EnglishDeutschFrançaisEspañolPortuguês

Microsoft · SC-200 · Associate

Microsoft Security Operations Analyst (SC-200) — Practice Questions and Mock Exam

The SC-200 certification validates skills in threat detection, investigation, and response using Microsoft security technologies.

Practice for freeTry a practice question first
Try a practice question firstPractice for free
Start practicing SC-200 freeBuy SC-200 access for $29.99
50Questions per Pass-IT mock exam
100minPass-IT mock exam time limit

Official SC-200 exam: 700 out of 1000 points to pass.

Checked against Microsoft · August 2026 · Current exam version

Try Pass-IT

See what learning with Pass-IT is like.

Answer a SC-200 sample question and read the explanation with its source. Right here, with no sign-up.

Manage a security operations environment2 / 5

A security team wants to implement zero-day protection for email attachments. Which Defender for Office 365 feature provides this by detonating attachments in a sandboxed virtual environment?

AlexFull explanation from Alex

Safe Attachments in Microsoft Defender for Office 365 provides zero-day protection by detonating email attachments in a sandboxed virtual environment before delivery. The attachment is opened in a controlled VM where behavior is analyzed for malicious activity. Policy actions include Block (quarantine malicious attachments), Replace (deliver email without the attachment), and Dynamic Delivery (deliver email body immediately, reattach after scan completes). This catches malware that signature-based scanning cannot detect. Safe Links is a separate feature that protects against malicious URLs, not attachments. Anti-spam filtering and DLP policies do not provide sandbox detonation. Dynamic Delivery minimizes end-user delay while maintaining protection. Ref: learn.microsoft.com/microsoft-365/security/office-365-security/safe-attachments-about

Sourcelearn.microsoft.com

Perform threat hunting3 / 5

Which Microsoft Defender XDR table should you query in Advanced Hunting to find information about email-based threats including phishing and malware attachments?

AlexFull explanation from Alex

The EmailEvents table in Microsoft Defender XDR Advanced Hunting is the primary source for investigating email-based threats including phishing, malware, and spam. It contains sender/recipient information, subject lines, delivery actions (delivered, blocked, junked), and threat detection methods. Related tables provide additional detail: EmailAttachmentInfo for attachment metadata, EmailUrlInfo for URLs embedded in emails, and EmailPostDeliveryEvents for post-delivery actions like ZAP (Zero-hour Auto Purge). IdentityLogonEvents covers authentication events, CloudAppEvents covers SaaS activity, and DeviceProcessEvents covers endpoint process execution — none are email-specific. Ref: learn.microsoft.com/defender-xdr/advanced-hunting-emailevents-table

Sourcelearn.microsoft.com

Respond to security incidents4 / 5

Identify the correct Defender XDR portal location to review threat analytics reports about current active campaigns and emerging threats.

AlexFull explanation from Alex

Threat analytics in the Microsoft Defender XDR portal is an in-product threat intelligence solution from expert Microsoft security researchers. Each report covers active campaigns, emerging threats, and vulnerabilities with campaign descriptions, TTPs (tactics, techniques, procedures), indicators of compromise (IoCs), recommended mitigations, and organizational exposure assessments. Access it via the Threat analytics section in the Defender portal. It helps SOC teams understand their exposure to current threats and prioritize response. This is distinct from the Incidents queue or Secure Score, which serve different functions. Ref: learn.microsoft.com/defender-xdr/threat-analytics

Sourcelearn.microsoft.com

Perform threat hunting5 / 5

Your Microsoft Sentinel workspace is onboarded to the Microsoft Sentinel data lake. Hunter1 must create scheduled KQL jobs in the data lake. The solution must follow the principle of least privilege. What should you assign to Hunter1?

AlexFull explanation from Alex

Microsoft Sentinel splits its permissions between two systems. The SIEM side uses Azure RBAC roles such as Microsoft Sentinel Reader, Responder and Contributor. The data lake side uses Microsoft Entra ID roles for broad access. Creating and managing KQL jobs in the data lake is tied to the Entra roles Security Operator, Security Administrator and Global Administrator. Azure roles such as Log Analytics Contributor or Microsoft Sentinel Contributor can grant table or workspace permissions, but they are not the roles listed for managing jobs. Security Reader gives read access and no write access. Exam tip: data lake job management maps to Entra roles, with Security Operator as the least privileged option.

