Free Microsoft SC-200 Exam Questions
Try our Free Demo Practice Tests for Comprehensive SC-200 Exam Preparation
-
Microsoft SC-200 Exam Questions
-
Provided By: Microsoft
- Exam: Microsoft Security Operations Analyst
- Certification: Security Operations Analyst Associate
-
Total Questions: 394
-
Updated On: Jun 01, 2026
-
Rated: 4.9 |
-
Online Users: 788
-
Question 1
-
You need to ensure that you can run hunting queries to meet the Microsoft Sentinel requirements.
Which type of workspace should you create?
Answer: D
-
You need to ensure that you can run hunting queries to meet the Microsoft Sentinel requirements.
Which type of workspace should you create?
-
Question 2
-
You have a Microsoft 365 subscription.You have 1,000 Windows devices that have a third-party antivirus product installed and MicrosoftDefender Antivirus in passive mode. You need to ensure that the devices are protected frommalicious artifacts that were undetected by the third-party antivirus product. Solution: You configureControlled folder access. Does this meet the goal?
Answer: B
-
You have a Microsoft 365 subscription.You have 1,000 Windows devices that have a third-party antivirus product installed and MicrosoftDefender Antivirus in passive mode. You need to ensure that the devices are protected frommalicious artifacts that were undetected by the third-party antivirus product. Solution: You configureControlled folder access. Does this meet the goal?
-
Question 3
-
You need to modify the anomaly detection policy settings to meet the Microsoft Defender for Cloud Apps requirements and resolve the reported problem.
Which policy should you modify?
Answer: D
-
You need to modify the anomaly detection policy settings to meet the Microsoft Defender for Cloud Apps requirements and resolve the reported problem.
Which policy should you modify?
-
Question 4
-
You need to restrict cloud apps running on CLIENT1 to meet the Microsoft Defender for Endpoint
requirements.Which two configurations should you modify? Each correct answer present part of the solution.
NOTE: Each correct selection is worth one point.
Answer: C,D
-
You need to restrict cloud apps running on CLIENT1 to meet the Microsoft Defender for Endpoint
requirements.Which two configurations should you modify? Each correct answer present part of the solution.
NOTE: Each correct selection is worth one point.
-
Question 5
-
You have an Azure subscription.
You need to stream the Microsoft Graph activity logs to a third-party security information and event management (SIEM) tool. The solution must minimize administrative effort.
To where should you stream the logs?
Answer: A
-
You have an Azure subscription.