Microsoft SC-200 Practice Test 19

Question 180

A workbook is shared but the underlying KQL query reveals restricted usernames in raw results. Which response best meets the security operations requirement?

Use supported identity-aware filters with appropriate data permissions.
Separate the incompatible measures or use distinct appropriately labeled visualizations.
Use a query that summarizes by host, orders by count, and limits results to five.
Limit data projection and enforce underlying table access controls.

Explanation

Correct Answer

Restricting sensitive fields and query access protects data beyond UI sharing restrictions. This directly addresses the requirement to prevent workbook data exposure.

Incorrect Answers

User-context filters can tailor operational views without broadening access to source data. This addresses tailor workbook views by analyst; it does not directly satisfy prevent workbook data exposure.

Units must be preserved for accurate comparisons and decision making. Its intended use is to avoid mixing incomparable chart units, whereas this case requires the analyst to prevent workbook data exposure.

Rank-ordered aggregation directly supports a highest-volume host chart. That action focuses on identify the five noisiest hosts rather than the specified need to prevent workbook data exposure.

Question 181

A DCR transform strips all IP addresses to save storage, but incident responders rely on source IP evidence. Which approach is best supported by the evidence?

Preserve required source and destination IP fields before optimizing the transform.
Apply approved ingestion-time minimization while preserving necessary security metadata.
Correct the transform's output schema and type conversion.
Compare pre- and post-transform field mappings and ingestion failures.

Explanation

Correct Answer

Overly aggressive column removal undermines investigative utility. This directly addresses the requirement to retain essential network attribution fields.

Incorrect Answers

Collection transformations can remove nonessential sensitive fields before storage. Its intended use is to minimize sensitive ingestion payloads, whereas this case requires the analyst to retain essential network attribution fields.

DCR output must satisfy the destination table schema. That action focuses on fix transformation schema compatibility rather than the specified need to retain essential network attribution fields.

Transformation changes can break detection without changing the originating event stream. This addresses diagnose transform-induced detection gaps; it does not directly satisfy retain essential network attribution fields.

Question 182

Windows event forwarders use source-initiated subscriptions but the target collector rejects connections. Which action most directly addresses the observed condition?

Review WinRM certificate or Kerberos trust and WEF subscription authentication prerequisites.
Validate collector URL, listener configuration and firewall policy.
Scope WEF subscription groups and XPath event filters appropriately.
Preserve forwarded-event source identity fields during ingestion and parsing.

Explanation

Correct Answer

Collector reachability is required before subscription delivery succeeds. This directly addresses the requirement to restore Windows event forwarding connectivity.

Incorrect Answers

WEF collection depends on secure connectivity and valid source authentication. This addresses fix WEF trust prerequisites; it does not directly satisfy restore Windows event forwarding connectivity.

Group and event filters narrow collection to approved assets and signals. That action focuses on limit WEF collection to critical hosts rather than the specified need to restore Windows event forwarding connectivity.

Source attribution is essential when multiple hosts share one collector. This addresses retain original host identity in forwarded events; it does not directly satisfy restore Windows event forwarding connectivity.

Question 183

A central collector receives Security events from 50 domain controllers and the SOC must identify the originating server for each failed login. What is the most appropriate next action for the analyst?

Audit subscription XPath filters and remove redundant coverage.
Inspect collector delivery queues and event timestamps before judging event absence.
Retain the forwarded-event Computer identity and relevant account fields in the analytic.
Generate an authorized pilot event and verify its end-to-end receipt in Sentinel.

Explanation

Correct Answer

Source computer attribution distinguishes independent domain controller events. This directly addresses the requirement to identify source domain controller for failures.

Incorrect Answers

Overlapping subscription criteria can forward the same event through multiple paths. This addresses deduplicate overlapping WEF subscriptions; it does not directly satisfy identify source domain controller for failures.

Delivery latency can separate event generation from ingestion visibility. Its intended use is to account for delayed Windows forwarding, whereas this case requires the analyst to identify source domain controller for failures.

Controlled end-to-end tests provide stronger proof than config presence alone. This addresses prove WEF pipeline readiness; it does not directly satisfy identify source domain controller for failures.

Question 184

A threat feed rotates its infrastructure daily and last week's IP addresses are now stale. Which response best meets the security operations requirement?

