SC-200 Practice Exam 54 — 20 Questions

Question 1

Refer to the exhibit. A security analyst runs this PowerShell script to query a Log Analytics workspace. What is the purpose of this query?

Accepted Answer

Detect suspicious PowerShell activity using encoded commands. The query hunts for PowerShell executions with encoded commands, a common technique for obfuscation. It is not limited to specific users, recent activity, or only encoded commands without other criteria.

Answer

Count the number of unique devices

Answer

Identify all PowerShell executions in the last 7 days

Answer

List all processes run by a specific account

Answer

Find devices that have not run PowerShell recently

Question 2

Refer to the exhibit. You are deploying this analytics rule in Microsoft Sentinel. Which activity will trigger an alert?

Accepted Answer

Word launching cmd.exe. The query detects when cmd.exe is created by winword.exe, indicating a potential macro-based attack. It does not look for other processes or parent processes.

Answer

cmd.exe launching winword.exe

Answer

Any process creation event

Answer

Winword.exe execution

Answer

Any cmd.exe execution

Question 3

Which TWO actions should you perform to contain a ransomware incident in Microsoft Defender for Endpoint?

Accepted Answer

Isolate the device from the network.. Options B and D are correct. Isolating the device prevents further spread, and killing malicious processes stops encryption. Option A is wrong because running antivirus may not be immediate containment. Option C is wrong because resetting passwords is for user accounts, not endpoints. Option E is wrong because collecting files is for investigation, not containment.

Answer

Reset the local administrator password.

Answer

Run a full antivirus scan.

Answer

Collect the ransomware sample for analysis.

Question 4

Which THREE are valid ways to automatically respond to a security incident in Microsoft Defender XDR?

Accepted Answer

Configure an automated investigation and response (AIR) playbook.. Options A, B, and D are correct. Automated investigation and response (AIR) is a core feature, custom detection rules can trigger actions, and attack simulation training can be automated. Option C is wrong because manual playbooks are not automatic. Option E is wrong because threat intelligence integration does not automatically respond.

Answer

Integrate threat intelligence to automatically block indicators.

Answer

Manually run a playbook from the incident.

Question 5

Your organization uses Microsoft Sentinel and has enabled UEBA (User and Entity Behavior Analytics). You notice a series of incidents involving anomalous logon times for a privileged user. You want to automate the response to disable the user's account in Microsoft Entra ID when such incidents are created. What should you configure?

Accepted Answer

Create an automation rule that runs a playbook when an incident from the UEBA analytics rule is created, and configure the playbook to disable the user in Microsoft Entra ID.. Option D is correct because an automation rule can trigger a playbook that uses the Microsoft Entra ID connector to disable a user. Option A is wrong because UEBA does not directly trigger actions. Option B is wrong because analytics rules create alerts, not direct account actions. Option C is wrong because watchlists are for enrichment.

Answer

Create an analytics rule that triggers on UEBA anomalies and directly disables the user.

Answer

Add the user to a watchlist and create a playbook that runs on a schedule.

Answer

Configure UEBA to automatically disable the user when anomalous behavior is detected.

Question 6

Which TWO actions can you perform in Microsoft Defender XDR as part of incident response?

Accepted Answer

Collect an investigation package from a device

Answer

Create a Microsoft Sentinel workbook

Answer

Modify a Microsoft Entra ID conditional access policy

Answer

Run a KQL query in Azure Data Explorer

Question 7

A SOC analyst is triaging an incident in Microsoft Sentinel and needs to assign it to a senior analyst for further investigation. What is the correct action?

Accepted Answer

Open the incident and change the Owner field to the senior analyst.. Option A is correct because the incident details blade allows changing the owner. Option B is wrong because creating a new incident is not necessary. Option C is wrong because closing the incident would stop investigation. Option D is wrong because the playbook is for automation, not for assignment.

Answer

Create a new incident and manually add the senior analyst as a comment.

Answer

Close the incident and reopen it under the senior analyst's name.

Answer

Run a playbook that sends an email to the senior analyst.

Question 8

Your organization uses Microsoft Sentinel and Microsoft Defender for Cloud. You receive an alert from Defender for Cloud indicating that a virtual machine has a high severity vulnerability (CVE-2023-XXXX). You need to create an incident in Microsoft Sentinel and trigger a playbook to remediate the vulnerability. However, the incident is not being created automatically. What is the most likely cause?

