How are SC-200 questions generated?

dotCreds builds SC-200 practice questions from public exam objectives and Microsoft Learn and exam-objective references. The questions are written for realistic study practice, not copied from exam dumps.

How are explanations sourced?

Each question includes an explanation and, when available, a source link back to the provider documentation or reference used to validate the answer. That keeps the practice tied to study material you can actually review.

The page tracks today's answered count and accuracy for the 10-question daily set, then saves a 7-day score history on this device so you can see your recent practice trend.

The site is the fastest way to start SC-200 practice without installing anything. It is built for daily recall, quick weak-topic discovery, and source-backed explanations you can review immediately.

Free SC-200 Practice Test

SC-200 Practice Test

Start today’s free 10-question SC-200 set with source-backed explanations, local progress, and a fresh rotation every morning.

10 Free Daily Questions Source-backed Explanations 200 Verified Questions

Questions updated at Aug 7, 2026, 10:05 AM CDT

Unlock the full SC-200 bank

200 verified questions Exam Mode Practice Mode Detailed explanations Weak-area review No subscription - one-time unlock

Get the complete source-backed bank with Interview Questions, the full Study Guide, full Course Notes, detailed explanations, weak-area review, and exam-style practice.

Interview Questions Full Study Guide Full Course Notes Exam Mode Practice Mode Guided Course Detailed explanations Weak-area review No subscription

What you get with free practice

10 Free Questions Daily Fresh set every day from the live bank

Detailed Explanations Learn with clear source-backed answers

Track Your Progress Daily history and performance insights

Upgrade Anytime Unlock the full bank when you are ready

Question 1 of 10

Objective Investigate Defender for Cloud workload and Defender for Cloud Apps alerts Respond to security incidents

An analyst closes a Defender for Cloud database alert, but the malicious login remains active in the database service. What additional step is required?

Concept tested:

Source:Microsoft Defender for Cloud security alerts

Question 2 of 10

Objective Create Advanced Hunting queries and interpret threat analytics Perform threat hunting

A second analyst must reproduce a hunt for suspicious remote-service creation in Defender XDR. What should the original hunter provide?

Concept tested:

Question 3 of 10

Objective Create and configure Microsoft Sentinel automation rules Manage a security operations environment

A Sentinel automation rule should add a tag only during a 30-day incident-response exercise. How can the team prevent stale logic afterward?

Concept tested:

Question 4 of 10

Objective Create hunting graphs and analyze entity relationships with Sentinel Graph Perform threat hunting

A hunt returns an account, three devices, and several remote connections. The analyst must estimate which assets may be reachable from the suspected account, but only relationships supported by authentication or communication evidence may be used. What should the analyst build?

Concept tested:

Question 5 of 10

Objective Use summary rules and notebooks for Sentinel threat hunting Perform threat hunting

A standard portal query cannot perform the required iterative Python enrichment with an external library. The chosen Sentinel notebook opens but cannot query the workspace. What must be fixed?

Concept tested:

Question 6 of 10

Objective Configure Defender XDR notifications, tuning, suppression, and correlation Manage a security operations environment

The Tier 1 team must receive email when a high-severity Defender XDR incident contains a device from the Finance device group. It does not need notifications merely because a response action completed or a threat report changed. What should be configured?

Concept tested:

Question 7 of 10

Objective Perform endpoint evidence investigation and respond to disrupted attacks Respond to security incidents

The SOC permits live response scripts only after code review and signing. An analyst with appropriate RBAC needs to run a remediation script on one endpoint. Which approach respects the control?

Concept tested:

Question 8 of 10

Objective Investigate and manage incidents in Microsoft Sentinel Respond to security incidents

A Sentinel case contains several related alerts. The shift lead needs one place to review mapped entities and the timeline, assign an owner, add tasks and comments, and track the investigation. What should the lead use?

Concept tested:

Question 9 of 10

Objective Manage automated investigation, response, and automatic attack disruption Manage a security operations environment

Automatic attack disruption contains an account and device during a high-confidence active attack. Before analysts change containment, where should they verify the affected assets and current disruption state?

Concept tested:

Question 10 of 10

Objective Create Sentinel hunting queries and KQL jobs in the data lake Perform threat hunting

A weekly hunt scans a year of data-lake telemetry and must save recurring aggregates for later detection logic. Which KQL job design is most appropriate?

