SaveMyCert
Log in
5 of 5 free questions left today·for 10 a day
SC-200 · Domain 1

Manage a security operations environment practice questions

Manage a security operations environment is worth 42% of the SC-200 exam — the heaviest of the 3 domains. Configuring the SOC platform: Defender XDR notifications, automated investigation and attack disruption, Defender for Endpoint settings, policies and device groups, Sentinel automation rules and playbooks, Sentinel roles, retention tiers, workbooks and SOC optimization, data connectors and ingestion, and detections in both Defender XDR and Sentinel. Official weighting 40–45%. 6 fully worked examples are further down this page, answers included.

Exam weight
42%
the heaviest of the 3 domains
Questions
217
across 7 topics
Free, no account
5/day
a free account allows 10 a day
Explanations
Every option
right and wrong

Build a practice session

5 free questions left today.

Domains

How many?

Mode

Ready when you are

10 fresh questions drawn across 1 of 3 domains, in Learn mode.

Review what you missed

Every question you answer incorrectly, and every question you flag while practising, is saved here automatically. Finish a session and you can come back to re-drill just those.

6 sample Manage a security operations environment questions, fully explained

Questions from the SC-200 bank mapped to domain 1, with the answer key and the reasoning behind every option. None of them repeat the examples on the main SC-200 practice page.

Question 1Manage a security operations environment

A security manager wants an email whenever an isolation started automatically by Microsoft Defender XDR, such as by automatic attack disruption, doesn't succeed. Isolations that analysts start by hand, and isolations that work, must not send email. Which two settings should the manager choose in the notification rule? (Select TWO.)

Choose TWO.

  • a
    Action source set to Manual

    Manual covers isolations that analysts start themselves, which the manager explicitly excludes.

  • b
    Action source set to Automated Correct

    Automated response actions include automatic attack disruption and automated investigation and response, which is what the manager wants.

  • c
    Action status set to Failed Correct

    The Action status field lets the rule fire only for failed actions, so successful isolations send nothing.

  • d
    Action status set to Completed

    Completed would email about isolations that worked, which the manager doesn't want.

  • e
    Alert severity set to High on the Incidents tab

    The Incidents tab notifies about incidents, not about the outcome of response actions.

The concept

Action notification rules (Email notifications > Actions) filter by action source, action, device group and status.

Why that’s the answer

Response-action notifications are configured on the Actions tab of Email notifications. Under Action source you choose manual, automated or both; automated covers automatic attack disruption and automated investigation and response. Under Action status you choose completed, failed or both. Automated plus Failed, with Isolate device in the action list, matches the requirement exactly.

How to reason it out
  1. Pick the Actions tab: the event is a response action, not an incident.
  2. Choose the action source: automated only.
  3. Choose the action status: failed only.

Exam tip: Action notifications: choose the source (manual/automated) and the status (completed/failed).

Defender XDR Automation for SC-200: Email Notifications, Alert Tuning, Correlation, AIR and Attack Disruption — the lesson that teaches this.

Question 2Manage a security operations environment

A threat intelligence analyst wants an email whenever Microsoft publishes a new threat analytics report about ransomware, or updates an existing one. Reports about other threats shouldn't send email. What should the analyst create in the Microsoft Defender portal?

Choose one.

  • a
    A Threat analytics notification rule that tracks all newly published reports

    Tracking all reports would also email about non-ransomware threats, which the analyst wants to avoid.

  • b
    An Incidents notification rule that tracks incidents with the Ransomware tag

    Incident rules notify about incidents in your tenant, not about Microsoft's threat analytics reports.

  • c
    A Threat analytics notification rule that tracks only reports with the Ransomware tag Correct

    Threat analytics notification rules can track all reports or only reports of a certain type or with a specific tag, and they fire on new and updated reports.

  • d
    An Actions notification rule that tracks automated actions on ransomware devices

    Action rules notify about response actions taken in your tenant, not about published reports.

The concept

Threat analytics email notifications track new and updated reports, optionally filtered by report type or tag.

Why that’s the answer

Threat analytics notifications are configured on the Threat analytics tab of Settings > Microsoft Defender XDR > Email notifications. A rule can track every newly published or updated report, or only reports of a specific type or with a specific tag such as Ransomware. The Incidents and Actions tabs cover events in your own tenant, not Microsoft's reports.

