SC-200 Practice Exam 53 — 20 Questions

Question 1

A security analyst receives a Microsoft Defender for Cloud Apps alert about a user performing unusual file downloads from SharePoint. The analyst needs to investigate the user's activity in the last 24 hours. Which log source should the analyst query first?

Accepted Answer

Cloud App Security logs in Microsoft Sentinel. Option A is correct because Defender for Cloud Apps logs user activity in the cloud app activities log. Option B is wrong because Azure AD sign-in logs show authentication events, not file downloads. Option C is wrong because Office 365 audit logs include SharePoint file activities, but Defender for Cloud Apps provides a more consolidated view. Option D is wrong because Microsoft Intune logs focus on device management.

Answer

Microsoft Entra ID sign-in logs

Answer

Microsoft Intune device logs

Answer

Office 365 audit logs

Question 2

Your organization uses Microsoft Sentinel. A security analyst reports that an incident was automatically closed without investigation. You need to identify why the incident was closed automatically. Which Sentinel feature should you review?

Accepted Answer

Automation rules. Automation rules can be configured to automatically close incidents based on conditions. Playbooks require manual triggering or automation rules. Analytics rules create incidents, not close them. Workbooks and watchlists do not close incidents.

Answer

Analytics rules

Answer

Playbooks

Answer

Workbooks

Answer

Watchlists

Question 3

Your organization uses Microsoft Sentinel and Microsoft Defender for Cloud. During an incident, you need to automatically disable a compromised Azure VM from the network. Which playbook action should you use?

Accepted Answer

Add a rule to the VM's network security group to deny all traffic.. Option A is correct because you can use Azure Network Security Group to deny all inbound/outbound traffic to the VM. Option B is wrong because Azure RBAC does not affect network access. Option C is wrong because Azure Policy does not apply runtime network controls. Option D is wrong because Azure Firewall rules are not VM-specific.

Answer

Apply an Azure Policy to deny network changes.

Answer

Create an Azure Firewall rule to block the VM's IP.

Answer

Remove the VM's role assignment from Azure RBAC.

Question 4

Your organization has a hybrid identity environment with Microsoft Entra ID and on-premises Active Directory. You suspect a compromised on-premises admin account that has been used to modify security groups. You want to quickly contain the threat. What should you do first?

Accepted Answer

Revoke the user's sessions in Microsoft Entra ID and reset the password in both on-premises AD and Entra ID.. Option D is correct because revoking the user's session tokens and resetting the password in both on-premises AD and Entra ID immediately stops further activity. Option A is wrong because disabling the user in Entra ID alone does not block on-premises access. Option B is wrong because resetting password in on-premises AD does not revoke current tokens. Option C is wrong because moving the user to a blocked OU may not take effect immediately.

Answer

Move the user account to an Organizational Unit (OU) with blocked logon hours.

Answer

Reset the user's password in on-premises Active Directory.

Answer

Disable the user account in Microsoft Entra ID.

Question 5

Your organization uses Microsoft Defender for Office 365. You detect a phishing email that was delivered to a user's inbox. You want to remove the email from all recipients. What should you do?

Accepted Answer

Use Threat Explorer to find the email and take action to delete it.. Option B is correct because the Threat Explorer in Defender for Office 365 allows you to take action on emails, such as deleting them. Option A is wrong because creating a mail flow rule is reactive but not immediate removal. Option C is wrong because submitting to Microsoft is for analysis. Option D is wrong because blocking the sender does not remove already delivered emails.

Answer

Submit the email to Microsoft for analysis.

Answer

Create a mail flow rule to delete similar emails in the future.

Answer

Block the sender using the Tenant Allow/Block List.

Question 6

During an incident, you need to prevent a malicious process from running on all endpoints using Microsoft Defender for Endpoint. The process is not yet detected by antivirus signatures. Which action should you use?

Accepted Answer

Add an indicator to block the process. Option C is correct because 'Indicators' allow you to block or allow specific hashes, IPs, or certificates. Option A is wrong because 'Initiate Live Response' is for live interaction. Option B is wrong because 'Run antivirus scan' may not detect unknown processes. Option D is wrong because 'Collect investigation package' is for data collection.

Answer

Run antivirus scan

Answer

Collect investigation package

Answer

Initiate Live Response

Question 7

During an incident involving a compromised Azure VM, the security team wants to capture a memory dump for forensic analysis. The VM is running Windows Server 2022. What is the recommended approach?

