Coding N Concepts
Security Operations Analyst (SC-200) Exam Questions
Page content
Comprehensive list of Free Security Operations Analyst Associate (SC-200) exam questions, grouped by official exam domain, curated for cracking the exam with confidence.
Disclaimer: Microsoft Azure is a protected Brand. These exam questions are neither endorsed by nor affiliated with Microsoft. These are not the official Microsoft exam questions/dumps. These questions are created from the web resources of Microsoft Learn. These questions cover all the domains/objectives of the SC-200 official exam, officially titled “Microsoft Security Operations Analyst,” and once you go through these questions and their concepts, you are more than ready to crack the exam in first attempt.
Note: SC-200 is still Microsoft’s current, active exam for the Security Operations Analyst Associate credential. Don’t confuse it with SC-401 (Information Security Administrator Associate), which is a different certification focused on Microsoft Purview information protection and data loss prevention. Microsoft is refreshing the English version of SC-200 on October 21, 2026. The change log lists only minor changes, all in the “Ingest data into the Microsoft Sentinel SIEM and platform” skill area, and the three domains and their weights stay the same, so these questions apply before and after the update. The exam now covers the unified Microsoft Defender portal throughout: Microsoft Sentinel’s data lake and graph, KQL jobs, summary rules, the Sentinel MCP server, case management, and the Security Copilot features built into Defender.
Overview
- This is an Associate level certification for Security Operations Analysts. It’s for people who reduce organizational risk by triaging alerts, responding to incidents, hunting for threats, and engineering detections with Microsoft Defender XDR, Microsoft Sentinel, Microsoft Entra ID, Microsoft Purview, and Microsoft Defender for Cloud workload protections.
- There is no formal prerequisite exam. Microsoft recommends familiarity with Microsoft security, compliance, and identity solutions, Microsoft 365, Azure cloud services, AI agents and Copilots, and Windows, Linux, and mobile operating systems. SC-900 is a good fundamentals-level starting point.
- Exam code is SC-200 (Microsoft Security Operations Analyst). Cost varies by country/region. You can retake the exam 24 hours after a first failed attempt, and longer waiting periods apply to later retakes.
- Exam duration is 100 minutes. The exam is proctored and includes interactive components, and question types include multiple choice and multiple response (“choose 2”) items. Microsoft doesn’t publish a fixed question count.
- Passing score is 700 (out of 1000).
- The current skills outline is dated October 21, 2026. Its three domains are weighted at 40–45%, 35–40%, and 20–25%.
- Like other Microsoft Associate certifications, it is valid for 1 year and can be renewed for free by passing an online assessment on Microsoft Learn before it expires.
- Study Guide and certification page for more details.
50 Practice Questions
| # | Domain | Weight | Questions below |
|---|---|---|---|
| 1 | Manage a security operations environment | 42% | 21 |
| 2 | Respond to security incidents | 36% | 18 |
| 3 | Perform threat hunting | 22% | 11 |
Domain 1: Manage a security operations environment (42%)
A SOC manager wants the on-call lead emailed whenever a High severity incident is created in Microsoft Defender XDR. The lead should get one email per incident rather than a new email every time another alert is correlated into it. A regional analyst who is scoped by RBAC to only the “APAC” device groups is also on the recipient list and should only hear about incidents for devices they’re allowed to see. What should be configured?
⬜ A. An alert notification rule in Defender for Endpoint for every device group, set to all severities
✅ B. An incident email notification rule in Microsoft Defender XDR, filtered to High severity with “Send only one notification per incident” enabled
⬜ C. A Microsoft Sentinel automation rule that runs a playbook to email the lead for every new alert
⬜ D. Threat analytics email notifications for newly published reports
Correct answer: B
Incident email notification rules in Defender XDR can be filtered by severity, device groups, service sources, and detection sources. The Send only one notification per incident option sends a single email per incident instead of one per correlated alert. Notifications also respect RBAC, so recipients only get emails for device groups they’re authorized to access.
Why other options are incorrect
A. Alert notification rules send an email for individual alerts, not one consolidated email per incident. Including all severities also doesn’t meet the High-only requirement.
C. An alert-level playbook would email on every alert, which is the noise the manager wants to avoid, and it takes custom automation that the built-in rule doesn’t need.
D. Threat analytics notifications tell you when threat intelligence reports are published or updated. They aren’t about incidents in your own tenant.
Source: Get incident notifications by email in Microsoft Defender XDR
A vulnerability-scanning server runs an authorized PowerShell-based inventory script every night, and Microsoft Defender XDR raises the same low-fidelity alert for it each time. The SOC has confirmed the activity is benign. They want new alerts that match this exact condition to be resolved automatically so they stop cluttering the queue, but the detection must stay active for every other device. What should the SOC configure?
⬜ A. Turn the detection off for the whole tenant in Defender for Endpoint advanced features
⬜ B. Set the automation level for every device group to “No automated response”
✅ C. An alert tuning rule (formerly alert suppression) with the “Resolve alert” action, scoped to the matching conditions
⬜ D. An “Allow” file indicator for powershell.exe across the organization
Correct answer: C
Alert tuning rules, formerly called alert suppression rules, let you define conditions (such as a specific device, file, or command line) that match known benign activity and apply an action such as Hide alert or Resolve alert. The detection keeps running everywhere else, and only matching alerts are handled automatically.
Why other options are incorrect
A. Advanced features toggle platform capabilities such as live response or tamper protection. They aren’t per-detection switches, and turning off detection coverage tenant-wide would create a blind spot.
B. Automation levels control how automated investigation and remediation acts on threats. Setting “No automated response” weakens your security posture and does nothing to reduce this alert.
D. An organization-wide “Allow” indicator for a system binary like PowerShell is far too broad and dangerous, and it isn’t how you tune a single benign alert pattern.
Tier-3 responders need to run an in-house, unsigned PowerShell collection script through live response on both Windows 11 workstations and Windows Server machines. Live response sessions already work on workstations, but responders can’t open sessions on servers, and the unsigned script is refused even on workstations. Which Microsoft Defender for Endpoint advanced features must be turned on in addition to “Live response”?
⬜ A. Tamper protection and EDR in block mode
✅ B. Live response for servers, and Live response unsigned script execution
⬜ C. Automatically resolve alerts, and Allow or block file
⬜ D. Web content filtering, and Custom network indicators
Correct answer: B
In Settings > Endpoints > Advanced features, Live response for servers extends live response sessions to server endpoints. Live response unsigned script execution allows unsigned scripts to run in a session. Both are separate from the base Live response toggle.
Why other options are incorrect
A. Tamper protection locks Defender Antivirus settings, and EDR in block mode blocks malicious artifacts when Defender Antivirus is passive. Neither affects live response.
C. Automatically resolve alerts closes alerts with no threats found or with threats remediated, and Allow or block file enables file indicators. Neither affects live response.
D. Web content filtering and custom network indicators control web and network access. They have nothing to do with remote shell sessions or script execution.
Source: Configure advanced features in Microsoft Defender for Endpoint
A security team wants to enable the attack surface reduction (ASR) rule “Block all Office applications from creating child processes,” but the finance department relies heavily on legacy macros. Before blocking anything, the team wants to measure exactly which processes the rule would have stopped, without affecting users at all, and then review the results in advanced hunting. What should they do?
✅ A. Deploy the rule in Audit mode, then query advanced hunting for the AsrOfficeChildProcessAudited action type
⬜ B. Deploy the rule in Warn mode so users can decide whether to continue
⬜ C. Deploy the rule in Block mode with all Office applications added as exclusions
⬜ D. Leave the rule off and rely on EDR in block mode to report what would have been blocked
Correct answer: A
Audit mode evaluates the ASR rule and records what it would have blocked without interrupting the user. Each rule has its own advanced hunting action types. For this rule they are AsrOfficeChildProcessAudited and AsrOfficeChildProcessBlocked, so the audited events can be queried to size the impact before switching to Block.