Normalize and correlate the indicator with the appropriate endpoint file-hash events.
Verify the connector's indicator types and the analytic's selected local event columns.
Treat the indicator as a hunting lead pending corroboration rather than a confirmed incident.
Refresh the feed and enforce indicator expiration or validity checks.

Explanation

Correct Answer

Time-aware indicator management limits incorrect matches to recycled infrastructure. This directly addresses the requirement to maintain current threat indicator state.

Incorrect Answers

Exact hash matching connects external intelligence to locally observed files. This addresses hunt for observed malicious file hashes; it does not directly satisfy maintain current threat indicator state.

Matching requires compatible observable representations and field mappings. Its intended use is to repair failed IOC-to-event correlation, whereas this case requires the analyst to maintain current threat indicator state.

Intelligence confidence and local evidence together inform threat priority. That action focuses on avoid treating uncorroborated IOC as compromise rather than the specified need to maintain current threat indicator state.

Question 185

A server forwards kernel warnings and application messages but the SOC needs only high-severity kernel events. Which approach is best supported by the evidence?

Filter kernel facility records by the documented severity threshold.
Add authpriv to the Syslog AMA DCR selection.
Map each source to one approved ingestion path or deduplicate safely upstream.
Configure device forwarding to the AMA-enabled collector with the proper facility routing.

Explanation

Correct Answer

Facility and severity together constrain syslog collection to the desired security scope. This directly addresses the requirement to target significant kernel records.

Incorrect Answers

Facilities classify event producers; excluding authpriv omits authentication records. Its intended use is to restore authentication facility events, whereas this case requires the analyst to target significant kernel records.

Duplicate collection inflates volume and can create redundant detection signals. That action focuses on eliminate duplicate syslog ingestion rather than the specified need to target significant kernel records.

Central collector patterns support appliances without native agents. This addresses ingest agentless Linux appliance syslog; it does not directly satisfy target significant kernel records.

Question 186

An administrator selects every Windows event on every server and ingestion costs exceed the project's budget. Which action most directly addresses the observed condition?

Correct the facility/severity selection using documented syslog severity ordering.
Filter collection to relevant log channels and event IDs based on detection requirements.
Compare event-source activity and ingestion health before retiring the connector.
Inspect DCR association, agent health and event generation on pilot hosts.

Explanation

Correct Answer

Event-level collection scoping reduces unnecessary ingestion while retaining required signals. This directly addresses the requirement to control Windows event ingestion costs.

Incorrect Answers

Syslog numeric priorities use defined severity semantics that must be interpreted correctly. This addresses retain critical Linux events; it does not directly satisfy control Windows event ingestion costs.

Low volume can reflect either a silent system or a broken collection path. That action focuses on distinguish quiet sources from ingestion faults rather than the specified need to control Windows event ingestion costs.

DCR configuration, endpoint execution and event occurrence all affect visible results. This addresses validate Windows AMA pilot collection; it does not directly satisfy control Windows event ingestion costs.

Question 187

A firewall streams CEF messages with inconsistent timezone offsets that distort event-order investigations. What is the most appropriate next action for the analyst?

Inspect the device's CEF key mapping and correct vendor formatting or transformation.
Validate the sender's supported syslog transport and size limits end to end.
Normalize event timestamps to a supported consistent time basis during parsing.
Query recent CommonSecurityLog records for that vendor before troubleshooting detection logic.

Explanation

Correct Answer

Comparable event-time fields prevent false attack orderings across devices. This directly addresses the requirement to align firewall event chronology.

Incorrect Answers

Normalized field semantics must match the actual source and destination roles. This addresses repair reversed network entity mapping; it does not directly satisfy align firewall event chronology.

Collection completeness depends on reliable message delivery and size handling. Its intended use is to prevent truncated firewall events, whereas this case requires the analyst to align firewall event chronology.

Separating event availability from analytic criteria narrows the diagnosis. This addresses prove third-party firewall telemetry arrival; it does not directly satisfy align firewall event chronology.

Question 188

A collector receives forwarded Security events but Sentinel sees none because its local collection rule monitors the wrong channel. Which response best meets the security operations requirement?