Concept tested:

Unlock the full SC-200 bank.

Get the full bank, Exam Mode, Practice Mode, question sets, random tests, readiness tracking, saved box scores, and review tools for this exam.

The PDF versions keep questions first and move the answer review, explanations, and distractor notes to the back of the file.

200 verified exam-style questions Every choice explained Exam Mode and Practice Mode Question sets and random tests Readiness score and trends Previous test box scores

You've answered 0/10 questions in today's set.

Locked: 190 more questions in the full bank.

Locked: exam simulation mode, practice mode, readiness tracking, and saved review history.

Checkout stays on this page, so you can keep practicing, unlock the full bank, and start Exam Mode or Practice Mode when you are ready.

Cheat Sheets

Question 1 An analyst closes a Defender for Cloud database alert, but the malicious login remains active in the database service. What additional step is required?

Answer choices

A. Assume closing the alert terminates every threat
B. Change only the alert title
C. Perform the required remediation in the protected database service and verify the threat is contained
D. Delete all Defender recommendations

Correct answer

Perform the required remediation in the protected database service and verify the threat is contained

Closing an alert updates case state but may not remediate the protected workload. The analyst must take the required service-level action and verify containment.

Wrong-answer review

A. Assume closing the alert terminates every threat: Case closure does not automatically change every affected workload.
B. Change only the alert title: Renaming the alert has no containment effect in this scenario.
D. Delete all Defender recommendations: Recommendations are separate posture guidance and should not be deleted wholesale.

Extra learning features

Why this matters

Closing an alert does not automatically resolve the underlying threat, potentially leaving the system vulnerable. Immediate remediation is crucial to prevent further compromise and data loss, directly impacting operational security. This action is vital to contain the threat and prevent escalation. (34 words)

Objective/domain: Respond to security incidents

Question 2 A second analyst must reproduce a hunt for suspicious remote-service creation in Defender XDR. What should the original hunter provide?

A. The Advanced Hunting KQL plus its hypothesis, assumptions, time scope, exclusions, results, and next investigative actions
B. Only a screenshot of the row count
C. Only the incident severity
D. An undocumented query with an unlimited time range

The Advanced Hunting KQL plus its hypothesis, assumptions, time scope, exclusions, results, and next investigative actions

Objective/domain: Perform threat hunting

Source: Advanced hunting query language in Microsoft Defender XDR

Question 3 A Sentinel automation rule should add a tag only during a 30-day incident-response exercise. How can the team prevent stale logic afterward?

A. Rely on memory to delete it someday
B. Set the automation rule expiration date to the exercise end
C. Convert the rule to a permanent analytics rule
D. Disable every automation rule in the workspace

Set the automation rule expiration date to the exercise end

Objective/domain: Manage a security operations environment

Source: Automation rules in Microsoft Sentinel

Question 4 A hunt returns an account, three devices, and several remote connections. The analyst must estimate which assets may be reachable from the suspected account, but only relationships supported by authentication or communication evidence may be used. What should the analyst build?

A. A flat count of every entity sharing the same department
B. A graph that links entities solely because their names have a common prefix
C. An incident notification rule for each device
D. A hunting graph with evidence-backed edges, followed by blast-radius analysis

A hunting graph with evidence-backed edges, followed by blast-radius analysis

Source: Hunting graph in Microsoft Defender advanced hunting

Question 5 A standard portal query cannot perform the required iterative Python enrichment with an external library. The chosen Sentinel notebook opens but cannot query the workspace. What must be fixed?

A. Convert the notebook into an incident tag
B. Use a workbook theme instead of Python
C. Configure notebook authentication and workspace connection, then run the code-based analysis
D. Disable Sentinel RBAC

Configure notebook authentication and workspace connection, then run the code-based analysis

Source: Jupyter notebooks with Microsoft Sentinel hunting capabilities

Question 6 The Tier 1 team must receive email when a high-severity Defender XDR incident contains a device from the Finance device group. It does not need notifications merely because a response action completed or a threat report changed. What should be configured?

