Logo ExamsQA
Exit
Official Bank 0/370

Microsoft Security Operations Analyst (SC-200) - Microsoft Exam Questions

Last updated on June 22, 2026

97% Exam Compliance
370 Total Questions
1
Question
You have a Microsoft 365 E5 subscription that contains 500 Windows 11 devices.

You have a Microsoft Defender for Endpoint deployment that has the following settings: Discovery mode: Basic Live Response: Disabled Enable EDR in block mode: Off Tamper Protection: Off You need to implement automatic attack disruption in Microsoft Defender XDR.

What should you do?
Options
A Change Discovery mode to Standard discovery.
B Set Tamper Protection to On.
C Set Enable EDR in block mode to On.
D Set Live Response to On.
Discussion (0 comments)

to join the discussion

Community Discussion

No discussions yet. Be the first to ask!

2
Question
DRAG DROP You have an Azure subscription that uses Microsoft Defender for Cloud. You need to create a workflow that will send a Microsoft Teams message to the IT department of your company when a new Microsoft Secure Score action is generated. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Exhibit

Exhibit
Reveal Only
Discussion (0 comments)

to join the discussion

Community Discussion

No discussions yet. Be the first to ask!

3
Question
You have a Microsoft 365 E5 subscription that contains 100 Linux devices. The devices are onboarded to Microsoft Defender 365. You need to initiate the collection of investigation packages from the devices by using the Microsoft 365 Defender portal. Which response action should you use?
Options
A Collect investigation package
B Initiate Live Response Session
C Run antivirus scan
D Initiate Automated Investigation
Discussion (0 comments)

to join the discussion

Community Discussion

No discussions yet. Be the first to ask!

4
Question
HOTSPOT You need to create the analytics rule to meet the Azure Sentinel requirements. What should you do? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Exhibit
HOTSPOT
Discussion (0 comments)

to join the discussion

Community Discussion

No discussions yet. Be the first to ask!

5
Question
Your on-premises network contains an Active Directory Domain Services (AD DS) forest. You have a Microsoft Entra tenant that uses Microsoft Defender for Identity. The AD DS forest syncs with the tenant You need to create a hunting query that will identify LDAP simple binds to the AD DS domain controllers.

Which table should you query?
Options
A AADDomainServicesAccountLogon
B Signinlogs
C AADServicePrincipalRiskEventi
D IdentityLOgonEvents
Discussion (0 comments)

to join the discussion

Community Discussion

No discussions yet. Be the first to ask!

Finish Practice?

Are you sure you want to finish? This will end your practice session.