Why other options are incorrect
B. Warn mode still blocks the action and shows the user a prompt they can bypass. That affects users, which the team explicitly wants to avoid.
C. Excluding every Office application makes the rule meaningless, because nothing would be evaluated.
D. EDR in block mode acts on malicious artifacts when Defender Antivirus is in passive mode. It doesn’t simulate or report on ASR rule behavior.
An analyst creates a Microsoft Defender for Endpoint file hash indicator with the “Block and remediate” action for a malicious executable. Hours later, the file still runs on onboarded Windows devices where Microsoft Defender Antivirus is in active mode. The analyst discovers that one tenant-level setting was never turned on. What is the most likely fix?
⬜ A. Recreate the indicator as a certificate indicator with the “Warn” action
⬜ B. Request an increase to the tenant’s 15,000-indicator limit
⬜ C. Convert the indicator into a custom network indicator for the file’s download URL
✅ D. Turn on the “Allow or block file” advanced feature and make sure cloud-delivered protection is enabled
Correct answer: D
File indicators are only enforced when the Allow or block file advanced feature is on and cloud protection is enabled. Without them, a correctly configured file hash indicator doesn’t block execution.
Why other options are incorrect
A. Certificate indicators only support Allow and Block and remediate, so “Warn” isn’t available. Switching indicator types also doesn’t fix the missing tenant setting.
B. The 15,000-indicator limit per tenant can’t be increased, and hitting it isn’t what’s happening here.
C. A URL indicator would block the download location but not a copy of the file that’s already on the device, and it doesn’t address why file indicators aren’t enforced.
Source: Overview of indicators in Microsoft Defender for Endpoint
A company wants automated investigation and remediation (AIR) in Microsoft Defender for Endpoint to remediate malicious files automatically in most locations. However, any remediation that touches files in core operating system directories such as \windows\* must wait for an analyst’s approval in the Action center. Which automation level should be assigned to the relevant device group?
⬜ A. Full - remediate threats automatically
✅ B. Semi - require approval for core folders remediation
⬜ C. Semi - require approval for all folders
⬜ D. No automated response
Correct answer: B
Semi - require approval for core folders remediation requires approval only for remediation actions on files in core OS directories (for example \windows\*). Remediation elsewhere happens automatically. Automation levels are assigned per device group.
Why other options are incorrect
A. Full automation remediates everything automatically, including core folders, with no approval step.
C. Semi – all folders requires approval for every remediation action, which is stricter than required.
D. No automated response runs no automated investigations at all. Microsoft doesn’t recommend it because it weakens your security posture.
Source: Automation levels in automated investigation and remediation capabilities
A company has turned on automatic attack disruption in Microsoft Defender XDR. The payroll team is worried that a critical service account running overnight batch jobs could be disabled or contained automatically during a suspected attack, causing a payroll outage. They want disruption to keep protecting every other user and device, but never act automatically on that one account. What should the SOC do?
✅ A. Add the service account to the automated response exclusions for attack disruption
⬜ B. Turn off automatic attack disruption for the whole tenant
⬜ C. Set every Defender for Endpoint device group to “No automated response”
⬜ D. Tag the service account as a sensitive account in Microsoft Defender for Identity
Correct answer: A
Attack disruption supports exclusions for specific users, devices, and IP addresses. Critical assets that must never be contained or disabled automatically can be excluded, while protection stays on for everything else. Any disruption action that does run can be undone from the Action center.
Why other options are incorrect
B. Turning disruption off tenant-wide removes a high-confidence, automated defense against ransomware, BEC, and AiTM attacks for every asset, which goes far beyond what’s needed.
C. Device group automation levels control Defender for Endpoint AIR. They don’t target one identity, and setting “No automated response” everywhere weakens security.
D. Marking an account as sensitive increases scrutiny of it. It doesn’t exclude the account from automated disruption actions.
Source: Automatic attack disruption in Microsoft Defender XDR
An authorized penetration test runs for five days. During it, a Microsoft Sentinel analytics rule will repeatedly generate incidents involving the testers’ IP address. The SOC wants those specific incidents closed automatically as Benign Positive during the test window only. They don’t want to modify or disable the analytics rule, and the auto-closing should stop by itself when the test ends. What should they create?
⬜ A. Disable the analytics rule for five days and re-enable it afterward
⬜ B. Turn on query suppression in the analytics rule’s settings
✅ C. An automation rule, triggered when an incident is created, with conditions on the analytics rule and the tester IP entity, a “Change status to Closed” action, and an expiration date set to the end of the test
⬜ D. A playbook that analysts run manually on each incident
Correct answer: C
Automation rules can match on conditions such as the analytics rule name and entity values, and can change status, severity, owner, or tags without code. An automation rule can also be given an expiration date, which Microsoft describes as useful for time-limited suppression during penetration tests or maintenance windows.
Why other options are incorrect
A. Disabling the rule stops all detection from it, so a real attacker using the same technique during those five days would be missed.
B. Query suppression stops the rule running for up to 24 hours after an alert. It can’t target just the tester IP, and it can’t cover a five-day window.
D. Running a playbook by hand on every incident is manual work, not automation. It also closes nothing on its own.
Source: Automate threat response in Microsoft Sentinel with automation rules
A security engineer builds a Microsoft Sentinel playbook in a dedicated “SOC-Playbooks” resource group and tries to add it to an automation rule. The playbook can’t be selected, and Sentinel reports that it doesn’t have permissions on that resource group. What must be done so automation rules can run playbooks from this resource group?
⬜ A. Assign the engineer the Microsoft Sentinel Playbook Operator role on the resource group
✅ B. Have an Owner or User Access Administrator grant Microsoft Sentinel the Microsoft Sentinel Automation Contributor role on the SOC-Playbooks resource group
⬜ C. Assign the engineer the Logic App Contributor role on the Sentinel workspace
⬜ D. Rebuild the playbook as a Standard logic app instead of Consumption
Correct answer: B
Microsoft Sentinel runs playbooks through its own service account. That account needs the Microsoft Sentinel Automation Contributor role on the resource group containing the playbooks, and someone with Owner or User Access Administrator rights has to grant it. This applies to both Consumption and Standard logic apps.
Why other options are incorrect
A. Playbook Operator lets a human list and manually run playbooks. It doesn’t give the Sentinel service account permission to run them from automation rules.
C. Logic App Contributor lets a user create and edit playbooks, but it doesn’t grant Sentinel itself permission to run them.
D. Both Consumption and Standard logic apps require the Automation Contributor role for Sentinel to run them, so changing the plan doesn’t help.
Source: Automate threat response with playbooks in Microsoft Sentinel
New tier-1 analysts in Microsoft Sentinel must be able to assign, tag, and close incidents and manually run existing playbooks on alerts and entities. They must not be able to create or edit analytics rules or edit playbooks. Following least privilege, which two roles should they be assigned? (Choose 2.)
✅ A. Microsoft Sentinel Responder
⬜ B. Microsoft Sentinel Contributor
✅ C. Microsoft Sentinel Playbook Operator
⬜ D. Logic App Contributor
Correct answer: A and C
Microsoft Sentinel Responder has all Reader permissions plus the ability to manage incidents. Microsoft Sentinel Playbook Operator can list, view, and manually run playbooks but not create or edit them. Microsoft’s recommended assignment for security analysts is exactly this pair.
Why other options are incorrect
B. Contributor adds the ability to create and edit analytics rules, workbooks, and other resources and to manage Content hub, which is more than required.
