EarnYourCert
Open the app
Exams › SC-200 › Domain 1 of 3
SC-200 · Domain 1 of 3 · 40-45% of the exam

Manage a security operations environment

Domain 1 of SC-200 accounts for 40-45% of the exam, the heaviest part of the syllabus. EarnYourCert has 170 original questions for this domain, all with explanations: 113 multiple choice, 20 yes/no and 37 completion or ordering items, like the real exam.

Practice domain 1 for free →No sign-up. Choose how many questions you want.

Domain 1 sample questions

8 questions from our 170-question bank for this domain. Try to answer before revealing the solution.

1. What does automatic attack disruption do when it detects a high-confidence ransomware attack?

  1. Waits for an analyst to approve each containment action before acting
  2. Only creates a report for the monthly review
  3. Contains affected assets, for example by isolating devices
  4. Sends an alert email to the SOC without taking any containment action
Show answer

Correct answer: C. Disruption acts at machine speed to stop attack progression.

2. Which actions can a Sentinel automation rule take without a playbook?

  1. Assign an owner, change status or severity and add tags or tasks
  2. Reimage a device remotely and restore it from the latest backup
  3. Isolate a device from the network and collect an investigation package
  4. Rotate a certificate
Show answer

Correct answer: A. Rules can also run playbooks for more complex actions.

3. Multiple automation rules apply to the same incident. How is their execution order determined?

  1. By the incident creation time
  2. Alphabetically by rule name
  3. By the analyst who created the rule
  4. By the order number assigned to each rule
Show answer

Correct answer: D. Rules run in ascending order unless a rule stops processing.

4. Which role is appropriate for a SOC manager who needs to view all Sentinel data but must not change anything?

  1. Owner
  2. User Access Administrator
  3. Microsoft Sentinel Reader
  4. Microsoft Sentinel Contributor
Show answer

Correct answer: C. Reader provides read-only access to Sentinel data.

5. What controls which events and fields the Azure Monitor Agent collects and where it sends them?

  1. A data collection rule (DCR)
  2. A retention label
  3. A Conditional Access policy
  4. A naming policy
Show answer

Correct answer: A. DCRs define sources, filters, transformations and destinations.

6. What happens to threat indicators in Sentinel when they have an expiration date that passes?

  1. They are deleted from the workspace immediately
  2. Their confidence score doubles
  3. They are no longer considered active for matching
  4. They are exported to the Defender portal as incidents
Show answer

Correct answer: C. Expired indicators are not used for detections.

7. What is the purpose of entity mapping in a Sentinel analytics rule?

  1. To bill each analyst for the query runtime used by the rule
  2. To delete event data older than 90 days from the source tables
  3. To rename the workspace tables
  4. To identify users, hosts and IPs so alerts can be correlated
Show answer

Correct answer: D. Entities power the investigation graph and incident grouping.

8. What is the minimum frequency option for a custom detection rule in Defender XDR that checks data continuously?

  1. Continuous (NRT)
  2. Every year
  3. Manual only
  4. Every 30 days
Show answer

Correct answer: A. Other options include every 1, 3, 12 or 24 hours.

Practice domain 1 for free →

Other SC-200 domains

2Respond to security incidents35-40% 3Perform threat hunting20-25% SC-200: full practice exam→