A security analyst wants to create a hunting graph in Microsoft Defender XDR to visualize the impact of a compromised account. What is the primary purpose of a blast radius graph?

To list all security alerts generated in the last 24 hours

To display the network topology of the organization

To show the potential spread of an attack across devices, users, and resources

To show the geographic location of all devices in the organization

A security analyst is reviewing a threat analytics report about a new phishing campaign. The report includes indicators of compromise (IOCs) and recommended hunting queries. What should the analyst do with this information?

Apply the recommended mitigations to all devices.

Create a custom hunting query to search for the IOCs.

Use the recommended hunting queries to search for the IOCs in the environment.

Wait for the threat to appear in the environment and then investigate the alert.

A security analyst is investigating a potential data exfiltration incident. The analyst suspects that a user downloaded a large file from a SharePoint site and then uploaded it to a personal cloud storage service. The analyst wants to use advanced hunting to find evidence of both activities. The analyst also needs to determine if the user accessed the SharePoint site from an unusual location. Which KQL query would be most effective?

EmailEvents | where SenderFromAddress == 'user@contoso.com' | project Timestamp, Subject, AttachmentName

IdentityLogonEvents | where AccountUpn == 'user@contoso.com' | project Timestamp, AccountUpn, IPAddress

CloudAppEvents | where ActionType in ('FileDownloaded', 'FileUploaded') | where AccountObjectId == 'user@contoso.com' | project Timestamp, ActionType, FileName, DestinationURL, IPAddress

DeviceFileEvents | where ActionType in ('FileCreated', 'FileModified') | where AccountName == 'user' | project Timestamp, ActionType, FileName

Microsoft Certified:Security Operations Analyst Associate

Domain 3Objective 1

Detect Threats by Using Microsoft Defender XDR SC-200 Practice Questions (Page 1)

Part of the Perform threat hunting domain, which accounts for 20–25% of the SC-200 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~8–16 in this domain), expect 4–8 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

6concepts

20–25%of the exam

Questions 1–5

1foundation · easy
A security analyst wants to create a hunting graph in Microsoft Defender XDR to visualize the impact of a compromised account. What is the primary purpose of a blast radius graph?
Select an answer first
2foundation · easy
A security analyst is using Microsoft Sentinel to investigate a security incident and wants to see how a specific user account is connected to other entities, such as devices and IP addresses. Which feature would the analyst use?
Select an answer first
3application · medium
A security analyst is reviewing a threat analytics report about a new phishing campaign. The report includes indicators of compromise (IOCs) and recommended hunting queries. What should the analyst do with this information?
Select an answer first
4foundation · easy
A security analyst is investigating a potential data exfiltration incident and wants to query network connections made from a compromised device. Which advanced hunting table should the analyst use?
Select an answer first
5expert · hard
A security analyst is investigating a potential data exfiltration incident. The analyst suspects that a user downloaded a large file from a SharePoint site and then uploaded it to a personal cloud storage service. The analyst wants to use advanced hunting to find evidence of both activities. The analyst also needs to determine if the user accessed the SharePoint site from an unusual location. Which KQL query would be most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-200

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-200” is a trademark of its owner, used for identification only.

Detect Threats by Using Microsoft Defender XDR SC-200 Practice Questions (Page 1)

Questions 1–5

A security analyst wants to create a hunting graph in Microsoft Defender XDR to visualize the impact of a compromised account. What is the primary purpose of a blast radius graph?

A security analyst is using Microsoft Sentinel to investigate a security incident and wants to see how a specific user account is connected to other entities, such as devices and IP addresses. Which feature would the analyst use?

A security analyst is reviewing a threat analytics report about a new phishing campaign. The report includes indicators of compromise (IOCs) and recommended hunting queries. What should the analyst do with this information?

A security analyst is investigating a potential data exfiltration incident and wants to query network connections made from a compromised device. Which advanced hunting table should the analyst use?

Keep studying — Perform threat hunting