Microsoft Security Operations Analyst Associate (SC-200)

C is correct.

Explanation: The parse operator evaluates a string expression and parses its value into one or more calculated columns. Simple mode is the default kind for parse, providing strict matching where all string delimiters must appear in the parsed string and all extended columns must strictly match their defined data types, exactly satisfying the scenario.

A is incorrect: Relaxed mode allows extended columns to partially match required types, assigning null when types do not match rather than enforcing strict typing.

B is incorrect: The extract function pulls a single regular expression match into one value rather than parsing multiple delimited values into typed columns.

D is incorrect: The mv-apply operator executes subqueries on array elements instead of parsing multiple delimited string values into extended typed table columns.

A is correct.

Explanation: In Threat Explorer, the Top targeted users tab displays every instance where an internal user was sent an email attachment containing malware. It lists the specific recipients, subject, sender domain, and sender IP, while the Delivery action column indicates whether the email was blocked or delivered as spam.

B is incorrect: Noteworthy trackers provide intelligence on prevailing cybersecurity issues to help implement countermeasures rather than detailing specific message delivery actions for recipients.

C is incorrect: Attack Simulator evaluates organizational vulnerabilities by running simulated credential harvesting attacks rather than reporting on real inbound malware message delivery data.

D is incorrect: The Detection technology filter shows whether emails were caught by sandboxing or Exchange Online Protection filters without displaying recipient and subject details.

A is correct.

Explanation: Bookmarks are not supported in the advanced hunting experience within the Microsoft Defender portal. In the Defender portal, bookmarks are specifically supported under Microsoft Sentinel > Threat management > Hunting, allowing analysts to bookmark query results during threat hunting activities. In contrast, using bookmarks within advanced hunting remains an Azure portal only capability after onboarding Sentinel to Defender.

B is incorrect: Incident tasks are unavailable in the Microsoft Defender portal and do not provide hunting bookmark capabilities to analysts.

C is incorrect: The Fusion rule is automatically disabled upon onboarding and replaced by Defender XDR correlation, unrelated to bookmark availability.

D is incorrect: The Defender XDR data connector is not shown on the Data connectors page in Defender and manages ingestion, not bookmarks.

A is correct.

Explanation: In Microsoft Sentinel threat hunting, keeping a hypothesis time-bound ensures analysts specify exact log timeframes such as the last day or week. Documenting the specific execution time and period covered informs team members of completed work, directly preventing analysts from repeating the same hunt on an identical dataset.

B is incorrect: Keeping hunts achievable ensures the organization possesses sufficient data and expertise to locate results, rather than tracking covered time ranges.

C is incorrect: Keeping the scope narrow prevents overly broad investigations like vague logon anomalies, but does not track hunted historical time windows.

D is incorrect: Keeping hunts useful and efficient targets weak detection areas and realistic threat models, but does not address duplicate timeframe coverage.

B is correct.

Explanation: A search job is required because it uses parallel processing to execute asynchronous queries across large datasets without degrading workspace performance or availability. The 10-month timeframe falls directly within the supported one-year search date range. Microsoft Sentinel places the matching records into a dedicated search results table for further review.

A is incorrect: Standard interactive queries lack asynchronous parallel processing and can degrade workspace performance and availability when scanning large historical tables.

C is incorrect: Restoring historical data for two days fails to cover the requested 10-month investigation window and adds unnecessary management overhead.

D is incorrect: Analytics rules evaluate incoming data streams rather than executing historical queries across long time spans in archived or historical tables.

A is correct.

Explanation: Selecting Add bookmark or the bookmark icon preserves an individual row directly from search job results. Adding bookmarks allows security analysts to tag relevant events, record investigative notes, and attach those specific events to an incident for later reference. This directly satisfies the requirement to preserve and annotate findings.

B is incorrect: Add filter refines or narrows the records displayed in the search table, but it cannot tag rows or record notes.

C is incorrect: The Columns control configures which table fields appear in the results grid and does not preserve or annotate individual entries.

D is incorrect: Restore recovers historical archived tables into the workspace for querying rather than tagging or attaching search results to incidents.

B is correct.

Explanation: The threat hunting cycle does not terminate simply because the hunt discovered no active threats in the environment. Even when no compromise is identified, analysts must perform routine follow-up tasks by setting up new monitoring and improving detection capabilities. Additionally, every hunt must be documented with inputs, outputs, and replication steps.

A is incorrect: Documentation is mandatory for all hunts regardless of findings, capturing what, how, why, input, output, and necessary next steps.

C is incorrect: Threat hunting is a continual process that requires evolving hypotheses rather than repeating identical queries over unchanged historical datasets.

D is incorrect: Proactive hunting continuously seeks undetected threats before alerts surface, rather than waiting reactively for analytics rules to trigger incidents.

B is correct.

Explanation: According to Microsoft Sentinel guidance, taking an IP address provided by a threat intelligence feed to check whether it was observed in past logs is technically not threat hunting because you are using a known bad entity. Proactive threat hunting strictly focuses on uncovering threats or activities not previously detected, developing a hypothesis rather than matching known indicators.

A is incorrect: Proactive threat hunting searches for previously undetected intrusion activities based on a hypothesis rather than querying historical data for known bad indicators.

C is incorrect: Incident analysis explicitly explores environment data based on evidence discovered in an active incident or alert rather than an incoming feed.

D is incorrect: Alert triage evaluates automated alerts already generated by security rules, whereas this task executes manual queries across historical logs for incoming indicators.

A is correct.

Explanation: To investigate prompt injection or safeguard bypass attempts, analysts must review the Messages property within CopilotInteraction audit records. The Messages property contains prompt and response pairs along with the JailbreakDetected flag. When a prompt attempts to bypass built-in AI safety guardrails, this specific flag explicitly indicates the detected jailbreak event.

B is incorrect: AccessedResources identifies files, sites, and sensitivity labels that Copilot accessed to generate answers, rather than indicators of prompt safeguard bypass attempts.

C is incorrect: Contexts records the active document or open application context during the interaction, rather than prompt safety flags or actual conversation content.

D is incorrect: AppHost identifies the host client application such as BizChat, Word, or Bing, but provides no visibility into prompt jailbreak security events.

C is correct.

Explanation: Embeddings place tokens that share linguistic contexts in similar vector directions within multi-dimensional space. To evaluate semantic proximity between vectors like dog and puppy, the system calculates their cosine similarity. This mathematical measurement directly quantifies how closely words align in contextual meaning rather than relying on position or arbitrary integer identifiers.

A is incorrect: Positional encoding records where a token appears within an input sequence rather than calculating semantic proximity between distinct vector representations.

B is incorrect: Masked attention ignores subsequent tokens during decoder training, so it cannot evaluate directional semantic relationships between trained token embeddings.

D is incorrect: Token IDs are unique integers assigned during tokenization, meaning raw identifier values cannot evaluate linguistic context or semantic vector closeness.