A security team wants to use an MCP server to enrich threat hunting data. The MCP server is external and requires authentication. The team also wants to use notebooks for advanced analysis. What should the team do to securely connect and use the MCP server?

Create a KQL job that authenticates to the MCP server and imports data.

Create a summary rule table that pulls data from the MCP server.

Establish the Sentinel MCP Server connection with the required credentials, then use notebooks to access the enriched data.

Store the MCP server credentials in a notebook and connect directly from the notebook.

A security team has a summary rule table that aggregates failed logins by user. The table is used by multiple hunting queries. Recently, the team noticed that the table is missing data for the last hour, and some entries are outdated. What should the team do to ensure the summary table is accurate and up-to-date?

Switch all hunting queries to query the raw events directly.

Create a new summary rule with a different aggregation and hope it captures the missing data.

Delete the summary table and recreate it from scratch.

Review the summary rule's schedule and rerun it if it failed, then verify the data.

A security team has created a summary rule table that aggregates user login events. They notice that the table is missing data from the last hour and needs to ensure it is up-to-date for their threat hunting. What should they do?

Check the summary rule's schedule and ensure it is running frequently enough to capture recent data.

Run a KQL job to manually populate the summary rule table.

Query the raw logs directly instead of using the summary rule table.

Delete and recreate the summary rule table to force a refresh.

When managing a connection to the Sentinel MCP Server, what is a key security practice to follow?

Allow anonymous access to simplify integration

Use a shared secret that is hardcoded in the client application

Use authentication and authorization to control access to the server

Disable all logging to protect data privacy

A security team has created a KQL job that processes a large volume of archived data to identify malicious IP addresses. The job is taking too long to complete and they need to optimize its performance. What should they do?

Increase the time range of the KQL job to include more data.

Run the KQL job multiple times in parallel to speed up processing.

Refine the KQL query to filter data earlier in the query pipeline and reduce the amount of data processed.

Create a summary rule table to pre-aggregate the data before running the KQL job.

Microsoft Certified:Security Operations Analyst Associate

Domain 3Objective 2

Detect Threats by Using the Microsoft Sentinel Platform SC-200 Practice Questions (Page 2)

Part of the Perform threat hunting domain, which accounts for 20–25% of the SC-200 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~8–16 in this domain), expect 4–8 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

8concepts

20–25%of the exam

Questions 6–10

6expert · hard
A security team wants to use an MCP server to enrich threat hunting data. The MCP server is external and requires authentication. The team also wants to use notebooks for advanced analysis. What should the team do to securely connect and use the MCP server?
Select an answer first
7expert · hard
A security team has a summary rule table that aggregates failed logins by user. The table is used by multiple hunting queries. Recently, the team noticed that the table is missing data for the last hour, and some entries are outdated. What should the team do to ensure the summary table is accurate and up-to-date?
Select an answer first
8application · medium
A security team has created a summary rule table that aggregates user login events. They notice that the table is missing data from the last hour and needs to ensure it is up-to-date for their threat hunting. What should they do?
Select an answer first
9foundation · easy
When managing a connection to the Sentinel MCP Server, what is a key security practice to follow?
Select an answer first
10application · medium
A security team has created a KQL job that processes a large volume of archived data to identify malicious IP addresses. The job is taking too long to complete and they need to optimize its performance. What should they do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-200

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-200” is a trademark of its owner, used for identification only.