SC-200 Practice Test 49 — 15 Questions

Question 1

During a ransomware incident, Microsoft Defender for Cloud Apps alerts indicate that a user is uploading large volumes of data to an external cloud storage provider not approved by your organization. Which two actions should you take first? (Choose two.)

Accepted Answer

Block the unapproved cloud storage app. The immediate actions are to suspend the user's access to prevent further data exfiltration and block the unapproved app to stop data uploads. Initiating a legal hold and notifying the user are later steps.

Answer

Notify the user about the policy violation

Answer

Initiate a legal hold on the user's data

Question 2

Your security team uses Microsoft Sentinel analytics rules to detect brute-force attacks. A rule triggers when more than 10 failed logins occur within 5 minutes from a single IP. An incident is generated. Which first step should the analyst take?

Accepted Answer

Investigate the incident details. The first step is to investigate the incident to confirm it's a true positive and assess scope. Blocking the IP might be premature without verification. Resetting passwords and notifying users come after confirmation.

Answer

Block the source IP address on the firewall

Answer

Notify the users of the failed login attempts

Answer

Reset passwords for all affected accounts

Question 3

An incident in Microsoft Defender XDR involves a device that is suspected to be infected with ransomware. The device is online and actively encrypting files. Which action should you take to contain the threat?

Accepted Answer

Isolate the device from the network. The immediate containment action is to isolate the device from the network to stop lateral movement and encryption. Running antivirus or collecting forensic data is secondary. Disabling the user account does not stop the device.

Answer

Disable the user's account

Answer

Run a full antivirus scan on the device

Answer

Collect a memory dump from the device

Question 4

Your organization uses Microsoft Sentinel with UEBA (User and Entity Behavior Analytics). An alert indicates a user's sign-in from an unusual location, followed by a mass download of sensitive files from SharePoint. The user is a low-privilege employee. What is the most likely conclusion?

Accepted Answer

The user's account is compromised. The combination of unusual location and mass download of sensitive files by a low-privilege user suggests account compromise. It is not necessarily ransomware or a false positive, and insider threat is less likely without evidence of intent.

Answer

The alert is a false positive due to user travel

Answer

The user is an insider threat

Answer

The user is conducting a ransomware attack

Question 5

You are responding to an incident where a user's credentials were used to access a federated SaaS application from an IP address associated with a known threat actor. The user's account is not disabled. Which action is most effective to prevent further unauthorized access?

Accepted Answer

Reset the user's password and revoke active sessions. Resetting the user's password and revoking tokens is the most effective because it invalidates current sessions and prevents further use of stolen credentials. Disabling the account is also effective but may cause business disruption; resetting and revoking is less disruptive. Blocking IP may not be effective if threat actor uses different IPs. Conditional access policy change is slower.

Answer

Create a Conditional Access policy to block the IP

Answer

Disable the user's account

Answer

Block the source IP address on the firewall

Question 6

During an incident response, you need to collect forensic data from Microsoft Defender for Endpoint (MDE) on a remote device that is currently offline. What is the best approach?

Accepted Answer

Initiate a live response session when the device comes online. The best approach is to initiate a live response once the device is online, because live response allows command execution and data collection. Collecting from cloud store is not direct. Remotely scheduled scan is not forensic collection. Waiting is passive.

Answer

Wait until the device is online and then collect manually

Answer

Run a remotely scheduled antivirus scan

Answer

Collect the data from the device's cloud store

Question 7

An incident in Microsoft Sentinel involves a phishing campaign that delivered a malicious macro-enabled document. The document was opened by 15 users. Which playbook action should be triggered automatically to contain the threat?

Accepted Answer

Block the file hash using Microsoft Defender for Endpoint. The automatic playbook action should block the file hash at the endpoint to prevent further execution. Isolating devices may be too aggressive. Blocking sender IP is not effective against phishing. Disabling user accounts is not direct.

Answer

Isolate all affected devices from the network

Answer

Block the sender's IP address on the email gateway

Answer

Disable the user accounts of those who opened the document

Question 8

Which TWO actions are appropriate when responding to a confirmed data exfiltration incident via email?

Accepted Answer

Block the recipient domain on the email gateway. Appropriate actions are to block the recipient domain and place a legal hold on the mailbox. Disabling the user account might be premature. Scanning the device is not directly for email. Deleting sent items is not forensic.

Answer

Disable the user's account immediately

Answer

Delete all sent items from the user's mailbox

Answer

Run a full antivirus scan on the user's device

Question 9

An analyst creates a playbook in Microsoft Sentinel to automatically block an IP address when an alert fires. However, the playbook fails to block the IP. What is the most likely cause?

