SC-200 Practice Exam 55 — 20 Questions

Question 1

A SOC analyst receives an alert from Microsoft Defender for Cloud Apps indicating that a user downloaded 500 GB of data from SharePoint to an unmanaged device. The user has no history of such behavior. What is the best first step in the incident response process?

Accepted Answer

Disable the user account in Microsoft Entra ID.. Option B is correct because disabling the user account immediately stops the potential data exfiltration and is the recommended containment step in ransomware or data theft scenarios. Option A is reactive and does not prevent further data loss. Option C is premature without containment. Option D may be necessary but not the first step.

Answer

Run a full antivirus scan on the unmanaged device.

Answer

Contact the user to verify if the download was intentional.

Answer

Create a detection rule for similar behavior in Microsoft Sentinel.

Question 2

You are investigating an incident where a user reported receiving a suspicious email with a malicious attachment. Microsoft Defender for Office 365 did not block it. The email originated from a known malicious sender domain. What configuration should you check first?

Accepted Answer

Anti-phishing policy in Microsoft Defender for Office 365. Option C is correct. The most likely reason for the email not being blocked is that the anti-phishing policy is not properly configured or the sender is bypassed. Option A (SPF) is relevant but less likely if the domain is known malicious. Option B (safe attachments) may not catch all. Option D (user reporting) is not about blocking.

Answer

User-reported message settings

Answer

SPF record for the sender domain

Answer

Safe Attachments policy

Question 3

Refer to the exhibit. You are reviewing an automation rule in Microsoft Sentinel that triggers a playbook. The rule is not triggering. What is the most likely cause?

Accepted Answer

The condition 'Status equals Active' is incorrect; incidents are created with status 'New'. Option A is correct because the condition filters for incidents with Status equals 'Active', but when an incident is created, its status is 'New', so the condition never matches. Option B is wrong because Logic App resource ID is correct. Option C is wrong because trigger type is correct. Option D is wrong because subscription issue would cause a different error.

Answer

The Logic App resource ID is incorrect

Answer

The subscription ID is missing

Answer

The trigger type should be 'IncidentUpdated' instead of 'IncidentCreated'

Question 4

You are a security analyst investigating a detected phishing campaign targeting users in your organization. The Microsoft Defender for Office 365 alert indicates that several users clicked on a malicious link. Which action should you take first to prevent further compromise?

Accepted Answer

Add the malicious URL to the Microsoft Defender for Endpoint custom threat indicator list.. The first priority is to block the malicious URL across all endpoints using Microsoft Defender for Endpoint's IOC capabilities to prevent any other users from clicking the link. Isolating users would be disruptive and may not be necessary for all. Reporting to Microsoft is not immediate. Blocking the sender may help but does not stop users who already have the email.

Answer

Isolate all affected users' devices from the network.

Answer

Report the email to Microsoft for analysis.

Answer

Block the sender email address in the tenant.

Question 5

Which TWO actions should be taken to respond to a potential data exfiltration incident detected by Microsoft Defender for Cloud Apps?

Accepted Answer

Suspend the user account in Microsoft Entra ID.. Suspending the user account and revoking active sessions are immediate containment actions. Blocking IP is good but may not be sufficient if the user is compromised. Reporting to Microsoft is not immediate. Running a full scan is not for cloud apps.

Answer

Block the IP address of the user's device at the firewall.

Answer

Report the user to Microsoft for investigation.

Answer

Run a full antivirus scan on the user's device.

Question 6

Your organization uses Microsoft Defender XDR. A security incident involving a compromised user account has been identified. Which THREE actions should you take to contain and remediate the incident?

Accepted Answer

Disable the user account in Microsoft Entra ID.. Disabling the user account prevents further access. Resetting the password ensures the attacker cannot use the old credentials. Revoking sessions forces termination of active sessions. Option A is incorrect because blocking all IPs is too broad and may affect legitimate users. Option D is incorrect because restoring from backup is not immediate and may not address the root cause.

Answer

Block all IP addresses that the user has connected from.

Answer

Restore the user's mailbox from a backup.

Question 7

During an incident response, a SOC analyst needs to automatically collect relevant evidence from multiple Microsoft 365 services. Which Microsoft Sentinel playbook trigger should the analyst configure?