Adjust subscription queries to capture the required event IDs and channels.
Configure source-initiated Windows Event Forwarding subscriptions and collector prerequisites.
Inspect WinRM reachability, subscription state and collector event logs.
Configure AMA to read the collector's ForwardedEvents channel as applicable.

Explanation

Correct Answer

Forwarded events can be collected from the designated collector channel when configured. This directly addresses the requirement to ingest centrally forwarded Windows events.

Incorrect Answers

Subscription filtering reduces irrelevant forwarded events upstream. This addresses narrow WEF subscription data; it does not directly satisfy ingest centrally forwarded Windows events.

WEF centralizes approved Windows events through subscriptions before downstream ingestion. Its intended use is to consolidate Windows event forwarding, whereas this case requires the analyst to ingest centrally forwarded Windows events.

WEF depends on functional Windows remote management and subscription delivery. That action focuses on troubleshoot the WEF collector pipeline rather than the specified need to ingest centrally forwarded Windows events.

Question 189

A remote syslog collector is receiving duplicates from both direct host agents and central forwarding. Which approach is best supported by the evidence?

Map each source to one approved ingestion path or deduplicate safely upstream.
Add authpriv to the Syslog AMA DCR selection.
Filter kernel facility records by the documented severity threshold.
Configure device forwarding to the AMA-enabled collector with the proper facility routing.

Explanation

Correct Answer

Duplicate collection inflates volume and can create redundant detection signals. This directly addresses the requirement to eliminate duplicate syslog ingestion.

Incorrect Answers

Facility and severity together constrain syslog collection to the desired security scope. That action focuses on target significant kernel records rather than the specified need to eliminate duplicate syslog ingestion.

Central collector patterns support appliances without native agents. This addresses ingest agentless Linux appliance syslog; it does not directly satisfy eliminate duplicate syslog ingestion.

Question 190

An intelligence provider supplies approved malicious indicators through a supported feed for Sentinel matching. Which action most directly addresses the observed condition?

Incorporate source confidence and corroborating event evidence into triage rules.
Connect the supported threat intelligence feed or indicator ingestion integration.
Join or correlate the relevant network table with the available threat indicator data.
Review expiration and lifecycle properties before using the indicator for new detections.

Explanation

Correct Answer

Threat intelligence ingestion makes normalized indicators available for applicable analytics. This directly addresses the requirement to ingest external threat indicators.

Incorrect Answers

Indicator context helps distinguish weak intelligence from verified active compromise. This addresses triage indicators by confidence; it does not directly satisfy ingest external threat indicators.

Correlation connects indicator values with observed organization telemetry. That action focuses on hunt for matches to new indicators rather than the specified need to ingest external threat indicators.

Expired threat data should not be treated as current without validation. This addresses avoid acting on stale threat intelligence; it does not directly satisfy ingest external threat indicators.

Microsoft Security Operations Analyst (SC-200) Practice Tests

Microsoft SC-200 Practice Test 17 - 10 Questions (Last Reviewed 17-Oct-2026)
Microsoft SC-200 Practice Test 18 - 10 Questions (Last Reviewed 16-Oct-2026)
Microsoft SC-200 Practice Test 19 - 10 Questions (Last Reviewed 15-Oct-2026)
Microsoft SC-200 Practice Test 20 - 10 Questions (Last Reviewed 14-Oct-2026)
Microsoft SC-200 Practice Test 21 - 10 Questions (Last Reviewed 13-Oct-2026)

Pass Your Microsoft SC-200 Exam Easy!

Question 180

Explanation

Correct Answer

Incorrect Answers

Question 181

Explanation

Correct Answer

Incorrect Answers

Question 182

Explanation

Correct Answer

Incorrect Answers

Question 183

Explanation

Correct Answer

Incorrect Answers

Question 184

Explanation

Correct Answer

Incorrect Answers

Question 185

Explanation

Correct Answer

Incorrect Answers

Question 186

Explanation

Correct Answer

Incorrect Answers

Question 187

Explanation

Correct Answer

Incorrect Answers

Question 188

Explanation

Correct Answer

Incorrect Answers

Question 189

Explanation

Correct Answer

Incorrect Answers

Question 190

Explanation

Correct Answer

Incorrect Answers

Microsoft Security Operations Analyst (SC-200) Practice Tests