Accepted Answer

Initiate a live response session on the VM and run the 'dump memory' command.. Option B is correct because initiating a live response session in Microsoft Defender for Endpoint allows running a memory dump collection command. Option A is wrong because taking a snapshot captures the disk, not memory. Option C is wrong because PowerShell remoting may not work if the VM is isolated. Option D is wrong because Azure Backup captures disk state, not memory.

Answer

Use Azure Backup to create a VM snapshot.

Answer

Establish a PowerShell remote session and run 'Get-Process | Export-CliXML'.

Answer

Use Azure Disk Encryption to export the disk.

Question 8

A security analyst in your organization receives an alert from Microsoft Defender for Cloud Apps indicating that a user has installed a third-party app with high permissions in Microsoft 365. The analyst suspects a consent phishing attack. Which playbook in Microsoft Sentinel should the analyst use to automate the investigation and remediation?

Accepted Answer

Entity page. The correct answer is B because the 'Entity page' in Microsoft Sentinel provides a consolidated view of all alerts, incidents, and activities related to a specific user, enabling efficient investigation of consent phishing. Option A is wrong because Automation rules are for automated response, not investigation. Option C is wrong because Hunting queries are for proactive threat hunting, not immediate investigation. Option D is wrong because Workbooks are for visualizations and reporting, not investigation.

Answer

Automation rule

Answer

Hunting query

Answer

Workbook

Question 9

Your organization uses Microsoft Defender for Endpoint. An endpoint is detected as infected with a trojan. The analyst needs to isolate the device from the network while preserving forensic data. What action should the analyst take?

Accepted Answer

Initiate the 'Isolate device' action from the Microsoft Defender XDR portal.. Option C is correct because 'Isolate device' in Defender for Endpoint disconnects the device from the network but keeps it connected to Microsoft Defender for analysis. Option A is wrong because disabling the network adapter may lose connection to Defender. Option B is wrong because removing the device from the domain does not isolate it. Option D is wrong because reimaging destroys forensic data.

Answer

Remove the device from the Active Directory domain.

Answer

Disable the network adapter on the device.

Answer

Perform a full reimage of the device.

Question 10

Your organization has Microsoft Defender XDR enabled. An incident is generated for a user who clicked a phishing link in an email. The analyst needs to automatically disable the user's mailbox for suspicious activity. Which automated action should the analyst configure in a Microsoft Sentinel automation rule?

Accepted Answer

Run a playbook that uses the Microsoft 365 Defender connector to disable the mailbox.. Option A is correct because disabling the mailbox is a remediation action available in Microsoft 365 Defender. Option B is wrong because deleting the email does not prevent future access. Option C is wrong because blocking the sender IP is not a direct action from Sentinel. Option D is wrong because resetting password is a different action.

Answer

Run a playbook that deletes the phishing email from the user's inbox.

Answer

Configure an automation rule to block the sender IP address in Defender for Cloud Apps.

Answer

Run a playbook that resets the user's password.

Question 11

During an incident response, you need to collect a memory dump from a compromised Windows 10 device managed by Microsoft Defender for Endpoint. Which action should you take in the Microsoft Defender XDR portal?

Accepted Answer

Initiate a Live Response session and run the 'memdump' command. Live Response allows executing commands like collecting memory dumps. Running a PowerShell script or initiating a scan does not collect a memory dump. The other options are not available actions.

Answer

Run a custom detection script

Answer

Execute a Power Automate flow to collect memory

Answer

Start a full antivirus scan

Answer

Submit the device for automated investigation

Question 12

You are investigating a suspicious sign-in to a privileged account. You need to determine if the sign-in was from a known malicious IP address. Which Microsoft Sentinel data source should you query?

Accepted Answer

ThreatIntelligenceIndicator. Option B is correct because Threat Intelligence in Sentinel contains known malicious IPs. Option A is wrong because SigninLogs show sign-in events but not threat intelligence. Option C is wrong because AuditLogs are for directory changes. Option D is wrong because SecurityEvent is for Windows event logs.

Answer

SecurityEvent

Answer

SigninLogs

Answer

AuditLogs

Question 13

Which TWO are valid incident response actions in Microsoft Sentinel?

Accepted Answer

Change the incident status to Active.. Options A and C are correct. Changing incident status and assigning owner are standard actions. Options B, D, and E are not valid: adding comments is a separate action, running a query is not an incident action, and merging incidents is already done via automation.

Answer

Run a KQL query from the incident.

