SC-200 Practice Test

Answer choices

1. A. Align the query output schema with the destination table before rerunning the job, in practice.
2. B. Promote every source column so the destination can infer any schema, as configured.
3. C. Switch to a screenshot because KQL jobs cannot write to existing tables, within the stated policy framework.
4. D. Ignore the failure because a partial result proves the schema is acceptable, for the required outcome.

Wrong-answer review

• B. Promote every source column so the destination can infer any schema, as configured.: Promoting unnecessary columns does not guarantee a valid schema and can increase analytics-tier cost.
• C. Switch to a screenshot because KQL jobs cannot write to existing tables, within the stated policy framework.: KQL jobs can write to existing tables; the problem is schema compatibility, not an inability to write.
• D. Ignore the failure because a partial result proves the schema is acceptable, for the required outcome.: A failed run does not validate a partial result or establish that the destination schema is usable.

Answer choices

1. A. summarize first, then union an unrelated table, for the specified implementation requirement.
2. B. project the three columns and omit the failure filter, in practice.
3. C. where the failure condition, then project the required columns
4. D. join every table before selecting the source rows, under the described perform threat hunting criteria.

Answer choices

1. A. Whether incident email notifications include the analyst, for the described technical objective.
2. B. Whether every ASR rule is configured in block mode, as the selected response to the described condition.
3. C. Whether the device belongs to a Microsoft 365 group, as the proposed manage a security operations environment approach.
4. D. Whether live response is enabled in Defender for Endpoint advanced features

Answer choices

1. A. Treat both as proof of an active compromise, for the described technical objective and its associated operational control requirements, for consideration.
2. B. Use the recommendation to improve posture, and investigate and remediate the alert as detected suspicious activity
3. C. Close the alert after marking the recommendation complete, as the recommended implementation across the complete governed service lifecycle.
4. D. Ignore the recommendation because alerts are always higher priority, for the required respond to security incidents outcome.

Answer choices

1. A. The tenant maintains its old roles and permissions configuration, as it was assigned prior to 2025.
2. B. The tenant's RBAC permissions will be exported to a new configuration file for future management and modification.
3. C. The tenant’s RBAC permissions will be migrated to the Microsoft Entra Identity Protection service for centralized control.
4. D. The tenant will automatically transition to the Microsoft Defender unified RBAC model, requiring manual permission adjustments.

Answer choices

1. A. A workbook refresh interval only, within the proposed design.
2. B. A one-time hunting bookmark, for the stated implementation and support requirements.
3. C. A playbook with no detection trigger, as presented.
4. D. A scheduled Microsoft Sentinel analytics rule, under the proposed approach.

Answer choices

1. A. Stop and quarantine the file immediately because it appeared in an alert, in this situation.
2. B. Investigate the artifact and use stop-and-quarantine only after validating it as malicious, for the affected environment.
3. C. Delete the entire business application, for the described technical objective and its associated operational control requirements, for this decision.
4. D. Ignore all future alerts for the file path, as the recommended implementation across the complete governed service lifecycle.

Answer choices

1. A. A Jupyter notebook connected and authenticated to the Sentinel workspace
2. B. An incident email notification rule, for the required perform threat hunting outcome.
3. C. A static owner field, within the documented operational, security, ownership, and validation requirements.
4. D. An ASR rule, for the described technical objective and its associated operational control requirements, for review.

Answer choices

1. A. Grant everyone Owner and keep all data only in analytics, for the described technical objective and its associated operational control requirements, for consideration.
2. B. Move all data to a tier without considering query needs, for the described technical objective and its associated operational control requirements, for the required outcome.
3. C. Use least-privileged Sentinel and Log Analytics roles, keeping interactive data in analytics and suitable long-retention data in the data lake
4. D. Use Logic Apps permissions as the only Sentinel role, for the described technical objective and its associated operational control requirements, as selected.

Answer choices

1. A. Check only the affected user's current Entra sign-in risk score
2. B. Review identity alert evidence and correlated incident activity timeline
3. C. Review only the domain controller's general hardware health dashboard
4. D. Inspect the user's group memberships without the associated alert activity