Security Operations Analyst Associate (SC-200) - Full Practice Exam 1

1. A cloud identity has been compromised. Its password was reset, but investigators are concerned about active sessions and other access paths. What is the best next approach?
2. A confirmed incident affects a business-critical server. Responders need containment and a defensible record. Which TWO actions are appropriate? Select TWO.
3. A connector that previously supplied events has stopped. What should operations examine first?
4. A custom source needs a queryable table with well-defined fields. What should ingestion configure?
5. A Defender for Identity alert indicates suspicious on-premises directory activity. What should an analyst do next?
6. A file hash appears in an intelligence report with limited confidence. What is the best investigation decision?
7. A hunt correlates sign-ins with device events. Why should the join keys and time relationship be explicitly designed?
8. A hunt finds a spike in command-line activity on several systems. What should distinguish malicious behavior from a scheduled administration job?
9. A hunt identifies activity requiring further investigation. What should be captured in a Sentinel bookmark?
10. A hunt should examine only process events from the last 24 hours. Which KQL operation applies the required time restriction?
11. A hunting query must estimate the number of unique affected devices rather than count all events. Which aggregation is appropriate?
12. A hunting query will become a Defender XDR custom detection. What must its output and scheduling satisfy?
13. A managed workstation is actively communicating with a confirmed malicious destination. Responders must contain network spread while retaining Defender connectivity where supported. Which response fits?
14. A model flags an unusual sign-in pattern. How should an analyst treat the anomaly?
15. A network appliance emits CEF over Syslog. Which ingestion approach should be evaluated?
16. A new automation rule will block accounts based on a detection. How should it be introduced for a sensitive production environment?
17. A new rule produces many alerts from a known business process. What should tuning do?
18. A phishing message reached several mailboxes. Which investigation approach best establishes impact without exposing the analyst?
19. A playbook can disable accounts. What must its execution identity and workflow enforce?
20. A process name matches a common administration tool. Which evidence best helps determine whether its execution is suspicious?
21. A proposed attack surface reduction rule may affect a critical business application. Which rollout approach is appropriate?
22. A query must retain every suspicious sign-in even when no matching device record exists. Which join kind fits?
23. A repeatable hunting query has demonstrated useful detection coverage. What is required before operationalizing it as an analytics rule?
24. A scheduled analytics rule runs every five minutes, but source ingestion can be delayed. What should its lookback design consider?
25. A SOC needs telemetry from several security products. What should determine which Sentinel data connectors are configured?
26. A SOC wants to understand which adversary techniques its detections cover and where telemetry gaps remain. Which framework view should it evaluate?
27. A team begins a proactive threat hunt. What is the strongest starting point?
28. A team creates an alert suppression for a legitimate recurring pattern. Which design is best?
29. A team wants lower-latency detections. What must it verify before choosing a near-real-time rule type?
30. A validated hunt returns too many columns. The analyst wants only device, account, and timestamp fields without changing which rows match. Which operator fits?
31. After an incident is resolved, which activity best improves future response?
32. An AI assistant summarizes an incident and recommends containment. What remains the analyst's responsibility?
33. An analyst needs a privileged role temporarily to contain a confirmed compromise. Which access approach is best?
34. An analyst wants the number of matching events per account. Which KQL pattern fits?
35. An incident contains identity and endpoint alerts for the same user. What should an analyst examine first to establish the attack sequence?
36. An OAuth application has suspicious consent and access to organizational data. Which response addresses that authorization path?
37. Analysts want a dashboard summarizing incidents and data trends. Which Sentinel capability supports that presentation?
38. Automated investigation and response is enabled. What must the SOC still govern?
39. Containment is complete and a server is ready for recovery. What should precede reconnecting it to production?
40. Defender for Cloud raises an alert on an internet-facing production workload. What should determine response priority?
41. Endpoint response should be delegated to a regional team without granting control over all devices. Which two controls should be evaluated? Select TWO.
42. Hundreds of vulnerabilities are reported across devices. Which remediation order best reduces operational security risk?
43. Investigators need evidence of Azure Resource Manager operations such as resource deletion. Which log is a primary source?
44. Responders need to investigate access to sensitive Microsoft 365 files. Which approach is appropriate?
45. Security data has different immediate detection and longer-term investigation needs. What should retention and storage-tier planning consider?
46. Sentinel should assign incidents and invoke supported workflows when defined conditions match. Which capability fits?
47. Threat indicators are ingested from a feed. What metadata and lifecycle should the SOC consider?
48. Two analysts are handling related Sentinel incidents. What improves accountability and avoids duplicated response?
49. Two compatible event tables should be searched as one combined stream, retaining rows from both. Which operator is appropriate?
50. Windows Security events must be collected through the supported Azure Monitor Agent integration. Which collection design should be evaluated?

Comments — 0