Answer

Merge the incident with another incident.

Answer

Add a comment to the incident.

Question 14

Your organization uses Microsoft Defender for Identity. You receive an alert about a suspicious Kerberos authentication attempt. What is the best first step to contain the potential threat?

Accepted Answer

Disable the account that was used for the authentication.. Option C is correct because disabling the compromised account immediately stops further authentication. Option A is wrong because investigating the source IP does not contain the threat. Option B is wrong because reviewing logs does not contain. Option D is wrong because resetting the krbtgt account is a drastic step and not the first action.

Answer

Review the Active Directory logs for related events.

Answer

Reset the krbtgt account password twice.

Answer

Investigate the source IP address of the authentication attempt.

Question 15

You are investigating an incident in Microsoft Defender XDR. The incident involves multiple alerts from different workloads. You need to view all related alerts in a single timeline. What should you use?

Accepted Answer

Incident page. Option A is correct because the incident page in Defender XDR shows all related alerts. Option B is wrong because the action center shows remediation actions. Option C is wrong because the hunting page is for proactive queries. Option D is wrong because the device timeline is per device.

Answer

Advanced hunting

Answer

Action center

Answer

Device timeline

Question 16

Your organization uses Microsoft Sentinel and Microsoft Defender for Identity. An alert fires for a potential DCSync attack. The incident response team needs to immediately block the source account from performing directory replication. Which action should be taken?

Accepted Answer

Disable the account in Microsoft Entra ID (if synced) or Active Directory.. Option D is correct because disabling the account in Microsoft Entra ID (formerly Azure AD) is the quickest way to stop the account from performing any actions, including DCSync. Option A is wrong because removing from Domain Admins does not remove the 'Replicate Directory Changes' permission if it was delegated. Option B is wrong because resetting the password does not terminate existing sessions immediately. Option C is wrong because the Microsoft Defender for Identity alert provides details but does not directly block the account.

Answer

Use Microsoft Defender for Identity to disable the account.

Answer

Reset the account password and enforce a sign-out.

Answer

Remove the account from the Domain Admins group.

Question 17

You are responding to a ransomware incident in Microsoft Defender XDR. You have identified that the malware encrypted files on several devices and then deleted the volume shadow copies. Which of the following actions should you take first to contain the incident?

Accepted Answer

Isolate affected devices using Microsoft Defender for Endpoint. The correct answer is A because isolating devices prevents the ransomware from spreading to other systems. Option B is wrong because deleting the malware does not address the encryption already done. Option C is wrong because restoring files should wait until containment is achieved. Option D is wrong because running a full scan is not the first containment step.

Answer

Run a remediation action to delete the detected malware

Answer

Restore encrypted files from backup

Answer

Run a full antivirus scan on all devices

Question 18

Which TWO of the following are valid sources for creating incidents in Microsoft Sentinel? (Choose two.)

Accepted Answer

Microsoft 365 Defender alerts. The correct answers are B and C. Incidents can be created from analytics rules or from Microsoft 365 Defender alerts. Option A is wrong because playbooks are for response, not incident creation. Option D is wrong because workbooks are for visualization. Option E is wrong because hunting queries do not create incidents automatically.

Answer

Hunting query results

Answer

Workbook creation

Answer

Playbook execution

Question 19

You are responding to a data exfiltration incident in Microsoft Sentinel. The attacker used a PowerShell script to upload data to an external storage account. You need to identify the specific storage account used. Which KQL query should you use in the AzureActivity table?

Accepted Answer

OperationName == 'Storage Blob Upload'. Option C is correct because Storage Blob Upload is the operation for uploading data. Option A is wrong because List Storage Keys is for managing storage account keys. Option B is wrong because Create or Update Storage Account is for provisioning. Option D is wrong because Get Storage Account Properties is read-only.

Answer

OperationName == 'Get Storage Account Properties'

Answer

OperationName == 'Create or Update Storage Account'

Answer

OperationName == 'List Storage Account Keys'

Question 20

An incident in Microsoft Sentinel was assigned to you. After investigation, you determine it is a false positive. What should you do to resolve the incident?

Accepted Answer

Close the incident with classification 'FalsePositive'. The correct action is to close the incident with a classification of 'FalsePositive'. Changing status or adding comments does not resolve it properly. Deleting is not recommended.

Answer

Add a comment and leave it open

Answer

Delete the incident

Answer

Reassign to another analyst

Answer

Change the status to 'Active'