Microsoft SC-200

SC-200 的基于表现题目：是什么，如何练习

微软并不使用“performance-based question”这个说法。SC-200 采用的是选择题（单选/多选）搭配拖放题和构建列表题，以及若干道题共用同一情景的案例研究题。构建列表题是与 CompTIA 的 PBQ 最接近的题型。

免费练习 SC-200 SC-200 详情
考试在考察什么

为什么会有这些题目

考的是你能否实际操作相关工具，而不是能否描述它。比如一道要求排出 Defender XDR 响应操作顺序的构建列表题，或是一道把保留要求与正确的 Log Analytics 功能匹配起来的题目，考察的都是对产品的实操性掌握。

在真实考试中，它们表现为拖放题和构建列表题，以及案例研究题。单选、多选、拖放与列表排序题，以及包含多道关联题目的案例分析

  • 在案例研究题中，先完整读一遍整个情景，再作答任何问题。后面的问题经常依赖情景开头提到的某个限制条件。
  • 做构建列表题时，只有在危害仍在持续发生的情况下，遏制才应排在证据收集之前；否则应先收集证据，因为补救操作会破坏易失性证据。
  • 弄清楚每项功能在哪个环节生效——摄入之前、查询时，还是事后。很多匹配题就完全取决于这个区别。

Try three questions. Understand every answer.

Original English practice examples, with answers and explanations available here. No account required. These are independent teaching examples, not official exam questions or exam dumps.

Question 1 of 3 · Microsoft Sentinel investigations

A Sentinel scheduled rule produces alerts from verified query matches, but no incidents appear. Ingestion and rule execution are healthy. Which focused check should come before changing data collection?

Answer and explanation

Best answer: The rule incident-creation and grouping settings

Scheduled analytics can generate alerts while incident creation is disabled or configured differently. Check that part of the rule because query execution and ingestion are already confirmed.

Why the other choices fit less well

Alert severity and scheduling frequency do not enable incident creation. Reinstalling a connector is not justified when the relevant events already arrive and the rule produces alerts.

Microsoft: scheduled analytics rules

Question 2 of 3 · KQL investigation

A Microsoft Sentinel query must keep only SigninLogs rows from the last hour. Which KQL fragment filters rows rather than only displaying different columns?

Answer and explanation

Best answer: | where TimeGenerated >= ago(1h)

The where operator keeps rows satisfying its predicate. TimeGenerated >= ago(1h) restricts the result to timestamps at or after the one-hour boundary.

Why the other choices fit less well

project selects columns. take limits the number of rows without expressing that time boundary. count produces a row count rather than the requested filtered events.

Microsoft: KQL where operator

Question 3 of 3 · KQL investigation

After filtering sign-in events, an analyst needs the number of returned events for each UserPrincipalName. Which KQL fragment expresses that grouping?

Answer and explanation

Best answer: | summarize EventCount = count() by UserPrincipalName

summarize applies the count aggregation within each UserPrincipalName group. The result has a row for each group, with its event count.

Why the other choices fit less well

project selects a column, take limits rows, and where removes rows failing a predicate. None of those operations alone counts the events per user.

Microsoft: KQL summarize operator

Choose your next step

Free practice questions: 20 for SC-200. Create a free account to save your progress. No card required.

Try 20 SC-200 questions freePrefer a short check? Take the 10-question SC-200 diagnostic.

Paid question-bank access is a one-time purchase, with no recurring subscription. Official exam registration, vouchers and provider labs are separate from CertSprint practice.

你在这里能得到什么

我们如何练习它们

我们的 SC-200 题库包含 39 道 PBQ 风格练习题，分为两种形式：匹配任务（将每项需求与满足它的能力配对）和排序任务（将某个流程的步骤排序）。每道题都附有和选择题相同的完整解析，说明为什么正确的安排是对的，以及为什么看似合理的选项是错的。

这些练习训练的是考试所考察的推理能力——顺序、定位和匹配——而不是复刻厂商的模拟界面。这里的任何内容都不会重现真实的考试环境，任何练习产品也都不应该合法地这样做。

看看你在 SC-200 上处于什么水平

20 道免费题目，无需信用卡。你的领域得分会显示在预约考试前哪些方面还需要加强。

免费开始

相关内容

Microsoft SC-200 练习题 · 全部六个认证 · CertSprint 如何运作

有依据地练习

理解答案背后的判断。

先分析情境，找出关键证据，再对照解析检查自己的推理。根据各领域的得分决定下一次复习重点。练习正确率只能提示学习进度，不能预测正式考试成绩，也不等同于官方分数。

最新练习集提供八种语言版本。较早的练习可能以英语显示。这些是独立编写的原创练习情境，并非官方考试题目。

Microsoft当前的考试大纲有三个技能领域：管理安全运营环境、响应事件和威胁搜寻。CertSprint 的部分练习类别仍沿用更细的历史分类。