FirstTry
SC-200Microsoft Security Operations Analyst

Practice Exam 1

5 of this form’s 40 questions, drawn from across its domains, free. The explanation on every one of them is free too, at every tier, and always will be.

  1. Question 1 of 5

    Manage incident response

    An incident shows lateral movement from a device that was never onboarded, so your team has no agent on it. Which disruption action still limits the spread?

  2. Question 2 of 5

    Manage security threats

    This hunt should list every message that carried the attachment, but returns only one message per file hash.

    KQL
    EmailAttachmentInfo| where Timestamp > ago(1h)| where Subject == "Document Attachment" and FileName == "Document.pdf"| join (DeviceFileEvents | where Timestamp > ago(1h)) on SHA256

    What causes that?

  3. Question 3 of 5

    Manage incident response

    A new SOC analyst cannot run audit log searches in the Microsoft Purview portal. Which assignment grants that with the least privilege?

  4. Question 4 of 5

    Configure protections and detections

    A device in Defender for Endpoint is confirmed compromised. You need to stop it reaching other systems while keeping the ability to investigate it from the portal. Which action fits?

  5. Question 5 of 5

    Manage a security operations environment

    An access review finds an analyst holding both Microsoft Sentinel Reader and Microsoft Sentinel Contributor on the same resource group. What can that analyst do?

0 of 40 completed

0%

The other 35 questions are the rest of this form: same 100 minute clock, same 700 cut score, and the same explanation on every question, which is never behind the wall. Practice Exam 1 of 2 on Security Operations Analyst.

What this exam covers

  • Manage a security operations environment9 questions / 22% of the exam
  • Configure protections and detections7 questions / 18% of the exam
  • Manage incident response13 questions / 32% of the exam
  • Manage security threats11 questions / 28% of the exam

Checking what you already have access to.

Every question is original, written from the published objectives. We never reproduce, paraphrase, or imitate real exam content, and neither should anything else you study from.