Practise the incident response part of SC-200 with Exam Dumpster: questions on triaging alerts in Defender XDR, automated investigation and remediation, Sentinel playbooks and evidence collection, each explained in a few sentences so SOC analysts can see why an option is correct. https://examdumpster.com/practice-tests/microsoft/SC-200-security-operations-analyst/sample-questions