D. Logic App Contributor lets a user create and edit playbooks, which the analysts must not be able to do.
Source: Roles and permissions in the Microsoft Sentinel platform
A regulator requires a bank to keep firewall logs for seven years. The SOC only needs those logs for real-time analytics and hunting for the most recent 90 days, and older data is queried only occasionally for forensic investigations. What is the most cost-effective way to meet both requirements in Microsoft Sentinel?
⬜ A. Set analytics tier retention on the firewall table to seven years
✅ B. Keep analytics tier retention at 90 days and extend total retention in the Microsoft Sentinel data lake tier to seven years
⬜ C. Rely on Defender XDR advanced hunting, which keeps data for seven years by default
⬜ D. Set the table to the XDR default tier, which retains data indefinitely at no cost
Correct answer: B
Analytics tier data is mirrored to the data lake for the same retention period by default. Retention in the lake can then be extended, at low cost, to up to 12 years in total. The analytics tier stays short for high-performance detection and hunting, and the lake covers long-term compliance and forensics.
Why other options are incorrect
A. Analytics tier retention maxes out at two years, and it’s the most expensive place to keep rarely used data.
C. Native Defender XDR data is kept for 30 days by default, not seven years.
D. The XDR default tier keeps data for 30 days, and extending it beyond that has a cost. It isn’t indefinite free retention.
Source: Manage data tiers and retention in Microsoft Sentinel
A SOC manager is under pressure to reduce Microsoft Sentinel ingestion costs. They want built-in guidance tailored to their own workspace that shows which ingested tables deliver little security value (for example, tables not used by any analytics rules), and where detection coverage is weak for specific attack types such as human-operated ransomware. Which feature should they use?
⬜ A. Azure Advisor cost recommendations
⬜ B. The Microsoft Sentinel workbooks gallery
✅ C. SOC optimization recommendations
⬜ D. The Content hub “installed solutions” list
Correct answer: C
SOC optimization offers data value recommendations, which point out ingested data with low security value, and coverage recommendations, which include threat-based recommendations that close gaps against specific attack types. Recommendations are tailored to the environment and recalculated every 24 hours.
Why other options are incorrect
A. Azure Advisor gives general Azure cost and reliability guidance. It doesn’t know which Sentinel tables your analytics rules use, and it doesn’t assess threat coverage.
B. Workbooks are visualizations you build or install. They don’t produce prioritized optimization recommendations.
D. The Content hub lists what solutions are installed, not how much value your ingested data delivers or where your detection gaps are.
An organization runs its domain controllers on premises, not in Azure. To control costs, it wants Microsoft Sentinel to collect only a specific set of Windows Security event IDs (such as 4624, 4625, and 4688) from those servers using the currently supported agent. What should the engineer do?
⬜ A. Install the legacy Log Analytics agent and choose the “Common” event set
⬜ B. Configure the Syslog via AMA connector on each domain controller
✅ C. Onboard the servers to Azure Arc, then use the Windows Security Events via AMA connector with the “Custom” event set and XPath queries in the data collection rule
⬜ D. Use the Windows Security Events via AMA connector with the “All” event set and delete unwanted rows after ingestion
Correct answer: C
The Windows Security Events via AMA connector collects from Azure and non-Azure machines, and non-Azure machines must be Azure Arc-enabled. It offers All, Common, Minimal, and Custom event sets. Custom uses XPath filtering in the data collection rule to collect exactly the event IDs you specify, and the events land in the SecurityEvent table.
Why other options are incorrect
A. The legacy Log Analytics agent has been retired and replaced by the Azure Monitor Agent. “Common” is also a predefined set, not an exact list of event IDs.
B. Syslog is a Linux/network-device logging protocol. It isn’t how Windows Security events are collected.
D. Collecting “All” and cleaning up afterward means paying to ingest data you don’t want. Filtering at collection time with a custom XPath is the cost-effective approach.
Source: Windows Security Events via AMA connector for Microsoft Sentinel
A Linux log forwarder runs the Azure Monitor Agent with two data collection rules: one for the Common Event Format (CEF) via AMA connector and one for the Syslog via AMA connector. Both collect the local4 facility. The SOC notices that every firewall event now appears twice, once in CommonSecurityLog and once in Syslog. What is the correct fix?
⬜ A. Change the syslog daemon’s listening port from 514 to 28330
✅ B. Stop using the same facility in both the CEF via AMA and Syslog via AMA data collection rules
⬜ C. Replace rsyslog with syslog-ng on the forwarder
⬜ D. Move the log forwarder to a Windows Server machine
Correct answer: B
Microsoft warns not to use the same facility for both the Syslog via AMA and CEF via AMA connectors, because the same messages are then ingested twice. CEF messages belong in CommonSecurityLog and plain syslog in Syslog, so each facility should be collected by only one of them.
Why other options are incorrect
A. Port 514 is where the daemon listens for remote messages, and 28330 is the internal port used to forward to AMA. Changing ports doesn’t remove the duplicate facility collection.
C. Both rsyslog and syslog-ng are supported daemons. Switching between them doesn’t change the overlapping DCR configuration.
D. The syslog/CEF forwarder architecture is Linux-based. Moving it to Windows isn’t supported and doesn’t address the duplication.
Source: Ingest syslog and CEF messages to Microsoft Sentinel with the Azure Monitor Agent
A Sentinel engineer uses the Azure Policy-based configuration to stream Azure activity logs and resource diagnostic logs into the Sentinel workspace. Resources created after the policy assignment send logs as expected, but resources that already existed before the assignment send nothing. What did the engineer miss?
✅ A. Selecting “Create a remediation task” on the Remediation tab so the policy is also applied to existing resources
⬜ B. Assigning the Microsoft Sentinel Responder role to every subscription owner
⬜ C. Installing the Azure Monitor Agent on every existing Azure resource
⬜ D. Waiting 14 days for Azure Policy to back-fill existing resources automatically
Correct answer: A
With Azure Policy-managed, diagnostic settings-based connectors, the policy applies to resources added in the future. To apply it to resources that already exist, you must select Create a remediation task on the Remediation tab. The Azure Activity connector now uses this diagnostic settings pipeline, and any subscriptions still connected through the legacy method must be disconnected first.
Why other options are incorrect
B. Sentinel Responder is an incident-management role. It has nothing to do with deploying diagnostic settings.
C. Azure activity and resource logs are streamed through diagnostic settings, not through an agent installed on each resource.
D. Azure Policy doesn’t remediate existing resources automatically after a delay. The 14-day figure refers to how long this connector type shows as “connected” after data was last ingested.
A financial-sector information sharing group publishes STIX threat indicators from a TAXII 2.1 server. The SOC wants those indicators imported into Microsoft Sentinel automatically and refreshed on a schedule. Besides installing the Threat Intelligence solution from Content hub, what information is needed to configure the import connector?
⬜ A. The partner’s Azure subscription ID and a shared Log Analytics workspace key
⬜ B. A storage account SAS token for a container holding STIX bundle files
⬜ C. A Microsoft Defender for Endpoint API client secret for custom indicators
✅ D. The TAXII server’s API root URL and collection ID, plus a username and password if the server requires them
Correct answer: D
The Threat Intelligence – TAXII data connector supports TAXII 2.0 and 2.1 servers. It’s configured with the server’s API root URL and collection ID, credentials if required, and a polling frequency. Some TAXII servers also require the Sentinel connector’s IP addresses to be allowlisted.
Why other options are incorrect
A. TAXII import doesn’t involve the partner’s Azure subscription or sharing workspace keys.
B. The TAXII connector polls a TAXII server over its API. It doesn’t read STIX files from a storage container.
C. Defender for Endpoint custom indicators are a separate endpoint feature and aren’t used to import TAXII feeds into Sentinel.