Accepted Answer

Microsoft Sentinel Incident trigger with action 'Collect evidence'.. Option C is correct because 'When an incident is triggered' allows automation based on Sentinel incidents. Option A is wrong because 'When a new alert is created' is too granular and not designed for multi-service evidence collection. Option B is wrong because 'When a response action is executed' is not a standard trigger. Option D is wrong because a scheduled query is for hunting, not for automated response.

Answer

Microsoft Sentinel Playbook trigger 'When a response action is executed'.

Answer

Microsoft Sentinel Scheduled Analytics rule trigger.

Answer

Microsoft Sentinel Alert trigger.

Question 8

Which TWO are valid sources of evidence in a Microsoft Sentinel incident? (Choose two.)

Accepted Answer

Alerts. Options A and C are correct. Alerts and bookmarks are evidence items in an incident. Option B is wrong because watchlists are reference data, not evidence. Option D is wrong because hunting queries are not stored as evidence. Option E is wrong because playbooks are automation, not evidence.

Answer

Playbooks

Answer

Watchlists

Answer

Hunting queries

Question 9

Your organization uses Microsoft Defender for Cloud to protect hybrid cloud workloads. An alert indicates that a container in Azure Kubernetes Service (AKS) is running a privileged container. Which response action should you take first?

Accepted Answer

Investigate the alert details in Microsoft Defender for Cloud. The correct answer is A because the first step is to investigate the alert to confirm the behavior. Option B is wrong because disabling the container without investigation could impact services. Option C is wrong because restarting is not a containment measure. Option D is wrong because deleting the container is too drastic without investigation.

Answer

Disable the container immediately

Answer

Restart the AKS cluster

Answer

Delete the container and its image

Question 10

During an incident investigation, you find that a compromised account was used to log into a virtual machine via RDP from an IP address in a sanctioned country. The VM has Microsoft Defender for Endpoint installed. Which data source in Microsoft Sentinel would you query to see the RDP connection events?

Accepted Answer

SecurityEvent. Option C is correct because RDP connection events on a Windows machine are captured in the SecurityEvent table (Event ID 4624). Option A is for network traffic logs. Option B is for audit logs from Azure AD. Option D is for advanced hunting in Defender for Endpoint, but not directly ingested into Sentinel by default.

Answer

DeviceLogonEvents (Microsoft Defender XDR)

Answer

CommonSecurityLog

Answer

SigninLogs (Microsoft Entra ID)

Question 11

You receive an incident in Microsoft Sentinel that is a low-confidence alert from Microsoft Defender for Identity. What should be your first step?

Accepted Answer

Investigate the alert by reviewing related entities and logs.. Option A is correct. The analyst should first investigate to determine if the alert is a true positive. Option B is premature without investigation. Option C is a post-investigation step. Option D is not appropriate for a low-confidence alert.

Answer

Close the incident as a false positive.

Answer

Escalate to senior management.

Answer

Isolate the affected account immediately.

Question 12

Your organization uses Microsoft Defender XDR. A security administrator reports that a user's device is showing high severity alerts for 'Tampering with Microsoft Defender Antivirus' but the device is not isolated. You need to ensure that when such alerts occur, the device is automatically isolated in Microsoft Defender for Endpoint. What should you do?

Accepted Answer

Create a custom detection rule in Microsoft Defender XDR. Option B is correct because you can create a custom detection rule in Microsoft Defender XDR that triggers an automatic response action like device isolation. Option A is wrong because Endpoint detection and response policies are for baseline settings. Option C is wrong because attack surface reduction rules are for blocking behaviors, not automatic response. Option D is wrong because automation rules in Sentinel are for incidents, not direct device isolation.

Answer

Create an automation rule in Microsoft Sentinel

Answer

Create an endpoint detection and response policy in Microsoft Intune

Answer

Configure an attack surface reduction rule

Question 13

During a ransomware incident, the security team needs to prevent the encryption of files while allowing the investigation to continue. Which feature in Microsoft Defender for Endpoint should be used to achieve this?

Accepted Answer

Controlled folder access.. Controlled folder access (CFA) blocks unauthorized applications from modifying files in protected folders, which is exactly what ransomware does. ASR rules are broader and may not target file encryption specifically. Device isolation disconnects the device from the network but stops the investigation. Custom detection rules are reactive.

Answer

Device isolation.

Answer

Attack surface reduction (ASR) rules.

Answer

Custom detection rules.

Question 14

Which THREE steps are part of the incident response process when using Microsoft Sentinel?

Accepted Answer

Investigate the incident using hunting queries and entity timelines.. The three correct steps are triage, investigation, and remediation. Identification is a precursor, and reporting is a final step but not always part of the core process in Sentinel.

