Free Security Operations Analyst Associate SC-200 practice questions

Sample question 1. An incident tagged Attack Disruption shows that a finance user was contained automatically. The investigation is complete, the user’s device has been cleaned, and the password reset. How should the analyst restore the user’s access?

1. Wait: contained users are released automatically after 24 hours.
2. Create a new account for the user.
3. Undo the Contain user action.
4. Exclude the user from all Conditional Access policies.

Sample question 2. After a phishing compromise, a hunter wants to see whether the victim’s workstation ran LDAP queries against domain controllers to enumerate Domain Admins group membership. Which table records this activity?

1. IdentityQueryEvents
2. IdentityLogonEvents
3. DeviceNetworkEvents on port 389 only
4. IdentityDirectoryEvents

Sample question 3. After an incident at a partner company, the SOC receives a one-off CSV file with 400 IP addresses, domains, and file hashes to import into Microsoft Sentinel threat intelligence today. No platform or feed is involved. What is the simplest supported method?

1. Configure the Threat Intelligence – TAXII connector pointed at the CSV file.
2. Upload the CSV as a watchlist, which Sentinel treats as threat indicators.
3. Use the threat intelligence bulk import from a CSV or JSON file.
4. Build an app that calls the upload API once for each indicator.