Source: Use STIX/TAXII to import and export threat intelligence in Microsoft Sentinel
A Sentinel engineer needs a new custom table in the Log Analytics workspace to hold JSON logs from an in-house application that will be sent through the Logs ingestion API. They create it in the Azure portal. Which statement about the resulting table is correct?
⬜ A. The table name automatically gets a _CF suffix
✅ B. The table name gets a _CL suffix, and creating it in the portal involves a data collection rule, a data collection endpoint, and a sample JSON file to define the schema
⬜ C. Custom tables must use the Basic plan and can’t use the Analytics plan
⬜ D. The table doesn’t need a TimeGenerated column, because timestamps are optional in Azure Monitor Logs
Correct answer: B
Custom tables use the _CL suffix, which the portal adds automatically. Creating a DCR-based custom table in the portal involves choosing a plan, creating or selecting a data collection rule and data collection endpoint, and uploading a sample JSON file so the schema (and optional KQL transformation) can be defined.
Why other options are incorrect
A. _CF is the suffix for custom columns added to Azure tables, not for custom table names.
C. Analytics is the default plan. Basic and Auxiliary are optional lower-cost plans, not requirements.
D. TimeGenerated is a required column and is added automatically if it’s missing.
Source: Add or delete tables and columns in Azure Monitor Logs
A threat hunter wants to turn an advanced hunting query on the DeviceProcessEvents table into a Microsoft Defender XDR custom detection rule that automatically isolates the affected device. The query currently projects only DeviceName and ProcessCommandLine, and the rule can’t be set up properly. Which columns should the query return?
⬜ A. AlertId and IncidentId
⬜ B. Only TimeGenerated
✅ C. Timestamp, ReportId, and DeviceId
⬜ D. SentinelScope_CF
Correct answer: C
Custom detection queries need a timestamp column (Timestamp or TimeGenerated) for the alert time. For Defender for Endpoint tables they also need DeviceId, which gives the correct device group scope and enables device response actions such as isolation, and ReportId, which links the alert back to the original event.
Why other options are incorrect
A. Alert and incident IDs are outputs of a detection. The query’s source events don’t have them.
B. A timestamp alone doesn’t identify the device, so device-level response actions can’t target it.
D. SentinelScope_CF is only needed to scope alerts on Microsoft Sentinel data. It doesn’t replace the device and event identifiers required for Defender for Endpoint data.
Source: Create custom detection rules in Microsoft Defender XDR
A security team must be alerted within roughly a minute or two whenever an emergency “break-glass” administrator account signs in. The detection runs in Microsoft Sentinel against sign-in logs, which arrive with low ingestion delay. Which type of Sentinel analytics rule fits this requirement best?
✅ A. A near-real-time (NRT) analytics rule
⬜ B. A scheduled analytics rule with the query frequency set to 1 minute
⬜ C. A customizable anomaly rule in Production mode
⬜ D. A summary rule that aggregates sign-ins every 20 minutes
Correct answer: A
NRT rules are hard-coded to run every minute, look at events ingested in the preceding minute, and have only a two-minute built-in delay, compared with five minutes for scheduled rules. That makes them the fastest analytics rule type in Sentinel. There’s a limit of 50 NRT rules per customer.
Why other options are incorrect
B. Scheduled rules can’t run more often than every 5 minutes, and they have a longer built-in ingestion delay.
C. Anomalies are behavioral signals written to the Anomalies table for hunting and enrichment. They aren’t a guaranteed one-minute alert for a specific account sign-in.
D. Summary rules aggregate data into custom tables on schedules of 20 minutes or longer. They’re a data aggregation feature, not a real-time detection.
Source: Quick threat detection with near-real-time (NRT) analytics rules in Microsoft Sentinel
A detection engineering lead wants a matrix view of which MITRE ATT&CK techniques are covered by the scheduled and near-real-time rules currently enabled in Microsoft Sentinel. They also want to see how much coverage they would gain by enabling the analytics rule templates they haven’t turned on yet. Which Sentinel feature provides this?
⬜ A. Threat analytics reports in Microsoft Defender XDR
⬜ B. The UEBA entity page for the organization’s top users
⬜ C. The Content hub solution details page
✅ D. The MITRE ATT&CK page, showing active and simulated coverage
Correct answer: D
The MITRE ATT&CK page shows active coverage from enabled scheduled and NRT rules mapped to tactics and techniques. It also shows simulated coverage for available detections that aren’t configured yet, so gaps and potential improvements are visible in one matrix.
Why other options are incorrect
A. Threat analytics reports describe specific threats, actors, and techniques. They don’t map your own rule inventory onto the ATT&CK matrix.
B. UEBA entity pages show behavior and insights for individual users or hosts, not detection coverage.
C. Content hub describes what a solution contains, but it doesn’t visualize organization-wide ATT&CK coverage of active versus available rules.
A built-in Microsoft Sentinel anomaly rule generates far more anomalies than the SOC considers useful. The team wants to raise its threshold, compare the tuned version’s results against the original for a while, and only then swap it in. What is the correct approach?
⬜ A. Edit the threshold directly on the built-in anomaly rule and save it
✅ B. Duplicate the anomaly rule, adjust the threshold on the customized copy, run it in Flighting mode alongside the original, then switch it to Production
⬜ C. Convert the anomaly rule into a near-real-time (NRT) rule
⬜ D. Disable UEBA so the anomaly rule stops generating results
Correct answer: B
Out-of-the-box anomaly rules can’t be edited directly. You duplicate the rule, which creates a disabled copy with a “Customized” suffix, tune its parameters and threshold, and run it in Flighting mode to compare results with the original in the Anomalies table. When you’re satisfied, you promote the copy to Production.
Why other options are incorrect
A. Built-in anomaly rules aren’t directly editable, which is why the duplicate-and-flight workflow exists.
C. Anomaly rules are machine-learning based and can’t be converted into NRT KQL rules.
D. Turning off features to silence noise removes detection capability instead of tuning it.
Source: Work with anomaly detection analytics rules in Microsoft Sentinel
Domain 2: Respond to security incidents (36%)
A credential-phishing email was delivered to 350 mailboxes before detection caught up. Using Microsoft Defender for Office 365 Plan 2, the SOC wants to remove every delivered copy from users’ mailboxes in one bulk operation while keeping the ability to recover messages if any turn out to be legitimate. What should the analyst do?
⬜ A. Create an Exchange mail flow rule to block the sender going forward
✅ B. In Threat Explorer, select the messages and use Take action to soft delete them (or move them to Deleted items), with the action tracked in the Action center
⬜ C. Ask every affected user to report the message as junk
⬜ D. Add the sender’s domain to the Tenant Allow/Block List and wait for it to purge delivered mail
Correct answer: B
Threat Explorer’s Take action wizard can move or delete delivered messages in bulk: to Junk, Inbox, Deleted items, soft deleted items, or hard delete. Soft delete keeps the messages recoverable. Actions are submitted to and tracked in the Action center, where some require approval.
Why other options are incorrect
A. A mail flow rule only affects future messages. It doesn’t remove copies already sitting in 350 inboxes.
C. Relying on each user is slow, inconsistent, and not a bulk remediation.
D. Blocking the sender in the Tenant Allow/Block List stops future delivery, but by itself it isn’t the bulk removal action for messages already delivered.
Source: Threat hunting in Threat Explorer and Real-time detections
A company with Microsoft 365 E5 wants a compliance-focused analyst to view and manage Microsoft Purview data loss prevention (DLP) alerts in the Microsoft Defender portal’s incident queue. Following least privilege, the analyst should see DLP alerts only, not every other security alert. Which permission fits best?