How to reason it out
  1. Identify the event: a Microsoft threat analytics report is published or updated.
  2. Use the Threat analytics tab of Email notifications.
  3. Narrow the rule to the Ransomware tag instead of all reports.

Exam tip: Report updates go through the Threat analytics tab; filter by report type or tag.

Defender XDR Automation for SC-200: Email Notifications, Alert Tuning, Correlation, AIR and Attack Disruption — the lesson that teaches this.

Question 3Manage a security operations environment

A SOC wants incident emails for Medium and High severity alerts from Defender for Endpoint EDR, but for every severity when the source is Microsoft Defender Experts. The team wants to maintain as few notification rules as possible. What should the team configure?

Choose one.

  • a
    One incident notification rule that sets a different severity for each source Correct

    Incident notification rules let you choose the severities per service source or detection source, so one rule covers both requirements.

  • b
    Two incident notification rules, one for each source with its own severities

    Two rules would work, but the team wants as few rules as possible, and one rule can set the severity per source.

  • c
    One incident notification rule for Medium and High severity for both sources

    This would miss Low and Informational alerts from Defender Experts, which the team wants.

  • d
    One rule for Low to High severity plus a tuning rule that hides Low EDR alerts

    Hiding the Low EDR alerts removes them from the queue entirely, not just from email, and the hidden alerts no longer create incidents.

The concept

Incident notification rules can set the severity separately for each service or detection source.

Why that’s the answer

Incident notifications can be narrowed to specific service sources or detection sources, and the severity can be chosen per source. That lets one rule send Medium and High for EDR and all severities for Defender Experts. Two rules also work but break the 'as few rules as possible' requirement. A tuning rule that hides alerts changes what the SOC sees, not just what it is emailed about.

How to reason it out
  1. List the two requirements: EDR Medium/High, Defender Experts all severities.
  2. Recall that the severity can be set per service or detection source.
  3. Pick the single rule; reject the two-rule design on the stated constraint.

Exam tip: One incident rule can apply different severities to different sources.

Defender XDR Automation for SC-200: Email Notifications, Alert Tuning, Correlation, AIR and Attack Disruption — the lesson that teaches this.

Question 4Manage a security operations environment

A red team runs scheduled phishing simulations that trigger Microsoft Defender for Office 365 alerts. The SOC wants matching alerts, and the incidents they create, to arrive already closed so that a record remains but nobody has to triage them. Which alert tuning action should the SOC use?

Choose one.

  • a
    Hide alert

    Hide alert applies only to Defender for Endpoint alerts and also stops incident creation, so there would be no incident record.

  • b
    Resolve alert Correct

    Resolve alert automatically resolves matching alerts and their incidents, so the record exists in a closed state.

  • c
    Set as behavior

    Set as behavior isn't supported for Defender for Office 365 alerts, and it removes the signals from the alert queue instead of closing them.

  • d
    Exclude from correlation

    Correlation settings control how alerts are grouped into incidents; they don't close the alerts.

The concept

Alert tuning actions: Hide alert, Resolve alert and Set as behavior.

Why that’s the answer

Alert tuning (formerly alert suppression) runs one of three actions when its conditions match. Resolve alert creates the alert and its incident in a resolved state, which keeps a record without triage work. Hide alert is limited to Defender for Endpoint alerts and prevents the incident; Set as behavior turns signals into behaviors and isn't supported for Defender for Office 365 or Defender for Cloud alerts.

How to reason it out
  1. Note the source: Defender for Office 365.
  2. Note the requirement: keep a closed record of the alert and incident.
  3. Choose Resolve alert; Hide is endpoint-only and Set as behavior doesn't support this source.

Exam tip: Want a closed record? Resolve alert. Want no incident at all for an endpoint alert? Hide alert.

Defender XDR Automation for SC-200: Email Notifications, Alert Tuning, Correlation, AIR and Attack Disruption — the lesson that teaches this.

Question 5Manage a security operations environment

A nightly backup agent triggers the same Microsoft Defender for Endpoint alert on 200 servers. The SOC wants these alerts out of the alert queue and wants no incidents created. The compliance team audits the activity each month with existing advanced hunting queries that read the AlertInfo and AlertEvidence tables. Which alert tuning action meets all the requirements?

Choose one.

