Microsoft · 考试 SC-200

围绕考试实际考察的判断力设计的 SC-200 练习题。

Practice the workflows used to investigate, hunt, and respond across Microsoft Sentinel, Defender XDR, and cloud security operations.

免费开始 20 道题 查看包含内容Practice free questions
无需绑卡即可开始 · 一次性付款 · 永久访问
内容审核于 2026年10月

还不确定 SC-200 适不适合你？

先做免费的 10 题诊断——注册免费账户，即时评分并按领域给出详细分析，让你在做决定之前先了解自己的水平。

免费 10 题诊断

限时模拟考试

一次完整的限时模拟，包含 SC-200 道练习题，提交前不显示任何反馈——最接近真实考试的体验。

开始限时模拟
为你的下一次尝试而设计

有目标的备考。

Microsoft security operations analysts who work with Sentinel, Defender XDR, cloud workloads, incidents, and KQL-driven threat hunting.

CertSprint 结合了针对性练习、详细解析、基于表现的任务和分领域的准备度评估，让每次练习都清楚告诉你接下来该学什么。

完整题库

超越 20 道题的预览版，进入围绕当前考纲的技能与场景组织的完整题库。

有启发性的解析

了解为什么正确答案符合证据，以及为什么其他选项不成立，从而培养判断力而不是死记硬背。

PBQ 与应用场景题

练习排序、匹配、排查和配置类任务，让知识在考试压力下也能真正用得上。

按领域评估准备度

正确率会映射到各考试领域，揭示薄弱环节，把考试日期变成切实可行的每日练习目标。

你将练习的内容

专注于 SC-200 的覆盖范围。

整个体验围绕相关的判断与故障排查设计，而不是零散的知识点。

  • Microsoft Sentinel investigations
  • Defender XDR alerts and incidents
  • KQL-based threat hunting and response

Try three questions. Understand every answer.

Original English practice examples, with answers and explanations available here. No account required. These are independent teaching examples, not official exam questions or exam dumps.

Question 1 of 3 · Microsoft Sentinel investigations

A Sentinel scheduled rule produces alerts from verified query matches, but no incidents appear. Ingestion and rule execution are healthy. Which focused check should come before changing data collection?

Answer and explanation

Best answer: The rule incident-creation and grouping settings

Scheduled analytics can generate alerts while incident creation is disabled or configured differently. Check that part of the rule because query execution and ingestion are already confirmed.

Why the other choices fit less well

Alert severity and scheduling frequency do not enable incident creation. Reinstalling a connector is not justified when the relevant events already arrive and the rule produces alerts.

Microsoft: scheduled analytics rules

Question 2 of 3 · KQL investigation

A Microsoft Sentinel query must keep only SigninLogs rows from the last hour. Which KQL fragment filters rows rather than only displaying different columns?

Answer and explanation

Best answer: | where TimeGenerated >= ago(1h)

The where operator keeps rows satisfying its predicate. TimeGenerated >= ago(1h) restricts the result to timestamps at or after the one-hour boundary.

Why the other choices fit less well

project selects columns. take limits the number of rows without expressing that time boundary. count produces a row count rather than the requested filtered events.

Microsoft: KQL where operator

Question 3 of 3 · KQL investigation

After filtering sign-in events, an analyst needs the number of returned events for each UserPrincipalName. Which KQL fragment expresses that grouping?

Answer and explanation

Best answer: | summarize EventCount = count() by UserPrincipalName

summarize applies the count aggregation within each UserPrincipalName group. The result has a row for each group, with its event count.

Why the other choices fit less well

project selects a column, take limits rows, and where removes rows failing a predicate. None of those operations alone counts the events per user.

Microsoft: KQL summarize operator

Choose your next step

Free practice questions: 20 for SC-200. Create a free account to save your progress. No card required.

Try 20 SC-200 questions freePrefer a short check? Take the 10-question SC-200 diagnostic.

Paid question-bank access is a one-time purchase, with no recurring subscription. Official exam registration, vouchers and provider labs are separate from CertSprint practice.

考试是如何进行的

准确了解考试当天的情况。

Microsoft SC-200（SC-200）官方考试形式 — 预约前请到官方网站确认最新价格和政策，因为这些可能会变化。

形式1 exam
题目数量Typically 40–60 questions (Microsoft varies the exact count per delivery)
时长100 minutes for the assessment; appointment time also includes administrative steps
及格分数700 out of 1000
题型Multiple choice, multiple answer, drag-and-drop/build-list items, and case studies with several linked questions
考试方式Pearson VUE test center or online proctored
重考政策Wait 24 hours after the first failed attempt and 14 days between subsequent attempts. Maximum five attempts within 12 months of the first. Retake fees apply.
学习计划

一份按真实题库权重分配的 6 周计划。

每周的时长与该领域实际拥有的 SC-200 练习题数量成正比，而不是通用模板。可在仪表盘中跟踪真实进度。

  1. 1

    Manage a security operations environment

    26% of the full question bank — the single largest block this week.

    约每天 18 题
  2. 2

    Configure protections and detections + Manage incident response

    Smaller domains grouped together to keep every week substantive.

    约每天 24 题
  3. 3

    Perform threat hunting

    22% of the full question bank — the single largest block this week.

    约每天 15 题
  4. 4

    Respond to security incidents

    17% of the full question bank — the single largest block this week.

    约每天 12 题
  5. 5

    Cumulative review

    Mixed practice across every domain, prioritizing whichever ones your readiness tracker shows below 80% accuracy — not a fixed list, but whatever the data says is weakest this week.

  6. 6

    Timed mock exam

    Simulate the real exam: one sitting, the real question count and time limit, no pausing. Re-drill any domain that comes in under 80%.

用数据说话

在考试日发现之前，先找到你的薄弱领域。

免费试做 20 道 SC-200 题目。准备好后再解锁完整练习空间。

免费开始 SC-200

Go deeper on SC-200

有依据地练习

理解答案背后的判断。

先分析情境，找出关键证据，再对照解析检查自己的推理。根据各领域的得分决定下一次复习重点。练习正确率只能提示学习进度，不能预测正式考试成绩，也不等同于官方分数。

最新练习集提供八种语言版本。较早的练习可能以英语显示。这些是独立编写的原创练习情境，并非官方考试题目。

Microsoft当前的考试大纲有三个技能领域：管理安全运营环境、响应事件和威胁搜寻。CertSprint 的部分练习类别仍沿用更细的历史分类。