⬜ A. Manage Alerts
⬜ B. eDiscovery Manager
✅ C. Information Protection Analyst
⬜ D. Security Administrator
Correct answer: C
Microsoft lists several permission options for investigating DLP alerts in Defender XDR. Information Protection Analyst gives access to DLP alerts only, while Manage Alerts covers both DLP and security alerts. Alerts must also be turned on in the DLP policies for them to flow into the Defender portal, where they’re correlated with other alerts into incidents.
Why other options are incorrect
A. Manage Alerts grants access to both DLP and security alerts, which is broader than required.
B. eDiscovery Manager is for searching and exporting content in eDiscovery. It isn’t an alert-management permission.
D. Security Administrator is a broad directory role, well beyond least privilege for this need.
Source: Investigate data loss alerts with Microsoft Defender XDR
Microsoft Defender for Servers repeatedly raises the same alert type for an approved administrative script on a group of Azure VMs. The SOC has confirmed it’s benign. Future alerts matching this exact pattern should be dismissed automatically, but still kept for audit, and the rule should lapse at the end of the quarter. What should the team configure in Microsoft Defender for Cloud?
✅ A. A suppression rule with matching conditions, a reason, and an expiration date
⬜ B. Turn off the Defender for Servers plan on those VMs
⬜ C. Manually delete each alert as it arrives
⬜ D. A secure score exemption on the related recommendation
Correct answer: A
Defender for Cloud suppression rules automatically set matching alerts to Dismissed. The alerts still appear in the security alerts list, but they no longer trigger notifications or show in active views. Each rule has a reason and can have an expiration date. It only applies to alert types that have already been triggered at least once.
Why other options are incorrect
B. Turning off Defender for Servers removes all threat protection from those VMs, not just this benign alert.
C. Deleting alerts by hand doesn’t scale and destroys the audit trail the team wants to keep.
D. Secure score exemptions apply to posture recommendations, not to threat protection alerts.
Microsoft Defender for Cloud Apps flags a user for an impossible-travel sign-in followed by a mass download from a connected cloud app. While the investigation continues, the analyst wants to immediately invalidate every refresh token and session cookie the user holds, forcing them to sign in again everywhere, but without blocking the account. Which governance action fits?
⬜ A. Suspend user
✅ B. Require user to sign in again
⬜ C. Notify user
⬜ D. Ban app
Correct answer: B
Require user to sign in again revokes all refresh tokens and session cookies issued to applications for the user. The user loses access until they sign in again, but the account itself stays enabled.
Why other options are incorrect
A. Suspend user takes away all access and the ability to sign in, which is more than the analyst wants right now.
C. Notify user only sends the user an email about a policy violation. It doesn’t cut off any sessions.
D. Ban app is an OAuth app governance action for a third-party app. It doesn’t act on a user’s sessions.
Source: Governance actions for connected apps - Microsoft Defender for Cloud Apps
After investigating a Microsoft Entra ID Protection risky user report, an administrator concludes the account really was compromised and selects “Confirm user compromised.” What does this action do on its own?
⬜ A. It resets the user’s password and revokes all sessions automatically
⬜ B. It closes the risk event and returns the user to a safe state
✅ C. It sets the user’s risk state to “Confirmed compromised,” but the admin must still secure the account, for example by resetting the password, revoking sessions, or blocking the user
⬜ D. It permanently deletes the user object from Microsoft Entra ID
Correct answer: C
Confirm user compromised records the admin’s verdict by setting the risk state to “Confirmed compromised,” and risk-based policies act on that verdict. Microsoft notes that the action alone doesn’t secure the account. The admin should still require a password change, block the user if needed, and revoke refresh or access tokens.
Why other options are incorrect
A. Password reset and session revocation are separate remediation steps. They aren’t performed automatically by confirming compromise.
B. That describes Dismiss user risk, which is a non-remediation action used when an investigation shows the account is safe.
D. No risk action deletes the user account.
Source: Remediate risks and unblock users - Microsoft Entra ID Protection
Microsoft Defender for Identity raises a high-severity alert titled “Suspected DCSync attack (replication of directory services).” The source is an ordinary employee workstation. What triggered the alert, and what does Microsoft suggest to prevent it?
⬜ A. A forged Kerberos TGT was used beyond its maximum lifetime; rotate the KRBTGT account password
⬜ B. An account with Kerberos preauthentication disabled was targeted; enable preauthentication
⬜ C. A decoy honeytoken account attempted to authenticate; delete the honeytoken
✅ D. A directory replication request came from a computer that isn’t a domain controller; review who holds the “Replicate directory changes” and “Replicate directory changes all” permissions
Correct answer: D
DCSync abuses Active Directory replication to pull data such as password hashes. Defender for Identity raises this alert when a replication request comes from a non-domain controller. It maps to MITRE ATT&CK T1003.006 (OS Credential Dumping: DCSync). The suggested prevention is to confirm that only intended principals hold the Replicate directory changes and Replicate directory changes all permissions.
Why other options are incorrect
A. That describes a Golden Ticket “time anomaly” alert, a different Kerberos persistence technique.
B. That describes AS-REP Roasting, which targets accounts with Kerberos preauthentication disabled.
C. Honeytoken alerts fire when decoy accounts are used or queried. Deleting the honeytoken removes a useful tripwire and has nothing to do with DCSync.
Source: Microsoft Defender for Identity classic security alerts
An analyst is investigating a Microsoft Sentinel incident and wants to see, without writing any query, up to 20 other incidents that most closely resemble this one. That way they can check how comparable cases were classified and handled. Where on the incident details page is this information?
✅ A. The Similar incidents widget
⬜ B. The Top insights panel
⬜ C. The Activity log
⬜ D. The Logs panel
Correct answer: A
The Similar incidents widget on the incident details page lists up to 20 other incidents that most closely resemble the current one, along with the reasons they’re similar. It gives the analyst historical context without writing a query.
Why other options are incorrect
B. Top insights shows the results of Microsoft-defined queries about the incident’s entities, such as UEBA and threat intelligence insights, not similar past incidents.
C. The Activity log is the incident’s audit trail and comments.
D. The Logs panel lets you run your own KQL. It doesn’t give a ready-made similar-incidents list.
Source: Investigate Microsoft Sentinel incidents in depth in the Azure portal
A tenant has Microsoft Security Copilot provisioned. An analyst opens a Microsoft Defender XDR incident that contains 60 correlated alerts. Which statement correctly describes the incident summary feature built into the Defender portal?
⬜ A. It only works in the standalone Security Copilot portal and needs a hand-written prompt
⬜ B. It only supports incidents with 10 or fewer alerts
⬜ C. It automatically closes the incident once the summary is generated
✅ D. By default it generates a summary automatically when the incident is opened, covering incidents with up to 100 alerts, and includes the attack timeline, affected assets, and indicators of compromise
Correct answer: D
Copilot in Microsoft Defender automatically generates an incident summary when an incident is opened, and admins can switch this to by-severity or on-demand in preview settings. It can summarize incidents with up to 100 alerts and includes, where available, the attack timeline, initial and affected assets, IOCs, and threat actor names, plus suggested follow-up prompts.
Why other options are incorrect
A. The summary is built into the Defender portal. The standalone portal is optional for deeper work.
B. The documented limit is 100 alerts, so a 60-alert incident is supported.
C. Copilot summarizes. It doesn’t change the incident’s status or classification.
Source: Summarize incidents with Microsoft Copilot in Microsoft Defender
During a multi-stage incident in Microsoft Defender XDR, an attacker compromised one user and moved laterally to two servers. The analyst wants to see not just what’s already affected, but also the possible propagation paths from a compromised node to the organization’s critical assets, all in one graph on the incident page. Which capability provides this?