Sourcelearn.microsoft.com

How to prepare for SC-200 with Pass-IT.

Currently 421 practice questions for SC-200, with new ones added regularly. Focus on what you still need to learn.

Get past difficult questions.

Understand why an answer is correct. Alex explains the concepts and answers your follow-up questions so you can apply what you learn to the next task.

Meet Alex →

Conversation preview · SC-200

Automatic attack disruption

  1. You

    Which feature contains a high-confidence active attack before an analyst acts?

  2. Alex · AI tutor

    Automatic attack disruption in Microsoft Defender XDR.

    Read the Microsoft documentation ↗
  3. You

    Is advanced hunting the same thing?

  4. Alex · AI tutor

    No. Hunting helps analysts query and investigate. Attack disruption uses high-confidence signals to contain an active attack automatically.

    Read the Microsoft documentation ↗

Make your study time count.

Practice at your level.
For new practice sessions, Pass-IT adjusts the difficulty based on your previous answers.

Learn from mistakes.
Incorrect answers automatically become flashcards. When you review them, you rate how confidently you remember; Pass-IT schedules the next review.

See how focused practice works →

Animated feature preview

Turn your mistakes into knowledge you can rely on.

How Pass-IT works

Your review

Answered a question incorrectly?

Pass-IT saves it for your review.

SC-200 · Question excerpt

Automatic attack disruption

View the full question

Which Microsoft Defender XDR capability automatically contains an active, high-confidence attack at machine speed before an analyst intervenes?

Understand the correct answer.

Automatic attack disruption

Automatic attack disruption can contain active attacks using high-confidence signals.

Read the Microsoft documentation ↗

How confidently do you remember?

During review, you assess how well you still know the answer.

Correct after hesitating

Pass-IT schedules your next review.

The date depends on your self-assessment and previous reviews.

Simplified demonstration. No learning progress is saved.

Practice for the moment that counts.

Take a full mock exam with a time limit and find out whether you can finish in time.

Your SC-200 mock exam

Questions
50
Minutes
100

Illustration of an exam session

  1. Start
  2. Answer questions
  3. Finish

Length and time limit of the Pass-IT mock exam.

Go into your exam with more confidence.

Your Readiness Score helps you assess whether you are ready for the exam. Results by exam domain show you where you should keep practicing.

Your money back if you fail despite 80% Readiness.
If your Readiness Score is at least 80% when you take the exam and you still fail, we refund the Pass-IT purchase price for this certification.

For active, paid access. Submit proof of failing within 14 days.

Further guarantee conditions

You need at least 80% Readiness and active, paid access to the certification when you take the exam. Take the exam within your access period and submit official proof of failing within 14 days after the exam.

For purchases through Apple or Google, refunds are handled by the respective store. See the full terms for further details.

Read the guarantee terms →

The Readiness Score describes your practice progress, not a probability of passing.

Guarantee requirement

80%

At least 80% Readiness
when you take the exam

Money back if you fail

Question counts and mock exam settings from the current Pass-IT catalog.

Exam domains

What you practice for SC-200.

Exam topics, relevant practice and sources you can check.

Security operations setup40–45% of the exam191 QuestionsPass-IT questions

You connect security data, tune detections and automate routine responses.

  • Configure Defender XDR notifications and alert tuning, plus Defender for Endpoint features, rules, data collection and attack surface reduction policies.
  • Manage automated investigation, response and attack disruption, set device-group permissions and automation levels, and build Sentinel automation rules and playbooks.
  • Configure Sentinel roles, retention across data tiers and workbooks, then use optimization recommendations to improve the platform.
  • Select and configure connectors for Windows events, forwarded events, Syslog, Common Event Format and Azure activity; ingest threat indicators and create custom log tables.
  • Create and manage custom Defender XDR detections and Sentinel analytics rules, configure anomaly detection and assess attack coverage with MITRE ATT&CK.
Official Microsoft objectives
Incident investigation and response35–40% of the exam150 QuestionsPass-IT questions

You follow evidence across services and devices to investigate and contain attacks.

