SaveMyCert
Log in
5 of 5 free questions left today·for 10 a day
SC-200 practice

Free SC-200 practice questions

Drill exam-realistic Microsoft Certified: Security Operations Analyst Associate questions by domain, with an explanation on every option — not just the right one. 5 fully worked examples are further down this page, answers included.

Question bank
519
across 3 domains
Free, no account
5/day
a free account allows 10 a day
Real exam
50 Qs
100 min · pass 700 / 1000
Explanations
Every option
right and wrong

Build a practice session

5 free questions left today.

Domains

How many?

Mode

Ready when you are

10 fresh questions drawn across all domains, in Learn mode.

Review what you missed

Every question you answer incorrectly, and every question you flag while practising, is saved here automatically. Finish a session and you can come back to re-drill just those.

5 sample SC-200 questions, fully explained

Real questions from the SC-200 bank, with the answer key and the reasoning behind every option. Read them, then go back up the page and try the rest.

Question 1Manage a security operations environment

A SOC lead wants the on-call analysts emailed about high-severity incidents in Microsoft Defender XDR. Large incidents often collect dozens of alerts, and the analysts complain that they get a separate email every time a new alert joins an incident they already know about. What should the lead configure?

Choose one.

  • a
    An incident notification rule for High severity with the tenant-specific portal link included

    The tenant-specific portal link only adds a link with the tenant ID to the email; it doesn't reduce the number of emails per incident.

  • b
    An action notification rule for automated actions with the Completed status selected

    Action notification rules email about response actions, not about new incidents, so analysts would miss incidents with no actions.

  • c
    An alert tuning rule that resolves Low and Medium alerts in the server device groups

    Alert tuning changes which alerts reach the queue; it doesn't control how many incident emails are sent, and resolving alerts loses real detections.

  • d
    An incident notification rule for High severity with one notification per incident selected Correct

    Incident notification rules filter by alert severity, and the 'Send only one notification per incident' option stops a new email for every alert that joins the same incident.

The concept

Incident email notification rules in Defender XDR are filtered by severity, source and device group, and can send one email per incident.

Why that’s the answer

The requirement is high-severity incidents only, with no repeat email for each new alert in the same incident. Both are settings of an incident notification rule (Settings > Microsoft Defender XDR > Email notifications > Incidents): the Alert severity filter and 'Send only one notification per incident'. The portal-link option changes the email content, action rules cover a different event, and alert tuning hides or resolves alerts rather than controlling notifications.

How to reason it out
  1. Identify the event to notify on: new or updated incidents.
  2. Pick the Incidents tab of Email notifications, not Actions or Threat analytics.
  3. Set Alert severity to High and select 'Send only one notification per incident'.

Exam tip: Too many incident emails: select 'Send only one notification per incident' on the incident notification rule.

Defender XDR Automation for SC-200: Email Notifications, Alert Tuning, Correlation, AIR and Attack Disruption — the lesson that teaches this.

Question 2Respond to security incidents

A phishing message was delivered to 300 mailboxes. The SOC wants the messages out of every visible mail folder, including Deleted Items, but users must still be able to recover a message themselves if the verdict turns out to be wrong. Which Threat Explorer action should the analyst take?

Choose one.

  • a
    Hard delete

    Hard delete purges the message; only admins can bring it back through single-item recovery, so users can't recover it themselves.

  • b
    Move to deleted items

    The message would still sit in the user's Deleted Items folder, which the requirement says must be emptied of it.

  • c
    Move to junk folder

    Junk Email is a visible folder, so users could still open the phishing message.

  • d
    Soft delete Correct

    Soft delete moves the message to the Recoverable Items\Deletions folder: it leaves the folders users browse and stays recoverable by the user and admins.

The concept

Defender for Office 365 email remediation actions differ in where the message ends up and who can recover it.

Why that’s the answer

Soft delete moves a message to Recoverable Items\Deletions, out of every folder the user browses, and the user or an admin can still recover it. Hard delete purges it, leaving only admin single-item recovery. Move to deleted items and Move to junk folder keep the message in a folder the user can open.

How to reason it out
  1. List the requirement: no visible folder, user-recoverable.
  2. Rule out actions that leave the message in Inbox, Junk or Deleted Items.
  3. Choose between soft and hard delete by who can recover the message.