A. An incident notification rule scoped to high severity, the Finance device group, and the Tier 1 recipients
B. An action notification rule for all automated and manual response actions
C. A threat analytics notification rule for every updated threat report
D. A suppression rule that hides all Finance device alerts

An incident notification rule scoped to high severity, the Finance device group, and the Tier 1 recipients

Source: Configure email notifications in Microsoft Defender XDR

Question 7 The SOC permits live response scripts only after code review and signing. An analyst with appropriate RBAC needs to run a remediation script on one endpoint. Which approach respects the control?

A. Enable unsigned-script execution for convenience
B. Grant the analyst Global Administrator
C. Upload and run the signed approved script through live response
D. Run an unknown unsigned script outside the approved library

Upload and run the signed approved script through live response

Source: Live response in Microsoft Defender for Endpoint

Question 8 A Sentinel case contains several related alerts. The shift lead needs one place to review mapped entities and the timeline, assign an owner, add tasks and comments, and track the investigation. What should the lead use?

A. The Microsoft Sentinel incident
B. A data collection rule
C. A custom log table
D. An Azure Activity diagnostic setting

The Microsoft Sentinel incident

Source: Investigate incidents in Microsoft Sentinel

Question 9 Automatic attack disruption contains an account and device during a high-confidence active attack. Before analysts change containment, where should they verify the affected assets and current disruption state?

A. Company branding
B. A Purview content search
C. Only the newest alert email
D. The disrupted Defender XDR incident, including its graph and asset containment status

The disrupted Defender XDR incident, including its graph and asset containment status

Source: Details and Results of an Automatic Attack Disruption Action

Question 10 A weekly hunt scans a year of data-lake telemetry and must save recurring aggregates for later detection logic. Which KQL job design is most appropriate?

A. Run only an interactive analytics query and discard all output
B. Store every raw event in an incident comment
C. Schedule a data-lake KQL job whose output destination preserves the recurring results needed downstream
D. Create a workbook parameter with no scheduled query

Schedule a data-lake KQL job whose output destination preserves the recurring results needed downstream

Source: KQL jobs in the Microsoft Sentinel data lake

SC-200 Practice Test

Unlock the full SC-200 bank

Practice with explanations that teach.

What you get with free practice

An analyst closes a Defender for Cloud database alert, but the malicious login remains active in the database service. What additional step is required?

A second analyst must reproduce a hunt for suspicious remote-service creation in Defender XDR. What should the original hunter provide?

A Sentinel automation rule should add a tag only during a 30-day incident-response exercise. How can the team prevent stale logic afterward?

A hunt returns an account, three devices, and several remote connections. The analyst must estimate which assets may be reachable from the suspected account, but only relationships supported by authentication or communication evidence may be used. What should the analyst build?

A standard portal query cannot perform the required iterative Python enrichment with an external library. The chosen Sentinel notebook opens but cannot query the workspace. What must be fixed?

The Tier 1 team must receive email when a high-severity Defender XDR incident contains a device from the Finance device group. It does not need notifications merely because a response action completed or a threat report changed. What should be configured?

The SOC permits live response scripts only after code review and signing. An analyst with appropriate RBAC needs to run a remediation script on one endpoint. Which approach respects the control?

A Sentinel case contains several related alerts. The shift lead needs one place to review mapped entities and the timeline, assign an owner, add tasks and comments, and track the investigation. What should the lead use?

Automatic attack disruption contains an account and device during a high-confidence active attack. Before analysts change containment, where should they verify the affected assets and current disruption state?

A weekly hunt scans a year of data-lake telemetry and must save recurring aggregates for later detection logic. Which KQL job design is most appropriate?

You are viewing today’s free 10. Unlock 190 more questions.

Build your practice session

Set your target once.

Customize your session

Unlock the full SC-200 bank.

7-day score keeper

Keep today’s practice moving

Answer choices

Correct answer

Wrong-answer review

Extra learning features

Why this matters

Answer choices

Correct answer

Answer choices

Correct answer

Answer choices

Correct answer

Answer choices

Correct answer

Answer choices

Correct answer

Answer choices

Correct answer

Answer choices

Correct answer

Answer choices

Correct answer

Answer choices

Correct answer

How are SC-200 questions generated?

How are explanations sourced?

What score do I get?

Why use this site?