FirstTry
SC-200Microsoft Security Operations Analyst

Practice Exam 1

The first 5 of 40 questions, free. The explanation on every one of them is free too, at every tier, and always will be.

  1. Question 1 of 40

    Data connectors and costManage a security operations environmentModerate

    Sentinel ingestion costs have doubled after onboarding verbose firewall logs that are needed for quarterly audits but almost never queried during investigations. What is the appropriate change?

  2. Question 2 of 40

    Syslog and CEF collection via AMAManage a security operations environmentHard

    An appliance in Singapore forwards through a collector in Ireland. Its records show EventTime several hours off TimeGenerated, and both hosts are synced to NTP. What explains the gap?

  3. Question 3 of 40

    Syslog and CEF collection via AMAManage a security operations environmentEasy

    A perimeter firewall sends CEF messages through a Linux log forwarder with the Azure Monitor Agent. Which table should an analyst query for those messages?

  4. Question 4 of 40

    Microsoft Sentinel roles and permissionsManage a security operations environmentModerate

    A contractor invited as a guest holds Microsoft Sentinel Responder. She can work incidents but cannot assign one to a colleague. What does she still need?

  5. Question 5 of 40

    Syslog and CEF collection via AMAManage a security operations environmentModerate

    An appliance emits syslog at every severity, and you must collect two specific levels rather than everything above a floor. Which approach delivers that?

0 of 40 completed

0%

The remaining 35 questions are the rest of this form: same 100 minute clock, same 700 cut score, and the same explanation on every question, which is never behind the wall. Practice Exam 1 of 2 on SC-200.

What the rest of this exam covers

  • Manage a security operations environment9 questions / 22% of the exam
  • Configure protections and detections7 questions / 18% of the exam
  • Manage incident response13 questions / 32% of the exam
  • Manage security threats11 questions / 28% of the exam

Checking what you already have access to.

Every question is original, written from the published objectives. We never reproduce, paraphrase, or imitate real exam content, and neither should anything else you study from.