SC-200 case studies

SC-200 · Put your knowledge to work in context.

The Microsoft Certified: Security Operations Analyst Associate credential is an intermediate-level, Azure-focused certification for security professionals who investigate, search for, and mitigate threats using Microsoft Sentinel, Microsoft Defender for Cloud, and Microsoft 365 Defender. Microsoft positions the role around reducing organizational risk through triage, incident response, threat hunting, and detection engineering, working across Microsoft Defender XDR, Microsoft Sentinel, Microsoft Entra ID, Microsoft Purview, and Defender for Cloud workload protections in multi-cloud and on-premises environments. The SC-200 case studies are 5 cases and about 2,745 words.

Noisy Sign-in Alerts After Conditional Access Rollout

Contoso's SOC operates a single Microsoft Sentinel workspace in the East US, ingesting Microsoft Entra ID sign-in logs and Defender XDR incidents through the connector. Three weeks ago the identity team enforced a Conditional Access policy requiring compliant devices for all cloud apps.

633 words, about 3 min 2

Automation Rule Fires but Playbook Fails Mid-Incident

Fabrikam's SOC uses Microsoft Sentinel with a playbook triggered by an automation rule when a 'Suspicious process' incident is created. The playbook calls the Microsoft Graph Security API to isolate the device, then posts to a Teams channel, then assigns the incident.

561 words, about 3 min 3

Phishing Incident with Credential Compromise and Lateral Movement

Northwind's SOC receives a Defender XDR incident: a user clicked a link in a phishing email, entered credentials on a lookalike page, and 12 minutes later a sign-in from a new country succeeded with MFA satisfied (the attacker used an adversary-in-the-middle proxy to steal the session token). Twenty minutes after that, the attacker created a mailbox rule forwarding finance emails to an external address, then attempted sign-ins to three other users' accounts from the same IP, two of which succeeded.

530 words, about 3 min 4

Hunting for Living-off-the-Land Persistence Across Endpoints

A threat-intel report (not from a commercial question bank) indicates an actor using scheduled tasks created via schtasks.exe with names resembling Windows updates, followed by PowerShell downloading a payload from a rare domain. Your environment has 8,000 Windows endpoints in Defender for Endpoint, 60 servers, and a Sentinel workspace with the DeviceProcessEvents and DeviceNetworkEvents tables.

492 words, about 2 min 5

Sentinel Data Ingestion Gap During a Live Investigation

Adventure Works' Sentinel workspace stopped receiving SecurityEvent logs from 200 domain controllers at 03:00. The agents show as 'Connected' in the portal, but no new events appear.

529 words, about 3 min