  • a
    Set as behavior

    Set as behavior also keeps signals out of the queue and incidents, but the data moves to the BehaviorInfo and BehaviorEntities tables, which breaks the existing queries.

  • b
    Resolve alert

    Resolve alert still creates the alerts and their incidents, only in a resolved state.

  • c
    Hide alert Correct

    Hide alert suppresses the alert and prevents incident creation, and hidden alerts remain in the AlertInfo and AlertEvidence tables.

  • d
    Resolve alert, with resolved incidents filtered out of the queue

    Filtering the queue view doesn't stop incident creation, which the SOC explicitly wants to avoid.

The concept

Hide alert vs Set as behavior: both keep signals out of the queue, but they store the data in different tables.

Why that’s the answer

Two actions keep the alerts out of the queue and stop incidents: Hide alert and Set as behavior. The deciding constraint is the audit queries. Hidden alerts stay in AlertInfo and AlertEvidence, while Set as behavior converts the signals into behaviors stored in BehaviorInfo and BehaviorEntities. Hide alert is available here because the alerts come from Defender for Endpoint, the only source it supports.

How to reason it out
  1. Eliminate Resolve alert: it still creates incidents.
  2. Compare Hide alert and Set as behavior: both meet the queue and incident requirements.
  3. Use the table constraint: only hidden alerts remain in AlertInfo and AlertEvidence.
  4. Confirm that the source is Defender for Endpoint, which Hide alert supports.

Exam tip: Hide keeps the alert rows; Set as behavior moves the data to BehaviorInfo and BehaviorEntities.

Defender XDR Automation for SC-200: Email Notifications, Alert Tuning, Correlation, AIR and Attack Disruption — the lesson that teaches this.

Question 6Manage a security operations environment

An administrator reviews the built-in alert tuning rules on the Alert tuning page and sees one that suppresses a common benign activity. A custom detection rule that the SOC wrote in advanced hunting still creates alerts for that same activity. What explains this?

Choose one.

  • a
    Built-in alert tuning rules don't apply to alerts from custom detection rules Correct

    Microsoft documents that built-in tuning rules don't apply to alerts from custom detection rules or from Custom TI indicators.

  • b
    Built-in rules suppress custom detection alerts after an automated investigation completes

    Built-in rules don't cover custom detection alerts at all, and suppression doesn't wait for an investigation; an investigation that finds malicious activity can reactivate a suppressed alert.

  • c
    Built-in rules suppress custom detection alerts once the rule is excluded from correlation

    Correlation settings control incident grouping, not alert suppression, and built-in tuning rules don't cover custom detection alerts either way.

  • d
    Built-in alert tuning rules stay inactive until an administrator turns each one on

    Built-in rules are active; an administrator can disable one, but doesn't need to turn them on.

The concept

Built-in alert tuning rules and their exclusions.

Why that’s the answer

Defender XDR ships built-in alert tuning rules that suppress common benign activity without affecting automated investigations or email notifications. They don't apply to alerts from custom detection rules or Custom TI, so the SOC's own detection still alerts. If the custom alert is noise, the SOC should tune the detection's query or create its own tuning rule.

How to reason it out
  1. Note that the noisy alert comes from a custom detection rule.
  2. Recall the documented exclusion: built-in tuning skips custom detections and Custom TI.
  3. Fix it in the custom detection's query or with a custom tuning rule.

Exam tip: Built-in tuning never touches custom detection or Custom TI alerts.

Defender XDR Automation for SC-200: Email Notifications, Alert Tuning, Correlation, AIR and Attack Disruption — the lesson that teaches this.

What SC-200 domain 1 tests, topic by topic

The official exam guide breaks Manage a security operations environment into 7 topics. The question bank follows the same split, so a weak topic shows up as a cluster of misses you can go back and read.