Accepted Answer

The IP address is being extracted from an incorrect field in the alert. The playbook references an incorrect field. The IP address should come from the alert's entity, not the alertRuleId. The trigger type is correct but the property path is wrong. Also, the action type should be

Wait, the exhibit shows 'actionType': 'BlockIP' which is not a standard action type. The correct action type might be 'Run playbook' or a connector. However, the most obvious error is the property path: 'alertRuleId' is not an IP address. Also, 'BlockIP' action type does not exist; actual block action is performed via a connector like Azure Firewall or Defender. But given the options, the incorrect property path is the key issue.

Answer

The block duration is set to one day, which is too short

Answer

The playbook actions array has only one action, which is insufficient

Answer

The playbook is using the wrong trigger type; it should be on incident creation

Question 10

You are deploying Microsoft Sentinel using the above ARM template parameters. After deployment, you notice that Microsoft Defender for Cloud alerts are not being ingested. What is the MOST likely reason?

Accepted Answer

The 'MicrosoftThreatProtection' connector only ingests Microsoft Defender XDR signals, not Defender for Cloud alerts.. Option C is correct because 'MicrosoftThreatProtection' in the dataConnectors list refers to Microsoft Defender XDR, not Defender for Cloud. Defender for Cloud requires the 'AzureSecurityCenter' data connector. Option A is wrong because UEBA is enabled but does not affect data ingestion. Option B is wrong because location does not affect connector availability. Option D is wrong because workspace name is valid.

Answer

UEBA is enabled, which conflicts with Defender for Cloud data ingestion.

Answer

The workspace location (eastus) does not support Defender for Cloud connector.

Answer

The workspace name 'sentinel-workspace' is reserved for internal use.

Question 11

Your organization uses Microsoft Defender for Cloud to monitor hybrid workloads. You receive an alert that a fileless malware attack was detected on an on-premises server connected via Azure Arc. The server is running Windows Server 2019. What is the BEST action to contain the threat?

Accepted Answer

Run a script via Azure Arc to disable the network interfaces on the server.. Option D is correct because Azure Arc allows executing scripts on the server, and running a script to disable network interfaces is a quick containment method. Option A is wrong because uninstalling the agent would lose visibility. Option B is wrong because Azure Update Manager does not contain fileless attacks. Option C is wrong because Azure Automation runbooks can be used but require setup; direct script execution is faster.

Answer

Apply a security update using Azure Update Manager.

Answer

Use Azure Automation runbook to restart the server.

Answer

Uninstall the Azure Arc agent from the server to isolate it.

Question 12

Which TWO actions are valid for containing a compromised user account in Microsoft 365 Defender? (Choose two.)

Accepted Answer

Disable the user account in Microsoft Entra ID.. A and D are correct. Disabling the user account immediately blocks access. Resetting the password forces the user to change credentials. B is wrong because deleting the mailbox is destructive and may be unnecessary. C is wrong because blocking the user's IP may affect other users. E is wrong because revoking session tokens does not prevent new sign-ins with valid credentials.

Answer

Block the user's IP address in Defender for Cloud Apps.

Answer

Revoke the user's session tokens.

Answer

Delete the user's mailbox in Exchange Online.

Question 13

Your organization uses Microsoft Defender for Cloud Apps. During an incident, you discover that a user is downloading large amounts of data from SharePoint to an unmanaged device. You need to automatically block further downloads from that device. What should you configure?

Accepted Answer

Create a session policy in Microsoft Defender for Cloud Apps to block download.. Option B is correct because Defender for Cloud Apps session policies can block downloads from unmanaged devices. Option A is wrong because conditional access policies block access but not specific actions. Option C is wrong because DLP policies generate alerts but do not block. Option D is wrong because device compliance policies require Intune enrollment.

Answer

Create a Conditional Access policy to require a compliant device.

Answer

Configure Microsoft Intune device compliance policy.

Answer

Create a DLP policy in Microsoft Purview.

Question 14

You are reviewing an incident in Microsoft Sentinel. The incident is assigned to a user. What does the 'assignedTo' field indicate?

Accepted Answer

The incident is assigned to that user for investigation.. Option A is correct because 'assignedTo' indicates the user responsible for the incident. Option B is wrong because the incident is not closed. Option C is wrong because it is the owner. Option D is wrong because it is an individual.

Answer

The incident was created by that user.

Answer

The incident was closed by that user.

Answer

The incident is assigned to a Microsoft Entra group.

Question 15

Your organization uses Microsoft Defender for Cloud. You receive a security alert about a suspicious process on a virtual machine. You want to investigate the process further. What should you do?

Accepted Answer

Initiate a live response session on the VM from Microsoft Defender for Cloud.. Option A is correct because live response allows real-time investigation of a VM. Option B is wrong because creating a custom detection rule is for future alerts. Option C is wrong because initiating an automated investigation is for incident response, not ad-hoc investigation. Option D is wrong because running a vulnerability scan is for vulnerabilities, not process investigation.

Answer

Create a custom detection rule to alert on similar processes.

Answer

Run a vulnerability assessment scan on the VM.

Answer

Initiate an automated investigation on the VM.