response actions that meet the following requirements:
* Block malware from communicating with and infecting managed devices.
* Do NOT affect the ability to control managed devices.
Which actions should you use for each device? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

QUESTION 134
You have an Azure subscription that uses Microsoft Defender for Cloud.
You create a Google Cloud Platform (GCP) organization named GCP1.
You need to onboard GCP1 to Defender for Cloud by using the native cloud connector. The solution must ensure that all future GCP projects are onboarded automatically.
What should you include in the solution? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

QUESTION 135
You create an Azure subscription named sub1.
In sub1, you create a Log Analytics workspace named workspace1.
You enable Azure Security Center and configure Security Center to use workspace1.
You need to ensure that Security Center processes events from the Azure virtual machines that report to workspace1.
What should you do?

In workspace1, install a solution.

In sub1, register a provider.

From Security Center, create a Workflow automation.

In workspace1, create a workbook.

QUESTION 136
You are investigating an incident by using Microsoft 365 Defender.
You need to create an advanced hunting query to detect failed sign-in authentications on three devices named CFOLaptop, CEOLaptop, and COOLaptop.
How should you complete the query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

QUESTION 137
You have a Microsoft Sentinel workspace
You develop a custom Advanced Security information Model (ASIM) parser named Parser1 that produces a schema named Schema1.
You need to validate Schema1.
How should you complete the command? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

QUESTION 138
You have an on-premises Linux server that runs a background process named App1 and has the Azure Connected Machine agent installed.
You have a Microsoft Sentinel workspace named WS1.
You need to configure a data collection rule (DCR) named DCR1 that will use the Syslog via AMA connector to collect messages related to App1. The solution must meet the following requirements:
* Only collect messages that have a priority level of critical.
* Minimize the volume of data collected.
Which facility and log level should you configure for DCR1? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Explanation:

When configuring the Syslog via Azure Monitor Agent (AMA) connector in Microsoft Sentinel, the Data Collection Rule (DCR) determines which Linux system logs are ingested. Syslog messages are filtered based on facility (the subsystem that generated the message) and severity level (priority).
According to Microsoft’s “Collect Syslog data sources using Azure Monitor Agent” documentation:
“Syslog facilities define which type of process generated the log (e.g., authentication, cron, daemon), and log levels define the severity (0=emerg, 1=alert, 2=crit, 3=err, etc.). To minimize data ingestion and cost, select only the facility and the highest severity level required for your investigation.” In this scenario:
* You need to collect logs related to App1, a background process (non-kernel, non-authentication, non- cron). Typically, such custom or application-level processes send logs to LOG_AUTH or LOG_DAEMON, depending on configuration. If App1 is an application that uses authentication or security features, the LOG_AUTH facility is appropriate.
* You must collect only logs with a critical priority, which corresponds to Syslog severity 2 (critical).
In Syslog terminology, that maps to the LOG_EMERG or “emergency” level and above.
However, to ensure minimum data collection while still capturing critical events, Sentinel’s best practice is to configure the Syslog DCR to collect only the specific facility associated with the application and the exact required severity level. For “critical only,” LOG_EMERG is the correct choice because it ensures that only the most urgent (critical/emergency) events are ingested, reducing data volume and cost.
# Final Configuration:
Setting
Correct Option
Purpose
Facility
LOG_AUTH
Collects security/authentication-related logs for App1
Log level
LOG_EMERG
Collects only critical/emergency events (priority # 0) to minimize ingestion volume In summary:
Selecting LOG_AUTH and LOG_EMERG satisfies both requirements – capturing only the highest- severity logs relevant to App1 while keeping the ingestion volume minimal, in line with Microsoft Sentinel Syslog DCR configuration guidance.

QUESTION 139
You need to create the test rule to meet the Azure Sentinel requirements. What should you do when you create the rule?

From Set rule logic, turn off suppression.

From Analytics rule details, configure the tactics.

From Set rule logic, map the entities.

From Analytics rule details, configure the severity.

QUESTION 140
You need to implement the scheduled rule for incident generation based on rulequery1.
What should you configure first?

entity mapping

custom details

event grouping

alert details

QUESTION 141
You have a Microsoft 365 E5 subscription that contains two users named User1 and User2. You have the hunting query shown in the following exhibit.

The users perform the following actions:
* User1 assigns User2 the Global Administrator role.
* User1 creates a new user named User3 and assigns the user a Microsoft Teams license.
* User2 creates a new user named User4 and assigns the user the Security Reader role.
* User2 creates a new user named User5 and assigns the user the Security Operator role.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.

