A security team wants to enhance their threat hunting capabilities by using an MCP server that can provide additional context about threats. They want to connect this server to Microsoft Sentinel so that hunting queries can leverage the MCP server's data. What should they do?

Create a summary rule table that ingests data from the MCP server.

Use a notebook to manually copy data from the MCP server into Sentinel.

Create a KQL job that queries the MCP server directly.

Establish a connection to the Sentinel MCP Server from the Sentinel workspace.

A security analyst has created a hunting query that identifies potential data exfiltration by looking for large outbound file transfers. They want to be notified when this query returns results so they can investigate immediately. What should they do?

Create a KQL job that runs the query and sends an email when results are found.

Create a summary rule table that stores the results and check it daily.

Convert the hunting query into a scheduled analytics rule that creates an incident when results are found.

Bookmark the hunting query results and share them with the team.

A security analyst needs to search 90 days of archived Microsoft Sentinel logs to find all instances of a specific command-line parameter used by a suspected attacker. The query will take several minutes to run and the results will be used for a one-time investigation. Which feature should they use?

Run the query directly in the Logs page after changing the time range to 90 days.

Create a hunting query and save it to the Hunting page for later execution.

Use a summary rule table to pre-aggregate the command-line data and then query the table.

Create a KQL job in the Data Lake to run the query against the archived data and retrieve the results.

After running a hunting query in Microsoft Sentinel, what is the primary action an analyst should take to investigate a suspicious result?

Add a bookmark to the result for further investigation

Create a new data connector to collect more logs

Delete the query from the hunting library

Disable the data source that produced the result

Microsoft Certified:Security Operations Analyst Associate

Domain 3Objective 2

Detect Threats by Using the Microsoft Sentinel Platform SC-200 Practice Questions (Page 1)

Part of the Perform threat hunting domain, which accounts for 20–25% of the SC-200 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~8–16 in this domain), expect 4–8 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

8concepts

20–25%of the exam

Questions 1–5

1application · medium
A security team wants to enhance their threat hunting capabilities by using an MCP server that can provide additional context about threats. They want to connect this server to Microsoft Sentinel so that hunting queries can leverage the MCP server's data. What should they do?
Select an answer first
2application · medium
A security analyst has created a hunting query that identifies potential data exfiltration by looking for large outbound file transfers. They want to be notified when this query returns results so they can investigate immediately. What should they do?
Select an answer first
3application · medium
A security analyst needs to search 90 days of archived Microsoft Sentinel logs to find all instances of a specific command-line parameter used by a suspected attacker. The query will take several minutes to run and the results will be used for a one-time investigation. Which feature should they use?
Select an answer first
4foundation · easy
Which query language is used to write hunting queries in Microsoft Sentinel?
Select an answer first
5foundation · easy
After running a hunting query in Microsoft Sentinel, what is the primary action an analyst should take to investigate a suspicious result?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-200

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-200” is a trademark of its owner, used for identification only.