Accepted Answer

The Microsoft Defender for Cloud connector in Microsoft Sentinel is not enabled or misconfigured. The correct answer is B because the connector must be enabled and configured properly for alerts to flow from Defender for Cloud to Sentinel. Option A is wrong because incorrect playbook permissions would affect playbook execution, not incident creation. Option C is wrong because analytics rules are not required for default incident creation. Option D is wrong because the free tier is functional but may have limitations.

Answer

An analytics rule with a matching severity threshold has not been created

Answer

The free trial of Microsoft Sentinel has expired

Answer

The playbook does not have the correct permissions on the target VM

Question 9

During a ransomware incident, you need to prevent the encryption of files on a server running Windows Server 2022. You have Microsoft Defender for Endpoint Plan 2. Which attack surface reduction rule should you enable?

Accepted Answer

Use advanced protection against ransomware. Option A is correct because 'Use advanced protection against ransomware' is a specific ASR rule that blocks ransomware behavior. Option B is wrong because 'Block executable files from running unless they meet a prevalence, age, or trusted list criterion' helps against unknown executables but not specifically ransomware. Option C is wrong because 'Block credential stealing from the Windows local security authority subsystem' targets credential theft. Option D is wrong because 'Block Adobe Reader from creating child processes' is for PDF exploits.

Answer

Block executable files from running unless they meet a prevalence, age, or trusted list criterion

Answer

Block credential stealing from the Windows local security authority subsystem

Answer

Block Adobe Reader from creating child processes

Question 10

Your organization uses Microsoft Sentinel and Microsoft Defender for Cloud. A critical server in Azure was compromised by ransomware. The incident response team needs to ensure that no other resources in the same resource group are affected. What is the most immediate containment action?

Accepted Answer

Disable the public IP address and apply an NSG rule to block all inbound/outbound traffic to the server's subnet.. Option A is correct because disabling the public IP and applying a network security group (NSG) block isolates the server while preserving the disk. Option B is wrong because deleting the VM destroys evidence. Option C is wrong because moving the VM to a different subnet does not prevent lateral movement from the original IP. Option D is wrong because changing the administrator password does not stop ransomware from running.

Answer

Delete the virtual machine immediately to stop the ransomware.

Answer

Change the local administrator password on the VM.

Answer

Move the VM to a different virtual network and subnet.

Question 11

Your organization uses Microsoft Purview to manage insider risk. A user is suspected of exfiltrating data via email. The incident response team needs to preserve a copy of the user's mailbox for legal hold. Which action should be taken?

Accepted Answer

Place the mailbox on litigation hold.. Option C is correct because a litigation hold preserves all mailbox content, including deleted items. Option A is wrong because eDiscovery hold is for specific searches, not full preservation. Option B is wrong because retention policies apply to all mailboxes, not targeted. Option D is wrong because MFA disablement does not preserve data.

Answer

Place the mailbox on an eDiscovery hold.

Answer

Disable the user's multi-factor authentication to prevent access.

Answer

Apply a Microsoft Purview retention policy to the user's mailbox.

Question 12

Your organization has Microsoft Defender for Endpoint deployed. A security analyst receives an alert about a suspicious PowerShell command executed on a device. The analyst needs to investigate the process tree. Which feature should the analyst use?

Accepted Answer

Timeline (process timeline). The correct answer is C because the timeline in Defender for Endpoint provides a detailed process tree and events. Option A is wrong because Advanced hunting is for querying, not visual process tree. Option B is wrong because the device isolation is for containment. Option D is wrong because live response is for remote commands, not investigation.

Answer

Device isolation

Answer

Live response

Answer

Advanced hunting

Question 13

You have been tasked with creating an automated response in Microsoft Sentinel for incidents involving lateral movement. Which Azure service allows you to run a playbook to automatically isolate a compromised VM?

Accepted Answer

Azure Logic Apps. Option A is correct because Microsoft Sentinel playbooks are built on Azure Logic Apps, which can execute automated actions like VM isolation. Option B is a query language, not an automation service. Option C is a data ingestion service. Option D is a query environment, not for automation.

Answer

Kusto Query Language (KQL)

Answer

Microsoft Defender XDR advanced hunting

Answer

Azure Event Hubs

Question 14

After a security incident, you need to collect forensic evidence from a Windows 10 machine. Which Microsoft tool should you use to create a memory dump?

Accepted Answer

Microsoft Crash Dump Tool (e.g., NotMyFault or Sysinternals tools). Option A is correct. Microsoft's official tool for memory dump creation is the Microsoft Crash Dump Tool (or other Sysinternals tools). Option B is for remote connectivity. Option C is for incident response. Option D is for endpoint detection.