⬜ A. The device timeline of the first compromised server
✅ B. Blast radius analysis in the incident graph
⬜ C. The threat analytics “Analyst report” tab
⬜ D. An alert tuning rule
Correct answer: B
Blast radius analysis is a graph view built into the incident investigation experience. It shows possible propagation paths from a selected node to predefined critical targets, scoped to the analyst’s permissions. It combines pre-breach and post-breach information, so the current and possible future impact appear in one graph.
Why other options are incorrect
A. A device timeline shows events on one device over time. It doesn’t model paths to other critical assets.
C. Threat analytics reports describe external threats and actors, not paths through your own environment in this incident.
D. Alert tuning suppresses or resolves alerts. It’s not an investigation or visualization tool.
Source: Investigate incidents in the Microsoft Defender portal
One threat actor campaign has produced five separate incidents over three weeks. The SOC lead wants a single container in the Microsoft Defender portal that links all five incidents and the related indicators of compromise, with its own tasks (each with an owner and due date), a priority, and custom statuses that match the SOC’s process, all without a third-party ticketing tool. What should they use?
⬜ A. A Microsoft Sentinel workbook
⬜ B. A shared tag on all five incidents
⬜ C. A threat analytics report
✅ D. A case in the Defender portal’s case management
Correct answer: D
Cases in the Defender portal can link multiple incidents and IOCs. They support tasks with an owner, status, priority, and due date, and admins can customize the status options to fit the SOC’s workflow. Cases are designed for work that spans several incidents, such as a campaign.
Why other options are incorrect
A. Workbooks are dashboards. They don’t manage tasks, ownership, or status for an investigation.
B. Tags help with filtering, but they don’t provide tasks, owners, due dates, or custom statuses.
C. Threat analytics reports are Microsoft’s intelligence write-ups. They aren’t a place to manage your own investigation.
Source: Manage security operations cases natively in the Microsoft Defender portal
An external incident response firm has asked for a record of everything that happened on one compromised Windows device during a specific five-day window two weeks ago, with the most significant events highlighted. What is the most direct way to produce this in Microsoft Defender for Endpoint?
✅ A. On the device page’s Timeline, set a custom date range, flag the key events, and export the timeline (an export can cover up to seven days)
⬜ B. Collect an investigation package from the device
⬜ C. Run a full antivirus scan and export the scan report
⬜ D. Start a live response session and run processes
Correct answer: A
The device timeline shows the past 30 days by default and supports a custom date range. Analysts can flag events so they’re easy to filter, and they can export detailed timeline events for a date range of up to seven days, which covers a five-day window.
Why other options are incorrect
B. An investigation package captures the device’s current forensic state (autoruns, processes, network connections, and so on), not a historical event timeline for a past window.
C. An antivirus scan looks for malware now. It doesn’t reconstruct past events.
D. processes lists what’s running right now, not what happened two weeks ago.
Source: Investigate devices in Microsoft Defender for Endpoint
During a live response session on a Windows device, a responder tries to run a remediation PowerShell script with the run command, but the command fails because the script can’t be found. The script exists only on the responder’s own laptop. What should the responder do first?
⬜ A. Use getfile to copy the script from the laptop to the device
✅ B. Upload the script to the live response library, then use run (unsigned script execution must also be enabled if the script is unsigned)
⬜ C. Run processes to load the script into memory
⬜ D. Collect an investigation package so the script is included in it
Correct answer: B
The live response run command executes scripts from the library, so the script has to be uploaded there first. Uploading files through live response needs the “Manage Security Settings” permission, and unsigned scripts also need the Live response unsigned script execution advanced feature.
Why other options are incorrect
A. getfile downloads a file from the device to the analyst. It doesn’t push files to the device.
C. processes only lists running processes.
D. An investigation package collects forensic data from the device. It can’t deliver scripts to it.
A Windows 11 laptop is suspected of being compromised, and the analyst wants to cut it off from the network immediately. However, the executive using it must keep working in Outlook and Microsoft Teams while the investigation runs. Which Microsoft Defender for Endpoint response action fits?
⬜ A. Full device isolation
⬜ B. Restrict app execution
✅ C. Selective isolation
⬜ D. Contain device
Correct answer: C
Device isolation disconnects the device from the network while keeping its connection to Defender for Endpoint. Selective isolation also keeps chosen communication, such as Outlook, Microsoft Teams, and Skype, working, so the user can stay productive while the device is investigated.
Why other options are incorrect
A. Full isolation cuts off all network connectivity except the Defender service, which would block Outlook and Teams too.
B. Restrict app execution applies a code integrity policy so only Microsoft-signed files run. It doesn’t cut the device off from the network.
D. Contain device makes onboarded devices block communication with a device, typically an unmanaged one. It isn’t the targeted, user-friendly isolation option for a managed laptop.
Source: Take response actions on a device in Microsoft Defender for Endpoint
A malicious, non-Microsoft-signed DLL is found running on 40 devices. The analyst wants a single file-level action that stops the running processes, quarantines the file, and deletes persistence data such as related registry keys on every affected device. Which action should be used?
✅ A. Stop and quarantine file
⬜ B. Deep analysis
⬜ C. Download file
⬜ D. Collect investigation package
Correct answer: A
Stop and quarantine file stops running processes, quarantines the file, and deletes persistent data such as registry keys. It applies across affected devices (up to 1,000), and the file can be restored from quarantine later if needed.
Why other options are incorrect
B. Deep analysis runs the file in a cloud sandbox to report its behavior. It doesn’t remediate anything on devices.
C. Downloading the file gives the analyst a copy for analysis. It doesn’t stop or remove it on endpoints.
D. An investigation package collects forensic data from one device. It doesn’t remediate the file.
Source: Take response actions on a file in Microsoft Defender for Endpoint
An incident titled “Human-operated ransomware attack… (attack disruption)” shows that Microsoft Defender XDR automatically contained a file server and disabled a user account. After investigating and cleaning up, the SOC confirms both assets are safe. How should the SOC bring them back?
⬜ A. Offboard and re-onboard the server to Defender for Endpoint
⬜ B. Wait seven days for containment to expire automatically
✅ C. Undo the automatic disruption actions from the Action center
⬜ D. Delete the incident, which reverses all actions attached to it
Correct answer: C
Automatic attack disruption actions, such as containing devices and disabling users, can all be undone from the Action center, so the SOC keeps full control over bringing assets back online. Disrupted incidents carry an “Attack Disruption” tag, and “(attack disruption)” is added to the incident title.
Why other options are incorrect
A. Re-onboarding is unnecessary and doesn’t reliably reverse identity actions such as a disabled account.
B. Waiting on a timer isn’t the documented release path for disruption actions, and it would keep a cleaned asset offline for no reason.
D. Incidents can’t be deleted to reverse response actions. The Action center is where actions are tracked and undone.
Source: Automatic attack disruption in Microsoft Defender XDR
While investigating a compromised mailbox with Microsoft Purview Audit, an analyst finds MailItemsAccessed records whose access type is Sync for the Inbox folder. The attacker’s session also shows several Bind records. How should these records be interpreted?
⬜ A. Sync records identify each individual message the attacker opened, and Bind records mean the whole folder was downloaded
✅ B. A Sync record means an entire folder was synchronized, so every item in it should be treated as compromised. Bind records represent access to individual messages and include each message’s InternetMessageId
⬜ C. MailItemsAccessed only records access through Outlook on the web, so desktop-client access is missing
⬜ D. MailItemsAccessed only records successful message deletions
Correct answer: B
MailItemsAccessed audits mail access across POP, IMAP, MAPI, EWS, Exchange ActiveSync, and REST. Sync is recorded at folder level, for example when a desktop Outlook client downloads a folder, so every item in that folder is assumed compromised. Bind records access to individual messages and includes the InternetMessageId, with bind operations aggregated in two-minute intervals.
