This is the free Microsoft SC-200 practice question bank —
200 of 383 total questions, each with a full explanation, free to
read with no signup required. Updated 2026-08-06.
Every answer is verified against official Microsoft documentation —
see our methodology.
Question 1
You have a Microsoft 365 subscription that uses Microsoft Security Copilot.
You have the files shown in the following table.
Each file contains a copy of your company's compliance policy.
You need to ensure that Security Copilot responses are informed by the compliance policy.
Which files can be uploaded to Security Copilot?
A. File1.docx only
B. File3.txt only
C. File1.docx and File3.txt only
D. File2.pdf and File3.txt only
E. File1.docx, File2.pdf, and File3.txt
Show Answer
Correct Answer: D
Explanation: Security Copilot supports uploading common text-based document formats including PDF and TXT (as well as DOCX/MD), but uploaded files must also meet the size limit of 3 MB per file. From the described table, the valid uploadable files are the PDF and TXT files because they satisfy the supported format and size requirements, while the DOCX file does not meet the upload constraints.
Question 2
You have an Azure subscription that contains a Microsoft Sentinel workspace and a virtual machine named VM1. VM1 runs Linux and hosts a log forwarder that receives Syslog and Common Event Format (CEF) messages from network appliances on TCP/UDP port 514. VM1 has the Azure Monitor Agent installed and is associated with a single data collection rule (DCR) that collects Syslog facilities.
You discover that when the appliances send CEF messages by using the local0 facility, the events are ingested into both the CommonSecurityLog table and the Syslog table.
You need to prevent the CEF messages from being ingested into the Syslog table. The solution must ensure that the CEF messages are still ingested into CommonSecurityLog.
What should you use?
A. a KQL function
B. an analytics rule in Microsoft Sentinel
C. an ingestion-time transformation
D. a table-level retention setting
Show Answer
Correct Answer: C
Explanation: Use an ingestion-time transformation in the data collection rule to filter CEF-formatted events from being written to the Syslog table while still allowing the CEF connector to ingest them into CommonSecurityLog. KQL functions and analytics rules operate after ingestion and cannot prevent storage in Syslog, while retention settings only control data lifecycle after ingestion.
Question 3
You have a Microsoft Sentinel workspace named Workspace1.
In Workspace1, you create a Microsoft Sentinel workbook named WB1.
You need to add a query to WB1 that will return a list of all the watchlists in Workspace1.
To what should you set Data source for the query?
A. SQL database
B. Logs (Analytics)
C. Storage account
D. Azure Resource Graph
Show Answer
Correct Answer: D
Explanation: To enumerate Microsoft Sentinel watchlists themselves in a workbook, the query should use Azure Resource Graph because watchlists are Azure resource metadata. Logs (Analytics) is used to query Log Analytics data, including the contents of a known watchlist via functions such as _GetWatchlist(), not to list watchlist resources. SQL database and Storage account are not appropriate data sources for this task.
Question 4
You have a Microsoft Sentinel workspace named Workspace1 and a firewall named FW1. FW1 logs are ingested into Workspace1. Typically, firewall events are ingested approximately two minutes after the event occurs, and occasionally up to five minutes after.
A scheduled analytics rule runs every five minutes and queries the TimeGenerated value for the last five minutes.
You need to minimize missed detections caused by ingestion delays and prevent duplicate alerts across rule runs.
How should you change the analytics rule query?
A. Increase the rule frequency to one minute and keep the lookback window on TimeGenerated at five minutes.
B. Keep the lookback window on TimeGenerated at five minutes and add | where ingestion_time() > ago(5m).
C. Increase the lookback window on TimeGenerated to 10 minutes and add | where ingestion_time() > ago(5m).
D. Increase the lookback window on TimeGenerated to 10 minutes and do NOT add ingestion_time() filter.
Show Answer
Correct Answer: C
Explanation: To avoid missing late-arriving events, extend the TimeGenerated lookback beyond the rule interval to cover the maximum expected ingestion delay. To avoid duplicate processing across overlapping lookback windows, filter on ingestion_time() so each rule run only evaluates records newly ingested since the previous run. A 10-minute TimeGenerated window with ingestion_time() > ago(5m) matches a 5-minute schedule and up to 5-minute ingestion delay.
