SC-200 practice examsFinished
Microsoft Security Operations Analyst
Investigate, respond to, and hunt for threats using Microsoft Sentinel, Microsoft Defender XDR, and Microsoft Defender for Cloud. Triage, investigate, and respond to incidents. Use KQL to query data and build detections.
What you get
Papers are cut from the bank and weighted like the real exam, and no question appears in two of them. Every wrong answer comes back on later days until you have it right.
What the exam covers
| Manage a security operations environment | 40-45% |
| Respond to security incidents | 35-40% |
| Perform threat hunting | 20-25% |
Two sample questions
1. What is a 'session' in Security Copilot?
- A conversation thread where prompts and responses are maintained for an investigation context — correct
- A billing period during which Security Compute Units are consumed by the organization
- A training module that teaches analysts how to write effective prompts for the AI assistant
- A scheduled maintenance window during which Security Copilot is temporarily unavailable
Why: A session in Security Copilot is a conversation thread that maintains context across multiple prompts and responses. Sessions can be saved, shared with other analysts, and referenced later for continued investigation.
2. A hunting graph shows a few storage nodes appear in most paths to SQL data. What should the security team do next?
- Delete the hunting graph scenario
- Raise the alert threshold for SQL
- Disable advanced hunting for the whole team
- Segment those nodes to cut many paths at once — correct
Why: Nodes in the most paths are choke points worth segmenting.
The real SC-200 exam
| Length | 120 minutes |
|---|---|
| Questions | 40-60 |
| Pass mark | 700/1000 |
| Price | $165 USD |
| Recommended before you sit it | Basic understanding of Microsoft 365, Azure security services, and Windows/Linux operating systems. Familiarity with KQL is strongly recommended. |
| Valid for | 1 year (annual renewal required) |
Exam facts as published by Microsoft; always check the vendor’s page before you book.
Study SC-200 with Chiron
Chiron is invitation-only while we are in beta, and nothing is for sale yet: invited accounts use every paper, drill and course note for free.