Why other options are incorrect
A. This reverses the two access types.
C. The action covers all the mail protocols listed above, not just Outlook on the web.
D. MailItemsAccessed records access to mail data, not deletions.
Source: Use MailItemsAccessed to investigate compromised accounts
An analyst uses Microsoft Purview eDiscovery to find every email across the organization’s mailboxes that has a specific phishing subject line and came from a known malicious sender. They’re building the search with Keyword Query Language (KeyQL) in the current eDiscovery experience. Which statement about building this query is correct?
⬜ A. Classic Content Search is still the recommended tool for this in the Microsoft Purview portal
⬜ B. Boolean operators can be written in any case, such as and or or
⬜ C. Suffix wildcards such as *voice are supported for matching the end of words
✅ D. Boolean operators such as AND, OR, and NOT must be uppercase, and only prefix wildcards (such as invoice*) are supported
Correct answer: D
Searches are created inside an eDiscovery case (or a Content Search case) in the Purview portal. You add data sources, then build the query with the condition builder or KeyQL. In KeyQL, Boolean operators (AND, OR, NOT, NEAR) must be uppercase, searches are case-insensitive, and wildcards are prefix-only.
Why other options are incorrect
A. Microsoft retired the classic eDiscovery experiences, including classic Content Search, on August 31, 2025. The current eDiscovery experience replaces them.
B. Lowercase and/or are treated as keywords, not operators.
C. Suffix, infix, and substring wildcards aren’t supported. Only prefix wildcards are.
A SOC suspects that a compromised app registration is quietly enumerating users and groups through Microsoft Graph. The team needs a per-request audit trail of Graph API calls, including request URI, HTTP method, app ID, caller IP, and response status code, that can be queried with KQL in their Log Analytics workspace. What should they configure?
⬜ A. Export Microsoft Entra sign-in logs to Log Analytics
✅ B. Diagnostic settings that send Microsoft Graph activity logs to the Log Analytics workspace, where they appear in the MicrosoftGraphActivityLogs table
⬜ C. Enable Microsoft Purview Audit (Premium) for the app’s service principal
⬜ D. Deploy Microsoft Defender for Endpoint on the app’s hosting server
Correct answer: B
Microsoft Graph activity logs are an audit trail of the HTTP requests Microsoft Graph receives for the tenant. They include request URI and method, app ID, service principal ID, IP address, user agent, and response status code. They’re routed with diagnostic settings to Log Analytics (the MicrosoftGraphActivityLogs table), storage, or Event Hubs, and require Microsoft Entra ID P1 or P2.
Why other options are incorrect
A. Sign-in logs record authentication events, not each API request an app makes after getting a token.
C. Purview Audit records user and admin activities in Microsoft 365 workloads. It isn’t a per-request log of Microsoft Graph API calls.
D. An endpoint sensor on a server doesn’t see API calls made to Microsoft Graph in the cloud with the app’s token.
Domain 3: Perform threat hunting (22%)
A threat hunter wants to find every user who clicked a malicious link delivered in email and rewritten by Safe Links, including clicks made from Teams and Office apps. Which Microsoft Defender XDR advanced hunting table should the query start from?
⬜ A. EmailUrlInfo
✅ B. UrlClickEvents
⬜ C. DeviceNetworkEvents
⬜ D. IdentityLogonEvents
Correct answer: B
UrlClickEvents records Safe Links clicks from email messages, Teams, and Office 365 apps, so it directly answers “who clicked.”
Why other options are incorrect
A. EmailUrlInfo lists the URLs contained in emails. It shows what was delivered, not who clicked.
C. DeviceNetworkEvents records network connections from onboarded devices. It isn’t the Safe Links click record and doesn’t cover clicks from unmanaged devices.
D. IdentityLogonEvents holds authentication events for Active Directory and Microsoft online services, not link clicks.
Source: Data tables in the Microsoft Defender XDR advanced hunting schema
A hunting query over 30 days of DeviceProcessEvents filters with where ProcessCommandLine contains "mimikatz" and runs slowly. The hunter only needs to match “mimikatz” as a whole word, bounded by non-alphanumeric characters as in mimikatz.exe. Which change will most likely make the query faster?
⬜ A. Replace contains with matches regex "mimikatz"
✅ B. Replace contains with has
⬜ C. Replace contains with contains_cs
⬜ D. Replace contains with !contains
Correct answer: B
has matches whole terms using the term index, while contains scans every value for a substring. Microsoft notes that has works faster than contains, startswith, or endswith, and recommends has when looking for a word bounded by non-alphanumeric characters.
Why other options are incorrect
A. Regular expression matching is generally more expensive than term matching.
C. Case-sensitive contains_cs is somewhat faster than contains, but it still does a substring scan instead of using the term index.
D. !contains reverses the logic and would return everything except the matches.
A hunter runs this advanced hunting query: IdentityLogonEvents | where ActionType == "LogonFailed" | summarize FailedAccounts = dcount(AccountUpn) by IPAddress | where FailedAccounts > 20. What activity is it designed to surface?
⬜ A. Accounts that failed to sign in more than 20 times
✅ B. Source IP addresses that had failed sign-ins against more than 20 distinct accounts, a typical password-spray pattern
⬜ C. IP addresses with more than 20 successful sign-ins
⬜ D. The 20 most recent failed sign-ins in the tenant
Correct answer: B
summarize ... by IPAddress produces one row per source IP, and dcount(AccountUpn) counts the distinct accounts each IP failed against. Keeping only IPs with more than 20 distinct accounts highlights one source trying many users, which is characteristic of password spraying.
Why other options are incorrect
A. That would need grouping by AccountUpn with count(), not a distinct count of accounts per IP.
C. The query filters for LogonFailed, so successful sign-ins are excluded.
D. Nothing in the query sorts by time or takes the latest 20 rows. The 20 is a threshold on distinct accounts.
A newly hired tier-1 analyst has little Kusto Query Language experience but must start hunting in Microsoft Defender XDR advanced hunting. Which statement about advanced hunting is correct?
⬜ A. Native Defender XDR data is kept for 180 days
⬜ B. Queries can return an unlimited number of rows
✅ C. A guided mode lets users build queries without writing KQL, and native Defender XDR data is available for the past 30 days
⬜ D. Microsoft Sentinel workspace data can never be queried from advanced hunting
Correct answer: C
Advanced hunting has a guided mode for users who aren’t familiar with KQL and an advanced mode for writing queries from scratch. Native Defender XDR data is kept for 30 days. Microsoft Sentinel data can also be queried once the workspace is onboarded, with retention set by the workspace’s analytics-tier settings.
Why other options are incorrect
A. Native advanced hunting data is kept for 30 days, not 180.
B. Queries have service limits, including a maximum of 100,000 rows per result set and a 10-minute timeout.
D. Advanced hunting can query Microsoft Sentinel data when the workspace is onboarded to the Defender portal.
Source: Proactively hunt for threats with advanced hunting in Microsoft Defender
Microsoft publishes a new threat analytics report about a ransomware activity group. The CISO asks two questions: how many of our devices are exposed to this threat, and are the relevant security updates deployed? Which section of the report answers this?
⬜ A. Analyst report
⬜ B. Related incidents
✅ C. Endpoints exposure
⬜ D. Indicators
Correct answer: C
The Endpoints exposure section of a threat analytics report shows the organization’s exposure level to the threat, including security update deployment status and vulnerable devices. Viewing it needs the Vulnerability management (read) permission.
Why other options are incorrect
A. The analyst report is Microsoft researchers’ write-up of the threat, attack chain, and hunting guidance. It isn’t your organization’s own exposure data.