Question 5
You have a Microsoft 365 subscription that uses Microsoft Defender XDR. All client computers run Windows 11 and are onboarded to Microsoft Defender for Endpoint.
You have an Azure subscription that contains a Microsoft Sentinel workspace.
You need to ensure that when malware is detected on a Windows 11 computer, an investigation package is collected. The solution must minimize administrative effort.
What should you configure?
A. an automation rule
B. an automated alert response in Defender for Endpoint
C. an endpoint security policy
D. a custom detection rule
Show Answer
Correct Answer: B
Explanation: Automated investigation and response (AIR) in Microsoft Defender for Endpoint can automatically respond to malware alerts and collect an investigation package from the affected device. This is the native capability for malware-triggered investigation package collection and requires less administrative effort than orchestrating it through Microsoft Sentinel automation. Endpoint security policies configure protection settings, and custom detection rules create detections rather than handling built-in malware response.
Question 6
DRAG DROP
-
You have a Microsoft Sentinel workspace named Workspace.
You need to run a KQL query as a search job.
Which five actions should you perform in Workspace1 in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Show Answer
Correct Answer: Select Logs
Enter a KQL query and select Search job.
Enter a new table name.
Select Run a search job.
Explanation: From the Logs blade, initiate a search job from the query, provide the destination table name, then start the search job. The exam item appears to omit the date-range step from Microsoft documentation.
Question 7
You have a Microsoft 365 subscription that contains a group named Group1. The subscription uses Microsoft Defender for Endpoint.
You have 500 devices that run Windows 11. The devices are managed by using Microsoft Intune and are members of Group1.
You implement security baselines for the devices.
You discover that some devices fail to receive the security baselines.
You need to identify which devices failed to receive the security baselines and which baselines were NOT received. The solution must minimize administrative effort
Which node should you use in the Microsoft Intune admin center?
A. Endpoint security
B. Apps
C. Devices
D. Groups
Show Answer
Correct Answer: A
Explanation: The Endpoint security node provides centralized management and reporting for security baselines. From there, you can view baseline assignment status and reports to identify which devices failed to receive a baseline and which specific baselines were not applied, minimizing administrative effort. The Devices, Groups, and Apps nodes do not provide the same baseline-focused reporting.
Question 8
You have a Microsoft Sentinel workspace that contains Common Event Format (CEF) data.
You need to run a query against the CEF data.
Which table should you query?
A. Syslog
B. SecurityEvent
C. CommonSecurityLog
D. TrreatIntelligentIndicator
Show Answer
Correct Answer: C
Explanation: CEF (Common Event Format) data ingested into Microsoft Sentinel is stored in the CommonSecurityLog table. The Syslog table contains standard syslog messages, while SecurityEvent stores Windows security events and ThreatIntelligenceIndicator stores threat intelligence indicators.
Question 9
HOTSPOT
-
You have a Microsoft Sentinel workspace that contains a table named Table1. Table1 has the Analytics plan configured.
You need to configure the retention period for Table1. The solution must maximize the retention of data stored in Table1.
How should you configure the Data retention settings? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Interactive retention: 2 years
Total retention period: 12 years
Explanation: For Microsoft Sentinel/Log Analytics tables using the Analytics plan, interactive retention can be configured up to 730 days (2 years), and total retention (including long-term retention) can be extended up to 12 years.
Question 10
HOTSPOT
-
You have a Microsoft 365 subscription that uses Microsoft Defender XDR.
You plan to investigate suspicious activity in the subscription by using Microsoft Graph activity logs.
You need to search for requests to delete resources from the subscription and identify the users that initiated the requests.
How should you complete the KQL query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: First box: matches
Second box: AccountName
Explanation: Use the matches operator with a regex pattern. After joining with IdentityInfo, project AccountName to identify the user associated with the deleted user object.
$19
Get all 383 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