QUESTION 142
You deploy Azure Sentinel.
You need to implement connectors in Azure Sentinel to monitor Microsoft Teams and Linux virtual machines in Azure. The solution must minimize administrative effort.
Which data connector type should you use for each workload? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

QUESTION 143
You have an Azure subscription that contains a Log Analytics workspace named Workspace1.
You configure Azure activity logs and Microsoft Entra ID logs to be forwarded to Workspace1.
You need to identify which Azure resources have been queried or modified by risky users.
How should you complete the KQL query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

QUESTION 144
You have a Microsoft 365 E5 subscription.
You plan to perform cross-domain investigations by using Microsoft 365 Defender.
You need to create an advanced hunting query to identify devices affected by a malicious email attachment.
How should you complete the query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

QUESTION 145
You provision Azure Sentinel for a new Azure subscription. You are configuring the Security Events connector.
While creating a new rule from a template in the connector, you decide to generate a new alert for every event. You create the following rule query.

By which two components can you group alerts into incidents? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.

user

resource group

IP address

computer

QUESTION 146
HOTSPOT
You are informed of an increase in malicious email being received by users.
You need to create an advanced hunting query in Microsoft 365 Defender to identify whether the accounts of the email recipients were compromised. The query must return the most recent 20 sign-ins performed by the recipients within an hour of receiving the known malicious email.
How should you complete the query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

QUESTION 147
You have an Azure subscription that uses Microsoft Defender for Cloud.
You have a GitHub account named Account1 that contains 10 repositories.
You need to ensure that Defender for Cloud can assess the repositories in Account1.
What should you do first in the Microsoft Defender for Cloud portal?

Add an environment.

Enable security policies.

Enable integrations.

Enable a plan.

QUESTION 148
You need to implement the Azure Information Protection requirements. What should you configure first?

Device health and compliance reports settings in Microsoft Defender Security Center

scanner clusters in Azure Information Protection from the Azure portal

content scan jobs in Azure Information Protection from the Azure portal

Advanced features from Settings in Microsoft Defender Security Center

QUESTION 149
You plan to connect an external solution that will send Common Event Format (CEF) messages to Azure Sentinel.
You need to deploy the log forwarder.
Which three actions should you perform in sequence? To answer, move the appropriate actions form the list of actions to the answer area and arrange them in the correct order.

QUESTION 150
You have a Microsoft 365 E5 subscription that uses Microsoft Defender for Endpoint. You need to create a detection rule that meets the following requirements:
* Is triggered when a device that has critical software vulnerabilities was active during the last hour
* Limits the number of duplicate results
How should you complete the KQL query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

QUESTION 151
You have a Microsoft 365 E5 subscription that uses Microsoft Defender for Office 365.
You need to build a hunting query that will list events involving potentially malicious emails that were detected but NOT removed successfully from mailboxes after delivery. The solution must ensure that the events are correlated with the sign-in events of the email recipients.
How should you complete the query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

QUESTION 152
You have an Azure subscription that has Microsoft Defender for Cloud enabled.
You have a virtual machine that runs Windows 10 and has the Log Analytics agent installed.
You need to simulate an attack on the virtual machine that will generate an alert.
What should you do first?

Run the Log Analytics Troubleshooting Tool.

Copy a executable and rename the file as ASC_AlerTest_662jf10N,exe

Modify the settings of the Microsoft Monitoring Agent.

Run the MMASetup executable and specify the -foo argument

QUESTION 153
You have an Azure subscription that uses Microsoft Sentinel and contains 100 Linux virtual machines.
You need to monitor the virtual machines by using Microsoft Sentinel. The solution must meet the fallowing requirements:
* Minimize administrative effort
* Minimize the parsing required to read log data
What should you configure?

REST API integration

a SysJog connector

a Log Analytics Data Collector API

a Common Event Format (CEF) connector

Microsoft Security Operations Analyst certification exam, also known as SC-200, is a valuable and sought-after certification for professionals in the field of cybersecurity. Microsoft Security Operations Analyst certification is designed to equip individuals with the necessary skills to effectively monitor and respond to security incidents using Microsoft security technologies.

Microsoft Exam Practice Test To Gain Brilliante Result: https://www.examdumpsvce.com/SC-200-valid-exam-dumps.html