Published SC-200 practice questions per topic in Manage a security operations environment
TopicWhat it coversQuestions
Configure automation in Microsoft Defender XDRSkills outline section (SC-200, skills measured as of October 21, 2026), Configure automation for Microsoft Defender XDR and Microsoft Sentinel (Defender XDR part): Configure email notifications in Microsoft Defender XDR, including incidents, actions, and threat analytics; Configure alert notifications in Microsoft Defender XDR, including tuning, suppression, and correlation; Manage automated investigation and response capabilities in Microsoft Defender XDR; Configure automatic attack disruption in Microsoft Defender XDR.31
Configure Microsoft Defender for EndpointSkills outline section (SC-200, skills measured as of October 21, 2026), Configure automation for Microsoft Defender XDR and Microsoft Sentinel (Defender for Endpoint part): Configure Microsoft Defender for Endpoint advanced features; Configure rules settings in Microsoft Defender for Endpoint; Configure custom data collection in Microsoft Defender for Endpoint; Configure security policies for Microsoft Defender for Endpoint, including attack surface reduction (ASR) rules; Configure and manage device groups, permissions, and automation levels in Microsoft Defender for Endpoint.31
Configure automation in Microsoft SentinelSkills outline section (SC-200, skills measured as of October 21, 2026), Configure automation for Microsoft Defender XDR and Microsoft Sentinel (Sentinel part): Create and configure automation rules in Microsoft Sentinel; Create and configure Microsoft Sentinel playbooks.31
Configure the Microsoft Sentinel SIEM and platformSkills outline section (SC-200, skills measured as of October 21, 2026): Specify Microsoft Sentinel roles; Manage data retention for XDR and Microsoft Sentinel tables, including Analytics, Data lake, and XDR tiers; Create and configure Microsoft Sentinel workbooks; Optimize the Microsoft Sentinel platform, including SOC optimization recommendations.31
Ingest Windows security events into Microsoft SentinelSkills outline section (SC-200, skills measured as of October 21, 2026), Ingest data into the Microsoft Sentinel SIEM and platform (first part): Select data connectors based on data source requirements, including Windows logs and security events; Configure collection of Windows Security events by using Windows Security Events via AMA, including data collection rules; Plan and configure collection of Windows Security events by using Windows Event Forwarding (WEF).31
Ingest Syslog, CEF, Azure activity, threat indicators and custom logsSkills outline section (SC-200, skills measured as of October 21, 2026), Ingest data into the Microsoft Sentinel SIEM and platform (second part): Plan and configure Syslog via AMA and Common Event Format (CEF) via AMA connectors; Configure collection of Azure activity logs by using Azure Policy and resource diagnostic settings; Ingest threat indicators into Microsoft Sentinel; Create custom log tables in the workspace to store ingested data.31
Configure detectionsSkills outline section (SC-200, skills measured as of October 21, 2026): Create custom detection rules by using Advanced Hunting in Microsoft Defender XDR; Manage custom detection rules in Microsoft Defender XDR; Configure and manage analytics rules in Microsoft Sentinel SIEM, including scheduled, near-real time (NRT), threat intelligence, and machine learning; Analyze attack vector coverage by using the MITRE ATT&CK matrix; Configure anomalies in Microsoft Sentinel.31
Total217

