SC-200 Microsoft · Security Operations Analyst

SC-200 practice test

Microsoft Security Operations Analyst. A full SC-200 practice exam across the October 2026 skills outline: Defender XDR and Sentinel automation, Sentinel platform and data ingestion, detections, incident response across Defender XDR and Defender for Endpoint, Microsoft 365 investigations, and KQL threat hunting, with a case study and exhibits.

  • 2 practice tests + challenge test
  • 150 questions
  • 40 questions, 100 min per test
  • Pass at 70%

Take the free SC-200 diagnostic10 questions, no card needed

Free SC-200 sample questions

3 questions from the free diagnostic, with answers and explanations.

Question 1 · Configure detections

Which type of Microsoft Sentinel analytics rule runs a KQL query on a schedule with a lookback period and creates alerts when results meet a threshold?

  1. Scheduled
  2. Anomaly
  3. Threat intelligence matching
  4. Microsoft Security incident creation
Show answer

Answer: A (Scheduled)

Scheduled rules define the query, frequency, lookback and threshold.

Question 2 · Configure detections

A scheduled rule detects malware downloads and runs every 10 minutes with a 1-hour lookback. The same download creates six alerts and incidents. Analysts want one incident per device per hour, without missing downloads on other devices. What should you configure?

  1. Alert grouping by the Host entity within a 1-hour window
  2. A 24-hour query frequency with a 10-minute lookback
  3. Removing the Host entity mapping from the rule
  4. Disabling incident creation for the rule
Show answer

Answer: A (Alert grouping by the Host entity within a 1-hour window)

Grouping alerts that share an entity into one incident removes duplicates while new devices still create incidents.

Question 3 · Respond to alerts and incidents in Microsoft Defender XDR

Where do analysts see related alerts from Defender for Endpoint, Office 365 and Identity combined into one investigation?

  1. In an incident in the Defender portal
  2. In a Compliance Manager assessment
  3. In the Azure Cost Management page
  4. In the Microsoft Entra sign-in logs for each affected user
Show answer

Answer: A (In an incident in the Defender portal)

Defender XDR correlates related alerts into incidents.

Try the full diagnostic free

What the SC-200 practice covers

Share of practice questions per skill area.

  • Respond to alerts and incidents in Microsoft Defender XDR22%
  • Configure automation for Microsoft Defender XDR and Microsoft Sentinel14%
  • Ingest data into the Microsoft Sentinel SIEM and platform12%
  • Detect threats by using Microsoft Defender XDR12%
  • Configure detections10%
  • Respond to alerts and incidents in Microsoft Defender for Endpoint10%
  • Detect threats by using the Microsoft Sentinel platform8%
  • Configure the Microsoft Sentinel SIEM and platform6%
  • Investigate Microsoft 365 activities to identify threats6%

Question formats

  • Single choice
  • Multiple select
  • Case studies
  • Exhibits (screenshots, diagrams and code)

Career path: Security Operations Analyst

Detect, investigate and respond to threats with Microsoft Defender XDR and Microsoft Sentinel: data ingestion, detections, automation, incident response and KQL threat hunting.

  1. SC-900
  2. SC-200

Guides

SC-200 practice test FAQ

Is there a free SC-200 practice test?

Yes. Create a free account and take the SC-200 free diagnostic: 10 questions across every skill area of the exam, with a study plan for the topics to work on. You can retake it as often as you like.

How many questions are in each ExamKite SC-200 practice test?

Each full practice test has 40 questions with a 100-minute timer, and you pass at 70%. There are 2 practice tests plus a harder challenge test, with 150 questions in total.

Which question formats does the SC-200 practice include?

Single choice, multiple select, case studies and exhibits (screenshots, diagrams and code), the same formats you meet on the real exam.

Are these real SC-200 exam questions?

No. They are original questions written for ExamKite and mapped to the Microsoft skills outline, never copied from the real exam. Using leaked exam questions breaks the certification provider's exam rules and can get your certification revoked.

More answers in the full FAQ.

Ready to practice for SC-200?

Start with the free diagnostic and get a study plan for the topics you miss.

Create a free account