SC-200 performance-based questions: what they are and how to practise them
Microsoft does not use the term "performance-based question". SC-200 instead mixes multiple choice and multiple answer with drag-and-drop and build-list items, and case studies where several linked questions share one scenario. The build-list items are the closest equivalent to a CompTIA PBQ.
Why these questions exist
Whether you can operate the tooling, not describe it. A build-list item asking for the order of response actions in Defender XDR, or a matching item pairing a retention requirement to the right Log Analytics capability, is testing working knowledge of the product.
On the real exam these appear as drag-and-drop and build-list items, plus case studies. Multiple choice, multiple answer, drag-and-drop and build-list items, plus case studies with linked questions
- In case studies, read the entire scenario once before answering anything. Later questions frequently depend on a constraint stated at the top.
- For build-list items, containment normally precedes evidence collection only when harm is ongoing; otherwise collect first, because remediation destroys volatile evidence.
- Know which capability acts at which point — before ingestion, at query time, or after the fact. Several matching items turn entirely on that distinction.
How we practise them
Our SC-200 bank contains 37 PBQ-style exercises in two formats: matching tasks, where you pair each requirement to the capability that satisfies it, and ordering tasks, where you sequence the steps of a procedure. Each one carries the same full explanation as the multiple-choice questions, covering why the correct arrangement is right and why the plausible alternative is not.
These train the reasoning the exam tests — sequence, placement, and matching — rather than reproducing a vendor's simulation interface. Nothing here recreates the exam environment itself, and no practice product legitimately can.
See where you stand on SC-200
20 free questions, no card required. Your domain scores show which areas need work before you book the exam.
Learn the decision behind the answer.
Work through the scenario, identify the evidence that matters, then compare your reasoning with the explanation. Use domain scores to choose your next study session. A practice percentage is a learning signal, not a prediction or an official exam score.
The current Microsoft outline has three skill areas: managing the security operations environment, responding to incidents, and threat hunting. Some existing CertSprint practice categories use a more detailed historical grouping.