Revise Manage a security operations environment before you drill it

Defender XDR Automation for SC-200: Email Notifications, Alert Tuning, Correlation, AIR and Attack DisruptionQuestions on this topic are short SOC scenarios set in the Microsoft Defender portal that ask which setting to configure or what explains an observed behaviour. The options are usually real Defender settings that each do a different job, so knowing what each setting changes, and what it leaves alone, decides the item. Expect near-twins to be contrasted: the three alert tuning actions, Semi versus No automated response for attack disruption, user versus device versus IP exclusions versus policy applications, analytics-rule correlation settings versus the custom detection setting, and Pending versus History in the Action center. Permissions (Manage security settings, Search and Purge) and documented limitations of built-in tuning rules and response-action notifications also appear, as do Select TWO items on merge conditions and attack disruption prerequisites. Current behaviour matters, including the 2026 Defender for Endpoint AIR change and the Entra ID Protection alert default.SC-200 Configure Microsoft Defender for Endpoint: Advanced Features, ASR Rules, Device Groups and RolesQuestions on this topic describe a SOC or endpoint team, its Defender for Endpoint setup and a requirement, then ask which advanced feature, indicator, policy, device group setting or permission meets it. Requirement phrases such as least privilege, minimize administrative effort, without deploying additional agents, without replacing the current antivirus, only this rule or only the pilot devices decide between options that would otherwise all work. Expect near-twins: indicator types and their allowed actions, SmartScreen versus network protection, global versus per-rule versus antivirus exclusions, the three semi-automated remediation levels, Basic versus Advanced live response, and RBAC permissions with similar names. Several items describe a symptom (a block that doesn't happen, a rule that goes quiet, a browser that isn't filtered) and ask for the cause, which usually comes down to a prerequisite such as Defender Antivirus active mode or network protection block mode. Some items show a short advanced hunting query and ask for the value that completes it.SC-200 Microsoft Sentinel Automation: Automation Rules and PlaybooksQuestions on this topic describe a SOC scenario and a requirement, then ask which automation rule trigger, condition, action or playbook design meets it. Expect requirement phrases such as least privilege, no extra Logic Apps cost, no stored secrets, without waiting for incidents or must stop on its own to rule options out. Near-twin choices are common: Equals versus Changed to, Any individual tag versus Collection of all tags, a greyed-out versus a missing playbook, Playbook Operator versus Logic App Contributor, Responder versus Reader for a playbook identity, and Consumption versus Standard logic apps. Some items ask you to predict what happens when several rules run in order, what changed after the workspace moved to the Defender portal, or to pick the SentinelHealth query that finds failed automation.SC-200 Microsoft Sentinel Platform: Roles, Data Tiers, Retention, Workbooks and SOC OptimizationQuestions on this topic describe a SOC team, its Sentinel workspace and a requirement, then ask which role, scope, tier, retention setting, workbook option or SOC optimization feature meets it. Requirements usually combine a functional need with a constraint such as least privilege, scope, cost or continued access to the data, so the answer depends on knowing exactly what each role, tier and setting does and doesn't cover. Some items describe a symptom or an unexpected result and ask for the cause or the fix, and some ask you to select two statements that describe the result of a change.SC-200 Windows Security Events in Microsoft Sentinel: AMA, DCRs and WEFQuestions on this topic describe a Windows estate and a requirement, then ask which connector, event set, filter, table or WEF setting meets it. Requirement phrases such as minimize ingestion cost, least administrative effort, without installing agents, no Group Policy changes, keep using WEF or the built-in rules must work decide between options. Expect near-twin choices: Windows Security Events versus Windows Forwarded Events, Common versus Minimal, SecurityEvent versus Event versus WindowsEvent, source-initiated versus collector-initiated subscriptions, Kerberos versus certificates, and the WEF delivery modes. Some items ask you to pick a valid XPath expression, read or complete a short KQL query, diagnose missing or duplicated events, or choose several settings that together complete a WEF configuration.SC-200 Sentinel Data Ingestion: Syslog, CEF, Azure Activity, Threat Intelligence and Custom LogsQuestions on this topic describe a SOC data source and a requirement, then ask which connector, table, role or configuration step meets it, often under a least-privilege or least-effort constraint. The distinctions that matter most are the destination table for each source, the port a device sends to versus the forwarder's internal port, when the portal's minimum log level is enough, how policy-managed diagnostic settings reach existing resources, which role each ingestion API checks, which threat intelligence table holds which objects, and when a data collection endpoint is needed. Some items ask you to pick or complete a KQL query or transformation, or to explain why a connector shows as disconnected or why data from one source is missing.SC-200 Configure Detections: Defender XDR Custom Detections, Sentinel Analytics Rules, MITRE ATT&CK and AnomaliesQuestions on this topic describe a SOC requirement and ask which detection type, frequency, query change, setting or permission meets it. Expect to fix an advanced hunting query so a custom detection gets its scope or actions, choose a frequency from the window the logic needs or from a latency requirement, and spot why Continuous (NRT) isn't offered. Sentinel items turn on interval versus lookback, event grouping, suppression and ingestion delay, NRT limits, matching analytics versus TI map templates, what Defender portal onboarding disables, the MITRE ATT&CK page's active and simulated coverage, and how anomaly rules are duplicated and promoted. Requirement phrases such as least privilege, lowest delay, without writing KQL or no duplicates usually decide between two workable options.

Other SC-200 domains

Domain 2: Respond to security incidents37% of the exam · 192 questionsDomain 3: Perform threat hunting21% of the exam · 110 questionsAll SC-200 practice questionsMixed sessions across all 3 domains — the way the real exam interleaves them.

Manage a security operations environment: your questions

Manage a security operations environment is domain 1 of the SC-200 exam guide and carries 42% of the scored content — the heaviest of the 3 domains. On a 50-question paper that works out to roughly 21 questions, though Microsoft Azure does not publish an exact per-domain count and individual exam forms vary.

Source

The domain weight and topic list on this page come from the official SC-200 exam guide.