Answer

Identify the incident by creating an analytics rule.

Answer

Report the incident to the security team via email.

Question 15

Your organization uses Microsoft Sentinel. You are investigating an incident and need to gather additional context about a suspicious IP address. Which TWO Microsoft Sentinel features can you use to enrich the investigation?

Accepted Answer

Threat intelligence. Entity behavior analytics provides insights into user and entity activities. Threat intelligence feeds provide context about known malicious IPs. The watchlist feature is for storing data, not enrichment. The hunting feature is for proactive searches. The UEBA feature is similar to entity behavior analytics but not specifically for IP enrichment.

Answer

Watchlist

Answer

Hunting

Answer

User and Entity Behavior Analytics (UEBA)

Question 16

A SOC analyst receives a Microsoft Defender for Cloud Apps alert about a mass download of files from a SharePoint site by a single user. The analyst needs to contain the incident. Which action should be taken first?

Accepted Answer

Suspend the user account in Microsoft Entra ID.. Suspending the user in Microsoft Entra ID stops all account activity. Option A doesn't prevent further downloads; Option C is reactive; Option D is for other scenarios.

Answer

Increase the SharePoint download limit.

Answer

Notify the user's manager.

Answer

Run a malware scan on the downloaded files.

Question 17

Refer to the exhibit. You are reviewing a Microsoft Sentinel scheduled analytics rule configured as above. An incident was created for multiple alerts triggering within a 5-hour window. The SOC team needs to investigate each alert separately because they involve different user accounts. What should the analyst do to ensure each alert generates a separate incident?

Accepted Answer

Set 'enabled' to false under groupingConfiguration.. Option D is correct because setting 'enabled' to false under groupingConfiguration disables grouping, so each alert becomes its own incident. Option A is wrong because increasing lookbackDuration would group more alerts. Option B is wrong because changing matchingMethod to 'AllEntities' is already set and does not affect grouping behavior. Option C is wrong because enabling 'reopenClosedIncident' is for reopening, not for separating alerts.

Answer

Change the matchingMethod to 'AnyAlert'.

Answer

Set 'reopenClosedIncident' to true.

Answer

Change the lookbackDuration to PT0H.

Question 18

A security analyst is investigating a Microsoft Defender for Cloud Apps alert about a suspicious OAuth app that has high permissions. The analyst needs to disable the app immediately. What is the correct action?

Accepted Answer

From the Microsoft Defender for Cloud Apps alert, select 'Disable app'.. Option B is correct because Microsoft Defender for Cloud Apps allows disabling OAuth apps from the app governance page. Option A is wrong because Microsoft Entra ID admin center can also manage OAuth apps, but the question specifies from the Defender for Cloud Apps alert. Option C is wrong because revoking user tokens does not disable the app. Option D is wrong because generating a new secret does not revoke existing tokens.

Answer

Revoke all tokens for the app in Microsoft Entra ID.

Answer

Generate a new client secret for the app.

Answer

Go to Microsoft Entra ID admin center and delete the app registration.

Question 19

Your organization uses Microsoft Sentinel and has enabled the Microsoft 365 Defender connector. You want to automatically assign incidents to a specific analyst team based on the incident severity and type. Which component should you configure?

Accepted Answer

Automation rule in Microsoft Sentinel. The correct answer is A because automation rules in Sentinel can set owner and assign to a team based on conditions. Option B is wrong because playbooks are for complex automation but assignment can be done with automation rules. Option C is wrong because analytics rules define alert conditions, not incident assignment. Option D is wrong because workbooks are for reporting.

Answer

Analytics rule in Microsoft Sentinel

Answer

Workbook in Microsoft Sentinel

Answer

Custom playbook in Microsoft Sentinel

Question 20

Which TWO actions should you take when handling a confirmed ransomware incident in an environment protected by Microsoft Defender for Endpoint?

Accepted Answer

Block the ransomware file hash using threat intelligence indicators in Microsoft Defender.. Options A and C are correct. Option A isolates affected devices to prevent spread. Option C blocks indicators of compromise (IoCs) to stop further execution. Option B is not immediate; Option D is unnecessary if Defender manages updates; Option E is reactive and not a containment step.

Answer

Disable Windows Defender real-time protection.

Answer

Submit the ransomware sample to Microsoft for analysis.

Answer

Reimage all affected servers immediately.