B. Related incidents lists incidents already linked to the threat. It doesn’t measure patch or exposure status.
D. Indicators lists IOCs associated with the threat, not device exposure.
A threat hunter wants to find every non-privileged user who has a potential privilege-escalation path to Domain Admins. They’d rather explore the results as an interactive node-and-edge visualization, starting from a prebuilt scenario instead of writing complex KQL joins. Which capability fits?
⬜ A. The incident graph of an existing incident
⬜ B. The MITRE ATT&CK coverage page in Microsoft Sentinel
⬜ C. The device timeline of a domain controller
✅ D. The hunting graph in advanced hunting, using the prebuilt “Paths to domain admins” scenario
Correct answer: D
The hunting graph in advanced hunting shows threat scenarios as interactive graphs of nodes (entities) and edges (relationships). It includes prebuilt scenarios such as Paths to domain admins, attack paths to critical assets, and paths between two entities. It requires access to the Microsoft Sentinel data lake and at least read-only access to Microsoft Security Exposure Management.
Why other options are incorrect
A. An incident graph is limited to the entities in one incident. It isn’t an organization-wide hunting tool.
B. The MITRE ATT&CK page shows detection rule coverage, not identity privilege-escalation paths.
C. A device timeline shows events on a single device, not relationships between users and groups.
Source: Hunting graph in Microsoft Defender advanced hunting
A SOC finds that the hunting graph and the blast radius view on incident pages aren’t available in its Microsoft Defender portal. Both experiences are powered by Microsoft Sentinel graph. What does Microsoft document as the way to enable them?
⬜ A. Enable User and Entity Behavior Analytics (UEBA) in the Sentinel workspace
✅ B. Complete the Microsoft Sentinel data lake onboarding flow, after which the hunting graph and blast radius experiences are provisioned automatically
⬜ C. Install a “Sentinel Graph” solution from Content hub
⬜ D. Enable the Defender CSPM plan on every Azure subscription
Correct answer: B
Microsoft Sentinel graph models security data as nodes and edges to answer questions such as “what’s the blast radius if this account is compromised?” It powers the incident graph’s blast radius view and the hunting graph in Defender XDR. It’s enabled through the Sentinel data lake onboarding flow, after which those experiences are provisioned automatically.
Why other options are incorrect
A. UEBA adds behavioral analytics and entity insights, but it isn’t how Sentinel graph is enabled.
C. Sentinel graph isn’t delivered as a Content hub solution. It comes with data lake onboarding.
D. Defender CSPM powers Defender for Cloud’s attack path analysis, but it isn’t the prerequisite for the Defender XDR hunting graph and blast radius.
While running Microsoft Sentinel hunting queries, an analyst finds several suspicious results and bookmarks them. Which two statements about hunting bookmarks are correct? (Choose 2.)
✅ A. You can create a new incident from one or more bookmarks
✅ B. Bookmarked results are stored in the HuntingBookmark table, where they can be correlated with other data
⬜ C. Bookmarking a result automatically creates and enables a matching analytics rule
⬜ D. Bookmarks are deleted automatically after 24 hours
Correct answer: A and B
Bookmarks preserve interesting hunting results with tags, notes, mapped entities, and MITRE techniques. You can escalate one or more bookmarks into a new incident. Bookmarked data is written to the HuntingBookmark table, so it can be queried and correlated with other data sources.
Why other options are incorrect
C. Turning a valuable hunting query into a detection is a separate, deliberate step. Bookmarking doesn’t create analytics rules.
D. There’s no 24-hour expiry. Bookmarks exist to keep findings for later investigation and correlation.
A SOC stores two years of firewall logs in the Microsoft Sentinel data lake tier. Every day, it wants to match that long history against current threat intelligence indicators and write any matches to a table in the analytics tier, where detection rules and analysts can use them quickly. What should it set up?
⬜ A. A near-real-time analytics rule that queries the data lake tier directly
⬜ B. A Defender XDR advanced hunting query saved as a favorite
✅ C. A scheduled KQL job in the data lake whose results are written to an analytics tier table (a new table gets a _KQL_CL suffix)
⬜ D. A Microsoft Sentinel workbook pinned to the SOC dashboard
Correct answer: C
KQL jobs are one-time or scheduled KQL queries that run over data lake data and promote the results to the analytics tier. Typical uses include historical threat intelligence matching and enrichment. New analytics tier output tables get a _KQL_CL suffix, and jobs can query up to 12 years of data.
Why other options are incorrect
A. Data lake tier data isn’t available for real-time analytics. NRT rules run against analytics tier data every minute, not over years of lake history.
B. A saved query doesn’t run on a schedule or write results to a table, and native advanced hunting data only covers 30 days.
D. Workbooks visualize data. They don’t run scheduled jobs that promote results between tiers.
A SOC keeps very high-volume network flow logs in a low-cost tier to control costs. Hunters want an hourly, aggregated view (for example, connection counts per source IP) in a fast Analytics-plan table for quick hunting and threat intelligence matching, while the raw logs stay in the cheap tier. Which Microsoft Sentinel feature is designed for this?
✅ A. Summary rules, which aggregate the data on a schedule into a custom _CL table on the Analytics plan
⬜ B. Moving every raw flow log into the analytics tier
⬜ C. A data collection rule transformation that drops all flow logs
⬜ D. Increasing the workspace’s analytics tier retention to two years
Correct answer: A
Summary rules run aggregation queries in the background, typically over verbose data kept in low-cost Basic, Auxiliary, or data lake tiers. They write the summarized results into custom _CL tables on the Analytics plan, on schedules from 20 minutes to 24 hours. This keeps hunting and threat intelligence matching fast without paying analytics prices for the raw logs.
Why other options are incorrect
B. Moving all raw flow logs into the analytics tier is exactly the cost the SOC wants to avoid.
C. Dropping the flow logs removes the data entirely, so there’d be nothing to summarize or investigate.
D. Longer analytics retention raises cost and doesn’t produce an aggregated view.
Source: Aggregate Microsoft Sentinel data with summary rules
A threat hunter works in Visual Studio Code with GitHub Copilot and Jupyter notebooks. They want to ask natural-language questions about security data in the Microsoft Sentinel data lake, and eventually build Security Copilot agents, without writing KQL or learning every table schema. What should they connect their AI client to?
⬜ A. A Microsoft Sentinel workbook
⬜ B. An Azure Logic Apps playbook
⬜ C. Advanced hunting guided mode in the Defender portal
✅ D. The Microsoft Sentinel MCP server, using its data exploration tool collection
Correct answer: D
The Microsoft Sentinel MCP server is a hosted Model Context Protocol server. Compatible AI clients, such as Visual Studio Code with GitHub Copilot or Security Copilot, connect to it to query the Sentinel data lake in natural language. It offers tool collections for data exploration, entity analysis, incident triage and threat hunting, and agent creation, so users don’t need code-first integration or deep schema knowledge.
Why other options are incorrect
A. Workbooks are dashboards. They can’t be queried in natural language by an AI client.
B. Playbooks automate responses. They aren’t a natural-language data access layer for AI clients.
C. Guided mode is a query builder inside the Defender portal. It isn’t an MCP endpoint that a VS Code or Copilot client can connect to over the data lake.
Related Certification Exams
- Security, Compliance, and Identity Fundamentals (SC-900) Exam Questions — the fundamentals-level starting point for Microsoft security, and a natural step before SC-200
- Cloud and AI Security Engineer (SC-500) Exam Questions — the Associate-level security engineering counterpart, focused on implementing security controls rather than operating the SOC
- Microsoft Azure Fundamentals (AZ-900) Exam Questions
