A security team needs to analyze a large dataset stored in Azure Data Lake to detect a specific attack pattern. The dataset is too large for a standard Sentinel query, and the team wants to use a KQL job. What should the team do to ensure the job runs efficiently?

Run the job without any filters to ensure no data is missed.

Convert the KQL job to a hunting query.

Filter the data as early as possible in the KQL query and limit the columns returned.

Use a summary rule table instead of a KQL job.

A security team has a summary rule table that aggregates user sign-in activity. The table is used by several hunting queries. The team wants to ensure the table remains accurate and does not grow indefinitely. What should they do?

Create a new summary rule each month to replace the old one.

Configure a retention policy for the summary table and review the aggregation logic.

Delete the summary table every week and recreate it.

Stop using the summary table and query raw events directly.

A security team has a summary rule table that is used by multiple hunting queries. They need to update the table to include a new field, but they are concerned about the impact on existing queries. What should they do?

Run a KQL job to add the new field to the existing table.

Create a new summary rule table with the new field and update all hunting queries to use the new table.

Update the summary rule to include the new field and test the existing hunting queries to ensure they still work.

Delete the existing summary rule table and recreate it with the new field.

A security operations team wants to use an AI-powered assistant to help them refine their hunting queries and get suggestions for new threat hunting techniques directly within their Microsoft Sentinel workspace. What should they configure?

Create a KQL job that uses machine learning models to suggest hunting queries.

Connect Microsoft Sentinel to the Sentinel MCP Server to enable AI-assisted hunting capabilities.

Use a Jupyter notebook with a custom Python script to generate query suggestions.

Configure a summary rule table to generate hunting recommendations.

A threat hunter wants to use a notebook to perform a time-series analysis of login anomalies. The notebook will use a Python library that is not pre-installed. What should the hunter do?

Use a KQL job to perform the time-series analysis instead.

Create a summary rule table to perform the analysis.

Use a hunting query with a timechart to approximate the analysis.

Install the library in the notebook's environment using a pip command.

Microsoft Certified:Security Operations Analyst Associate

Domain 3Objective 2

Detect Threats by Using the Microsoft Sentinel Platform SC-200 Practice Questions (Page 4)

Part of the Perform threat hunting domain, which accounts for 20–25% of the SC-200 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~8–16 in this domain), expect 4–8 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

8concepts

20–25%of the exam

Questions 16–20

16application · medium
A security team needs to analyze a large dataset stored in Azure Data Lake to detect a specific attack pattern. The dataset is too large for a standard Sentinel query, and the team wants to use a KQL job. What should the team do to ensure the job runs efficiently?
Select an answer first
17application · medium
A security team has a summary rule table that aggregates user sign-in activity. The table is used by several hunting queries. The team wants to ensure the table remains accurate and does not grow indefinitely. What should they do?
Select an answer first
18expert · hard
A security team has a summary rule table that is used by multiple hunting queries. They need to update the table to include a new field, but they are concerned about the impact on existing queries. What should they do?
Select an answer first
19application · medium
A security operations team wants to use an AI-powered assistant to help them refine their hunting queries and get suggestions for new threat hunting techniques directly within their Microsoft Sentinel workspace. What should they configure?
Select an answer first
20application · medium
A threat hunter wants to use a notebook to perform a time-series analysis of login anomalies. The notebook will use a Python library that is not pre-installed. What should the hunter do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-200

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-200” is a trademark of its owner, used for identification only.