Microsoft Security Operations Analyst Associate (SC-200)

A is correct.

Explanation: Microsoft Defender for Identity and Defender for Endpoint natively share data in the unified Microsoft Defender portal without separate setup steps. While Defender for Identity monitors domain controller traffic, Defender for Endpoint monitors endpoints. Analysts can select any endpoint in the portal to inspect associated Defender for Identity alerts and evaluate related attack activity.

B is incorrect: Exporting the sensor inventory generates a spreadsheet of sensor properties rather than showing endpoint-specific identity alerts during an investigation.

C is incorrect: The Domain Controllers list configures monitored domain controllers for standalone or specialized sensors, not standard endpoints investigated for identity alerts.

D is incorrect: Connecting Okta enables monitoring of Okta cloud sign-in activity rather than linking Defender for Endpoint device records with on-premises alerts.

A is correct.

Explanation: Security Copilot generates a process log visible directly to the user during request execution. Inspecting this log enables analysts to identify the specific capability used to generate the response, verifying that it originated from a trusted source, while also confirming that the output completed responsible AI safety checks.

B is incorrect: The usage monitoring dashboard tracks compute unit consumption, session initiators, and plugin counts over time, rather than per-response execution details.

C is incorrect: Plugin setup settings configure authentication credentials and tenant connection parameters, without displaying which capability or safety check evaluated an output.

D is incorrect: Promptbooks supply preselected series of prompts to guide investigative workflows, but they do not record runtime capability choices or safety reviews.

A is correct.

Explanation: In the Identity Risk Management Agent settings, the Triggers category defines when and how the agent runs. Configuring Continuous monitoring causes the agent to check for new risky users every 5 minutes automatically. This directly fulfills the operations requirement for automated, frequent inspection of newly flagged identities without requiring manual administrator initiation.

B is incorrect: The Daily trigger causes the agent to run only once per day, failing the requirement for a 5-minute check cycle.

C is incorrect: Scope settings adjust timeframes, risk levels, and user groups to scan, rather than defining the recurring execution schedule or intervals.

D is incorrect: Manual run configures the agent to execute only when launched interactively, preventing automated risk evaluation every five minutes as required.

B is correct.

Explanation: Bookmarks preserve relevant hunting query results along with contextual notes and tags for collaboration. When an analyst selects a bookmark, using the Incident actions button allows them to create a new incident directly from that finding, making it immediately manageable on the Incidents page alongside other security incidents.

A is incorrect: Marking a query as a favorite only configures it to run automatically on page open, without preserving individual events or creating incidents.

C is incorrect: Mapping entities in a custom query defines data schema relationships, but it does not save individual event findings or generate new incidents.

D is incorrect: Filtering by MITRE tactics narrows available queries, but re-executing a query does not preserve specific records or escalate findings to the queue.

C is correct.

Explanation: The Microsoft Sentinel repository on GitHub contains ready-to-use playbooks defined with ARM templates to automate incident responses. For false-positive atypical travel detections, you can deploy the Dismiss-AADRiskyUser playbook directly into your Azure subscription. After authorizing its API connections, you can execute the playbook on demand to clear the risky user property.

A is incorrect: The Change incident status action only modifies Microsoft Sentinel incident metadata rather than dismissing risky user state in Microsoft Entra ID.

B is incorrect: Cloning duplicates an existing logic app and Run Trigger executes it, but neither option deploys the required risky user remediation template.

D is incorrect: Exporting transfers a logic app definition to Power Automate rather than acquiring or deploying the Microsoft Entra risk dismissal playbook.

B is correct.

Explanation: Retrieval augmented generation retrieves relevant information from sources such as policy documents and augments the user prompt with that data. By supplying this specific context alongside the question, the language model can generate responses grounded in organizational policy rather than returning generic guidance telling users to review external documentation.

A is incorrect: System prompts establish overall tone and behavior constraints, but adjusting style cannot supply the missing expense policy documentation to the model.

C is incorrect: Submitting longer questions without factual reference data still leaves the model without the policy text needed to ground its responses.

D is incorrect: Conversation history maintains multi-turn context across queries, and deleting it eliminates conversational continuity without adding any relevant policy context.

B is correct.

Explanation: For Exchange and Teams content, selecting Thread conversations packages chat messages into HTML transcripts for conversational review. Additionally, choosing to include contextual Teams and Viva Engage messages incorporates up to 12 hours of surrounding related conversation. Together, these specific mailbox and Teams export settings fulfill counsel's exact requirements for formatted readable transcripts and conversational context.

A is incorrect: Exporting content as PST files and retaining original folder paths configures format packaging, but neither creates transcripts nor includes conversational context.

C is incorrect: Exporting partially indexed items and organizing by source location manages unindexed data and directory structures rather than conversational message context.

D is incorrect: Exporting document versions and non-matching subfolder items represents OneDrive and SharePoint export settings rather than Teams chat transcript configurations.

C is correct.

Explanation: In Microsoft Defender for Endpoint, alerts with the same attack techniques or attributed to the same attacker are aggregated into an incident. This aggregation allows security analysts to understand the full scope of a breach and collectively investigate and respond to related threats instead of processing alerts individually.

A is incorrect: Security recommendations highlight organizational exposure and configuration weaknesses to remediate rather than grouping detected alert activity for collective incident response.

B is incorrect: Automated investigations use inspection playbooks to examine and remediate alerts automatically rather than acting as the entity aggregating related attacker alerts.

D is incorrect: Attack surface reduction rules prevent malicious Office and script behaviors rather than serving as the analytical entity that aggregates related alerts.

A is correct.

Explanation: Submitting a remediation request creates a tracking activity item within vulnerability management and generates a corresponding remediation ticket in Microsoft Intune. Crucially, submitting this request does not automatically trigger remediation or apply any changes to devices; instead, the IT administrator must log into Microsoft Intune to approve or reject the request and start a package deployment.

B is incorrect: The Weaknesses page catalogs CVE vulnerability details, and remediation workflows never require an analyst to manually update weakness entries.

C is incorrect: Remediation forms allow selecting applicable device groups, but submitting a request never applies changes or deploys updates to any endpoints.

D is incorrect: Due dates establish administrative deadlines, and omitting one cannot cause failure because request submissions never trigger automated endpoint patching.

A is correct.

Explanation: Sending an email notice does not close an insider risk case in Microsoft Purview. To change the case status to Closed, the investigator must explicitly select Resolve case and assign a classification of Benign or Confirmed policy violation. This operational action records the reason and logs resolution details into Case notes.

B is incorrect: Escalating to Microsoft Purview eDiscovery (Premium) transfers the case for legal hold and deeper investigation, leaving the case unresolved.

C is incorrect: The notice is logged in Case notes automatically, but recording this communication does not transition the case to Closed status.

D is incorrect: Running a Power Automate flow automates external notifications or ticket generation, but it does not resolve or close the case.