SC-200 performance-based questions: what they are and how to practise them
Microsoft does not use the term "performance-based question". SC-200 instead mixes multiple choice and multiple answer with drag-and-drop and build-list items, and case studies where several linked questions share one scenario. The build-list items are the closest equivalent to a CompTIA PBQ.
Whether you can operate the tooling, not describe it. A build-list item asking for the order of response actions in Defender XDR, or a matching item pairing a retention requirement to the right Log Analytics capability, is testing working knowledge of the product.
On the real exam these appear as drag-and-drop and build-list items, plus case studies. Multiple choice, multiple answer, drag-and-drop and build-list items, plus case studies with linked questions
In case studies, read the entire scenario once before answering anything. Later questions frequently depend on a constraint stated at the top.
For build-list items, containment normally precedes evidence collection only when harm is ongoing; otherwise collect first, because remediation destroys volatile evidence.
Know which capability acts at which point — before ingestion, at query time, or after the fact. Several matching items turn entirely on that distinction.
Try three questions. Understand every answer.
Original English practice examples, with answers and explanations available here. No account required. These are independent teaching examples, not official exam questions or exam dumps.
Question 1 of 3 · Microsoft Sentinel investigations
Answer and explanation
Best answer: The rule incident-creation and grouping settings
Scheduled analytics can generate alerts while incident creation is disabled or configured differently. Check that part of the rule because query execution and ingestion are already confirmed.
Why the other choices fit less well
Alert severity and scheduling frequency do not enable incident creation. Reinstalling a connector is not justified when the relevant events already arrive and the rule produces alerts.
The where operator keeps rows satisfying its predicate. TimeGenerated >= ago(1h) restricts the result to timestamps at or after the one-hour boundary.
Why the other choices fit less well
project selects columns. take limits the number of rows without expressing that time boundary. count produces a row count rather than the requested filtered events.
Paid question-bank access is a one-time purchase, with no recurring subscription. Official exam registration, vouchers and provider labs are separate from CertSprint practice.
What you get here
How we practise them
Our SC-200 bank contains 39 PBQ-style exercises in two formats: matching tasks, where you pair each requirement to the capability that satisfies it, and ordering tasks, where you sequence the steps of a procedure. Each one carries the same full explanation as the multiple-choice questions, covering why the correct arrangement is right and why the plausible alternative is not.
These train the reasoning the exam tests — sequence, placement, and matching — rather than reproducing a vendor's simulation interface. Nothing here recreates the exam environment itself, and no practice product legitimately can.
See where you stand on SC-200
20 free questions, no card required. Your domain scores show which areas need work before you book the exam.
Work through the scenario, identify the evidence that matters, then compare your reasoning with the explanation. Use domain scores to choose your next study session. A practice percentage is a learning signal, not a prediction or an official exam score.
The newest practice set is available in eight languages. Earlier exercises may appear in English. These are original independent practice scenarios, not official exam questions.
The current Microsoft outline has three skill areas: managing the security operations environment, responding to incidents, and threat hunting. Some existing CertSprint practice categories use a more detailed historical grouping.