  • Investigate and remediate threats across Office 365, Purview, cloud workloads and apps, Entra identities, Defender for Identity and Sentinel through Defender XDR.
  • Investigate complex, multistage attacks with AI assistance such as Security Copilot, and organize incident work through case management.
  • Investigate device timelines, evidence and entities in Defender for Endpoint, collect investigation packages, use live response and remediate incidents flagged by automatic attack disruption.
  • Investigate Microsoft 365 activity with Purview Audit, content search in Purview eDiscovery and Microsoft Graph activity logs.
Official Microsoft objectives
Proactive threat hunting20–25% of the exam80 QuestionsPass-IT questions

You query security data and explore relationships to find threats that need investigation.

  • Choose the right tables and write Kusto Query Language (KQL) queries for Advanced Hunting, then interpret Defender XDR threat analytics.
  • Build hunting graphs to assess an attack’s potential reach and use Sentinel Graph to analyze relationships between entities.
  • Create and monitor Sentinel hunting queries, manage data-lake KQL jobs and summary-rule tables, and use notebooks with the Sentinel MCP Server for investigations.
Official Microsoft objectives
Question formats you can practice
Multiple Choice
Select one answer.
Multiple Response
Select multiple applicable answers.
True / False
Decide whether statements are true or false.
Drag & Drop
Match items to the appropriate targets.
Ordering
Put steps in the correct order.
Dropdown
Choose the appropriate entry from a dropdown list.

These are Pass-IT practice formats. Check the Microsoft certification page for the official exam information.

The ranges describe the weighting of exam topics. See Official Microsoft objectives for the current exam objectives.

Frequently asked questions

Your preparation

How much study time should I plan for SC-200?

For planning, Pass-IT estimates roughly 30–75 hours. Relevant experience may put you toward the lower end; starting from scratch may put you toward the higher end. Your needs may fall outside this range. This is not a time requirement from Microsoft or a promise that you will be exam-ready within that time.

Using Pass-IT

What language are Pass-IT questions in?

Questions in the app are currently in English. Translations of the sample questions on this page apply only to this preview. Check with Microsoft for the languages available for the official exam.

How long does my SC-200 access last?

Access covers this certification for 12 months. You pay once, with no automatic renewal.

When does the money-back guarantee apply?

The guarantee refunds the Pass-IT purchase price for this certification. You need eligible paid access and a Readiness Score of at least 80% from your practice results when you take the exam. This score can only reach 80% after at least 50 answered questions and is not a validated probability of passing. Take the exam during your access period and submit official proof of failing within 14 days. Guarantee terms

About the SC-200 exam

Where can I take the SC-200 exam?

Pearson VUE online proctored or at authorized testing centers worldwide.

How long is the Microsoft Security Operations Analyst exam?

The SC-200 exam has 50 questions and a 100-minute time limit.

How often do you renew SC-200?

Every year, through Microsoft's free renewal assessment on Microsoft Learn. It opens six months before your expiry date and has to be finished before that date.

What happens if you fail SC-200?

A retake is available after 24 hours. Each further attempt needs a 14-day wait, capped at five attempts in any 12 months.

Your preparation for SC-200

$29.99one-time

12 months of access for SC-200 · No automatic renewal

Buy SC-200 access

Questions in the app are currently in English.

Try 20 questions for freeFree account required. No credit card.

Already have an account? Log in

Prefer a subscription? View subscriptions →

Money back if you fail with at least 80% Readiness, for eligible purchases under the guarantee terms.

Guarantee terms

The guarantee refunds the Pass-IT purchase price for this certification. You need eligible paid access and a Readiness Score of at least 80% from your practice results when you take the exam. This score can only reach 80% after at least 50 answered questions and is not a validated probability of passing. Take the exam during your access period and submit official proof of failing within 14 days.

Full guarantee terms →

Related certifications

Administering Information Security in Microsoft 365Administering Microsoft Azure SQL SolutionsAdministering Windows ServerCollaboration Communications Systems EngineerAll Microsoft certifications →