Exam tip: Out of sight but user-recoverable = soft delete; gone except for admin recovery = hard delete.

Investigating and Remediating Defender XDR Alerts for SC-200: Office 365, Purview, Defender for Cloud, Cloud Apps, Entra ID and Defender for Identity — the lesson that teaches this.

Question 3Perform threat hunting

A Fabrikam analyst reads a report that attackers run certutil.exe with the -urlcache switch to download payloads. She wants every launch of certutil.exe on onboarded Windows devices in the last seven days, with the full command line of each launch. Which advanced hunting table should she query?

Choose one.

  • a
    DeviceEvents

    This table mixes many event types raised by security controls such as Defender Antivirus and exploit protection; it isn't the process-creation log.

  • b
    DeviceFileEvents

    This table records file creation and modification, so it could show the downloaded payload but not each launch of the tool with its arguments.

  • c
    DeviceProcessEvents Correct

    Process creation events land here, with FileName and ProcessCommandLine for every launch.

  • d
    DeviceImageLoadEvents

    This table records DLL loads into processes, not process launches and their command lines.

The concept

Each Defender for Endpoint event family has its own table; process creation is in DeviceProcessEvents.

Why that’s the answer

A process launch, its arguments (ProcessCommandLine) and its parent (the InitiatingProcess columns) are written to DeviceProcessEvents. DeviceFileEvents would show what certutil wrote to disk, DeviceImageLoadEvents which DLLs it loaded, and DeviceEvents holds miscellaneous security-control events, but none of them gives one row per launch with the command line.

How to reason it out
  1. Name the activity: a program being started.
  2. Map program starts to the process-creation table.
  3. Filter FileName for certutil.exe and read ProcessCommandLine.

Exam tip: Something was started? DeviceProcessEvents. Something was written? DeviceFileEvents.

Detecting Threats with Microsoft Defender XDR for SC-200: Advanced Hunting Tables, KQL, Threat Analytics, Hunting Graphs and Sentinel Graph — the lesson that teaches this.

Question 4Manage a security operations environment

Contoso has activated Microsoft Defender XDR Unified RBAC. A regional analyst holds the Manage security settings permission, but her role is scoped to the device groups for the EU offices only. She creates an incident notification rule and selects All device groups as its scope. Which incidents will the rule notify her about?

Choose one.

  • a
    Incidents from the EU device groups, and none from other groups Correct

    With RBAC in use, a user can only create, edit, delete and receive notifications based on device groups they are allowed to manage.

  • b
    Incidents from every device group, as the rule scope selects

    Notification rules aren't evaluated tenant-wide for a scoped user; RBAC limits them to the device groups the user can manage.

  • c
    Incidents from every device group, with the device details redacted

    Defender doesn't send redacted emails for out-of-scope groups; those incidents simply don't reach her.

  • d
    No incidents, because the rule needs the Global Administrator role

    Saving a notification rule doesn't need Global Administrator; the Manage security settings permission is enough.

The concept

Email notification rules respect RBAC device-group scoping.

Why that’s the answer

Configuring email notifications needs the Manage security settings permission (Security Administrator or higher with basic permissions). When role-based access control is in use, a user can create, edit, delete and receive notifications only for the device groups they are allowed to manage. Selecting All device groups doesn't widen her scope: she gets notifications for the EU groups only. She can save the rule, so the claim that Global Administrator is required is wrong.

How to reason it out
  1. Note that she has Manage security settings, so she can create the rule.
  2. Recall that RBAC scoping also applies to which notifications a user receives.
  3. Conclude that the rule covers only her EU device groups.

Exam tip: Notification rules never reach past the device groups the rule owner is allowed to manage.

Defender XDR Automation for SC-200: Email Notifications, Alert Tuning, Correlation, AIR and Attack Disruption — the lesson that teaches this.

Question 5Respond to security incidents

A Tier 1 analyst with the Security Operator role finds a malicious campaign in Threat Explorer and wants to remediate it. The analyst doesn't hold the Search and Purge role, and company policy says a Tier 2 lead must sign off every mailbox deletion. How should the remediation reach the lead?

Choose one.

  • a
    The analyst adds the messages to a remediation, and the lead approves it on the Action center Pending tab Correct

    This is the two-step approval flow: messages go into a remediation container and someone with Search and Purge approves it from Pending.

