A security team has several KQL jobs that run daily to process archived data. They notice that some jobs are failing due to resource limits, and they need to ensure all jobs complete successfully. They also want to reduce the cost of running these jobs. What should they do?

Run all KQL jobs simultaneously to ensure they complete faster.

Optimize the KQL queries in the jobs to reduce the amount of data processed and run them during off-peak hours.

Create summary rule tables to pre-aggregate the data before running the KQL jobs.

Increase the time range of the jobs to ensure all data is processed.

In Microsoft Sentinel, what is the primary purpose of a hunting query?

To proactively search for suspicious activity across data sources

To automatically trigger an incident when a match is found

To schedule a regular report of all security events

To create a new data connector for ingesting logs

What is a key consideration when managing a summary rule table in Microsoft Sentinel to ensure it remains accurate over time?

The summary table should be manually deleted and recreated every day

The summary rule's query should be reviewed and updated if the underlying data schema changes

The summary table should be exported to a different workspace to improve performance

The summary rule should be set to run only once to avoid overloading the workspace

A security analyst needs to hunt for a specific threat pattern that involves data from both hot and archived storage. The hot data is from the last 30 days, and the archived data is from the previous 90 days. The analyst wants to run a single query that covers both time periods and returns unified results. What should they do?

Create a summary rule table that includes both hot and archived data.

Run a KQL job that queries both hot and archived data and stores the results in a new table.

Use a hunting query that automatically includes both hot and archived data.

Run two separate queries (one for hot, one for archived) and manually combine the results.

A security analyst has created a hunting query that identifies potential lateral movement. The query returns a large number of results, making it difficult to identify true positives. The analyst wants to reduce the noise and focus on the most suspicious activity. What should they do?

Convert the hunting query into an analytics rule to automatically filter the results.

Use a KQL job to process the results and remove duplicates.

Refine the hunting query to add more specific filters, such as excluding known-good IP addresses and requiring multiple failed logins.

Create a summary rule table to aggregate the results and reduce the number of rows.

Microsoft Certified:Security Operations Analyst Associate

Domain 3Objective 2

Detect Threats by Using the Microsoft Sentinel Platform SC-200 Practice Questions (Page 7)

Part of the Perform threat hunting domain, which accounts for 20–25% of the SC-200 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~8–16 in this domain), expect 4–8 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

8concepts

20–25%of the exam

Questions 31–35

31expert · hard
A security team has several KQL jobs that run daily to process archived data. They notice that some jobs are failing due to resource limits, and they need to ensure all jobs complete successfully. They also want to reduce the cost of running these jobs. What should they do?
Select an answer first
32foundation · easy
In Microsoft Sentinel, what is the primary purpose of a hunting query?
Select an answer first
33foundation · easy
What is a key consideration when managing a summary rule table in Microsoft Sentinel to ensure it remains accurate over time?
Select an answer first
34expert · hard
A security analyst needs to hunt for a specific threat pattern that involves data from both hot and archived storage. The hot data is from the last 30 days, and the archived data is from the previous 90 days. The analyst wants to run a single query that covers both time periods and returns unified results. What should they do?
Select an answer first
35expert · hard
A security analyst has created a hunting query that identifies potential lateral movement. The query returns a large number of results, making it difficult to identify true positives. The analyst wants to reduce the noise and focus on the most suspicious activity. What should they do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-200

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-200” is a trademark of its owner, used for identification only.