Free Microsoft SC-200 Exam Questions

Become Microsoft Certified with updated SC-200 exam questions and correct answers

Page: 1 / 75

Total 373 Questions | Updated On: Jan 28, 2026

Add To Cart

Question 1

You have a Microsoft Sentinel workspace.

You have a query named Query1 as shown in the following exhibit.

You plan to create a custom parser named Parser 1. You need to use Query1 in Parser1. What should you do

first?

A : move line 2.

B : line 4. remove the TimeGenerated predicate.

C : move line 5.

D : line 3, replace the 'contains operator with the !has operator.

Answer: A

Question 2

You need to identify which mean time metrics to use to meet the Microsoft Sentinel requirements. Which workbook should you use?

A : Analytics Efficiency

B : Security Operations Efficiency

C : Event Analyzer

D : Investigation insights

Answer: C

Question 3

You need to assign a role-based access control (RBAC) role to admin1 to meet the Azure Sentinel requirements and the business requirements. Which role should you assign?

A : Automation Operator

B : Automation Runbook Operator

C : Azure Sentinel Contributor

D : Logic App Contributor

Answer: C

Question 4

You need to remediate active attacks to meet the technical requirements. What should you include in the solution?

A : Azure Automation runbooks

B : Azure Logic Apps

C : Azure Functions

D : Azure Sentinel livestreams

Answer: B

Question 5

You have a playbook in Azure Sentinel.
When you trigger the playbook, it sends an email to a distribution group.
You need to modify the playbook to send the email to the owner of the resource instead of the distribution group.
What should you do?

A : a parameter and modify the trigger.

B : a custom data connector and modify the trigger.

C : a condition and modify the action.

D : a parameter and modify the action.

Answer: D

Page: 1 / 75

Total 373 Questions | Updated On: Jan 28, 2026

Add To Cart