  • b
    The analyst starts an automated investigation, and the lead approves it on the Investigations page

    An automated investigation isn't needed here; the manual remediation the analyst created is approved in the Action center, not from the Investigations list.

  • c
    The analyst submits the messages to Microsoft, and the lead approves them on the Submissions page

    Submissions send samples to Microsoft for analysis; they don't create a deletion that a lead approves.

  • d
    The analyst soft deletes the messages, and the lead reviews them on the Action center History tab

    Without Search and Purge the analyst can't execute the deletion directly, and History shows completed actions rather than waiting for sign-off.

The concept

Manual email remediation supports direct approval and two-step approval.

Why that’s the answer

People without the right permissions, or who need sign-off, use 'add to remediation'. The targeted emails go into a remediation container that appears on the Action center Pending tab; a second person who holds the Search and Purge role approves it, and the action then moves to History. Submissions and automated investigations are different workflows.

How to reason it out
  1. Note that the analyst can't approve deletions (no Search and Purge).
  2. Recall the two-step approval: add to remediation, then approve.
  3. Find where pending manual remediations wait: Action center > Pending.

Exam tip: No Search and Purge, or sign-off required: add to remediation, then approve from the Action center Pending tab.

Investigating and Remediating Defender XDR Alerts for SC-200: Office 365, Purview, Defender for Cloud, Cloud Apps, Entra ID and Defender for Identity — the lesson that teaches this.

The SC-200 question bank, by domain

The bank is built to the exam's own weighting, so the practice you get reflects the marks that are actually on offer — not whichever domain was easiest to write questions for.

Published SC-200 practice questions per exam domain
DomainExam weightTopicsQuestions
Manage a security operations environment42%7217
Respond to security incidents37%4192
Perform threat hunting21%2110
Total100%13519

Practise SC-200 one domain at a time

Domain 1: Manage a security operations environment42% of the exam · 217 questions, with worked examples and a topic breakdown.Domain 2: Respond to security incidents37% of the exam · 192 questions, with worked examples and a topic breakdown.Domain 3: Perform threat hunting21% of the exam · 110 questions, with worked examples and a topic breakdown.

How SC-200 questions are worded

Most SC-200 questions are not asking whether you can recall a definition. They describe a situation and ask which option satisfies it — so the skill being tested is reading the requirement precisely and eliminating options that fail it.

Single-response vs multiple-response

A single-response question has exactly one right answer. A multiple-response question tells you how many to pick ("Choose TWO") and there is no partial credit — getting one of the two right scores nothing. Read that instruction before you read the options.

Read the last line first

The final sentence is the actual question; everything before it is scenario. Read it first, then read the scenario knowing what you are looking for. It stops you from building an answer in your head that the question never asked for.

Hunt for the qualifier

Most scenarios turn on one word — MOST cost-effective, LEAST operational overhead, with the LEAST latency, without changing application code. Two options are frequently both technically correct, and the qualifier is the only thing separating them.

Eliminate, then choose

Distractors are almost always real Microsoft Azure services doing a real job — just not this job. Rule out the ones that break a stated constraint before you compare what's left. On a question you truly don't know, eliminating two options turns a guess into a coin flip.

Practise SC-200 from your browser

The SaveMyCert Chrome extension opens a daily drill of 5 SC-200 questions in the side panel, with the full explanation behind every answer. No account needed.

Get the Chrome extension (opens in a new tab)

Beyond SC-200 practice

SC-200 sample questions with answersA page of fully worked questions across every domain, answers and explanations included.SC-200 revision notes13 lessons covering every domain — go back to the source when a question keeps catching you out.SC-200 cheat sheetEvery key fact on one page. Skim it the week of the exam.SC-200 flashcardsThe same key facts one at a time, answer hidden until you commit — recall practice rather than re-reading.SC-200 mock examsQuestions are practice; 50 of them in 100 minutes is the exam. Rehearse the real thing.Microsoft Certified: Security Operations Analyst Associate (SC-200) exam overviewExam facts, who it is for, cost and how it fits alongside the other certifications.

SC-200 practice questions: your questions

Yes. You can answer 5 questions a day with no account at all, and a free account raises that to 10 a day across the full 519-question SC-200 bank, with an explanation on every option. Pro removes the daily cap entirely.

Source

Exam structure, domain weights and scoring on this page come from the official SC-200 exam guide.