Answer

Remote Desktop Protocol (RDP)

Answer

Microsoft Defender for Endpoint Live Response

Answer

Microsoft Defender for Cloud Apps

Question 15

Your organization uses Microsoft Sentinel. An incident has been identified as a false positive. What is the recommended action to prevent similar false positives in the future?

Accepted Answer

Modify the analytics rule to reduce false positives. Option C is correct because tuning the analytics rule reduces false positives. Option A is wrong because closing the incident without tuning does not prevent recurrence. Option B is wrong because marking as false positive in the incident is good for tracking but doesn't prevent future ones. Option D is wrong because deleting the rule is too aggressive.

Answer

Delete the analytics rule

Answer

Close the incident and set the classification to 'False positive'

Answer

Mark the incident as 'False positive' and add a comment

Question 16

Your organization uses Microsoft Sentinel. An incident is created for a possible data exfiltration via an unapproved external IP address. Which type of Microsoft Sentinel automation should you use to automatically block the IP address in the firewall?

Accepted Answer

Playbook.. An automation rule in Microsoft Sentinel can trigger a playbook (based on Azure Logic Apps) when an incident is created. The playbook can then block the IP. Data connectors ingest data, watchlists are for reference, and analytics rules create alerts.

Answer

Data connector.

Answer

Analytics rule.

Answer

Watchlist.

Question 17

The KQL query above is used in a Microsoft Sentinel analytics rule. What is the purpose of this rule?

Accepted Answer

Detect brute force attempts against disabled user accounts.. The query looks for sign-in failures (ResultType 50057) for disabled accounts (AccountEnabled == false) from the same IP exceeding a threshold. This indicates potential brute force attacks against disabled accounts, which could be a sign of reconnaissance or credential stuffing.

Answer

Detect when a disabled user account attempts to sign in.

Answer

Identify users who have been disabled due to inactivity.

Answer

Monitor sign-in attempts from suspicious IP addresses.

Question 18

A security analyst receives an alert in Microsoft Defender XDR indicating a possible credential theft attempt from an external IP. The analyst wants to isolate the affected device immediately while preserving forensic data. What should the analyst do?

Accepted Answer

Initiate a live response session on the device and run the 'isolate device' command.. Option B is correct because initiating a 'real-time response' session with 'isolate device' allows forensic data to be collected before isolation. Option A is wrong because disabling the user account does not prevent lateral movement from the device. Option C is wrong because resetting the password does not isolate the device. Option D is wrong because 'contain device' in Microsoft Defender for Endpoint is for network containment, not full isolation.

Answer

Use Microsoft Defender for Endpoint to 'contain device' from the device inventory.

Answer

Disable the user account in Microsoft Entra ID.

Answer

Reset the user's password and enforce sign-out.

Question 19

Which THREE are valid containment actions in Microsoft Defender for Endpoint? (Choose three.)

Accepted Answer

Contain device. Options A, B, and D are correct. 'Isolate device', 'Contain device', and 'Run antivirus scan' are built-in actions. Option C is wrong because 'Reset password' is not a containment action in Defender for Endpoint; it is done in Microsoft Entra ID. Option E is wrong because 'Collect investigation package' is a forensic action, not containment.

Answer

Reset password

Answer

Collect investigation package

Question 20

Your organization has deployed Microsoft Sentinel and uses the Microsoft 365 connector to ingest audit logs. You receive an alert from Microsoft Defender for Office 365 about a phishing email that was delivered to a user's inbox. You need to create an incident in Sentinel and automatically quarantine the email. What is the most efficient way to achieve this?

Accepted Answer

Create an automation rule in Microsoft Sentinel that is triggered when this specific alert is generated, and associate a playbook that uses the Microsoft 365 Defender connector to quarantine the email. The correct answer is C because Microsoft Sentinel can trigger an automation rule that runs a playbook to quarantine the email using Microsoft 365 Defender actions. Option A is wrong because the old Threat Explorer portal is not integrated with Sentinel. Option B is wrong because manual quarantine is not automatic. Option D is wrong because it suggests manual creation.

Answer

Use Microsoft Defender for Cloud Apps to investigate the alert and manually quarantine the email

Answer

Create a custom analytics rule that triggers when an alert is generated, and configure the rule to run a playbook that quarantines the email

Answer

Manually create an incident in Microsoft Sentinel and then run a playbook to quarantine the email

SC-200 Practice Exam 54 — 20 Questions

Exhibit

SC-200 Practice Exam 54 — 20 Questions

Exhibit