FirstTry
SC-200Microsoft Security Operations Analyst

Practice Exam 2

The first 5 of 40 questions, free. The explanation on every one of them is free too, at every tier, and always will be.

  1. Question 1 of 40

    Syslog and CEF collection via AMAManage a security operations environmentHard

    A transformation drops CEF messages from the Syslog stream by testing ProcessName. After an agent upgrade, duplicates return for two vendors only. What fixes it?

  2. Question 2 of 40

    Windows security event collectionManage a security operations environmentEasy

    Which Windows event set is built around events that suggest a successful breach, at low volume and without a full audit trail?

  3. Question 3 of 40

    Microsoft Sentinel roles and permissionsManage a security operations environmentModerate

    To keep scope tight, an admin assigned every Sentinel role directly on the workspace rather than on its resource group. Analysts now report missing access to related resources. What went wrong?

  4. Question 4 of 40

    Syslog and CEF collection via AMAManage a security operations environmentModerate

    Fifteen network appliances produce CEF messages and none of them can run an agent. How do you get their messages into the workspace?

  5. Question 5 of 40

    Syslog and CEF collection via AMAManage a security operations environmentHard

    An analyst notices that records from one firewall appear in both the CommonSecurityLog table and the Syslog table, doubling what that device costs to ingest. What is the cause?

0 of 40 completed

0%

The remaining 35 questions are the rest of this form: same 100 minute clock, same 700 cut score, and the same explanation on every question, which is never behind the wall. Practice Exam 2 of 2 on SC-200.

What the rest of this exam covers

  • Manage a security operations environment9 questions / 22% of the exam
  • Configure protections and detections7 questions / 18% of the exam
  • Manage incident response13 questions / 32% of the exam
  • Manage security threats11 questions / 28% of the exam

Checking what you already have access to.

Every question is original, written from the published objectives. We never reproduce, paraphrase, or imitate real exam content, and neither should anything else you study from.