You are creating a Microsoft Sentinel workbook to display the number of incidents by severity for the last 7 days. You want the workbook to automatically refresh every 5 minutes. Which workbook feature should you configure?

Create a scheduled query rule to update the workbook

Use a custom visualization that refreshes automatically

Set the time range parameter to 'Last 7 days'

Set the auto-refresh interval in the workbook settings

Your Microsoft Sentinel workspace is experiencing high query latency and you suspect it is due to large data volumes. You want to improve query performance without losing data. What should you do?

Move less-used tables to the basic logs tier.

Disable the data connectors for less-used sources.

Use summary rules to pre-aggregate data for common queries.

Increase the workspace retention to keep more data.

A security analyst needs to triage and manage incidents in Microsoft Sentinel, including changing incident status and assigning ownership, but should NOT be able to modify analytics rules or workbooks. Which built-in role should be assigned?

Microsoft Sentinel Playbook Operator

Your security team needs to query the last 90 days of sign-in logs for an investigation. The workspace retention is currently set to 30 days. What should you do to make the 90-day data available for interactive queries?

Use the Analytics tier for the workspace.

Create a new workspace and move the data.

Increase the workspace retention to 90 days.

Enable long-term retention and use search jobs.

Your Microsoft Sentinel workspace is ingesting large volumes of data, and you need to reduce costs while maintaining the ability to query all data for investigations. You have identified that a large portion of the data is verbose logs that are rarely used. What is the most cost-effective approach?

Increase the retention period for the verbose logs to keep them longer.

Move the verbose logs to a separate workspace with basic logs tier and use search jobs for occasional queries.

Use the Analytics tier for the verbose logs.

Disable the data connectors for the verbose logs.

Microsoft Certified:Security Operations Analyst Associate

Domain 1Objective 2

Configure the Microsoft Sentinel SIEM and Platform SC-200 Practice Questions (Page 3)

Part of the Manage a security operations environment domain, which accounts for 40–45% of the SC-200 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~16–29 in this domain), expect 4–7 from this objective — we provide 17 practice questions to prepare you well beyond it. (estimate)

17questions here

4free pages

5concepts

40–45%of the exam

Questions 11–15

11application · medium
You are creating a Microsoft Sentinel workbook to display the number of incidents by severity for the last 7 days. You want the workbook to automatically refresh every 5 minutes. Which workbook feature should you configure?
Select an answer first
12application · medium
Your Microsoft Sentinel workspace is experiencing high query latency and you suspect it is due to large data volumes. You want to improve query performance without losing data. What should you do?
Select an answer first
13foundation · easy
A security analyst needs to triage and manage incidents in Microsoft Sentinel, including changing incident status and assigning ownership, but should NOT be able to modify analytics rules or workbooks. Which built-in role should be assigned?
Select an answer first
14application · medium
Your security team needs to query the last 90 days of sign-in logs for an investigation. The workspace retention is currently set to 30 days. What should you do to make the 90-day data available for interactive queries?
Select an answer first
15expert · hard
Your Microsoft Sentinel workspace is ingesting large volumes of data, and you need to reduce costs while maintaining the ability to query all data for investigations. You have identified that a large portion of the data is verbose logs that are rarely used. What is the most cost-effective approach?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-200

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-200” is a trademark of its owner, used for identification only.