SC-200 Practice Exam 58 — 20 Questions

Question 1

A security administrator receives an alert from Microsoft Defender for Identity about a suspicious Kerberos ticket request from a domain controller. The alert suggests a possible Golden Ticket attack. Which action should the administrator take to validate the alert?

Accepted Answer

Check the domain controller's Security event log for Event ID 4769 with suspicious attributes.. To validate a Golden Ticket attack, the administrator should check the domain controller's event logs for Event ID 4769 (Kerberos service ticket request) with anomalous attributes such as ticket encryption type 0x17 (RC4) or non-existent user accounts. Checking user accounts for anomalies is less direct. Resetting passwords does not invalidate a Golden Ticket. Checking for brute force is unrelated.

Answer

Review Microsoft Defender for Identity alerts for brute force attempts.

Answer

Reset the krbtgt account password twice.

Answer

Verify if the user account associated with the ticket is disabled.

Question 2

The exhibit shows the output of a Microsoft Defender for Endpoint API call to get machine information. What does the isolationStatus value indicate?

Accepted Answer

The device has been isolated from the network.. The isolationStatus value 'Isolated' indicates that the device has been isolated from the network. The health status is separate and shows the device is healthy. It does not mean it is being scanned, nor that it is not isolated.

Answer

The device is healthy and has no issues.

Answer

The device is currently being scanned for malware.

Answer

The device is not isolated and is fully connected.

Question 3

Your organization uses Microsoft Defender for Cloud Apps. You discover that a user has been accessing sensitive data from an anonymous IP address. The user's account appears to be compromised. You need to prevent further data exfiltration. What should you do?

Accepted Answer

Suspend the user in Microsoft Defender for Cloud Apps.. Suspending the user in Defender for Cloud Apps immediately blocks all access to cloud apps, preventing data exfiltration. Option A is incorrect because changing password alone may not terminate existing sessions. Option C is incorrect because disabling the account in Microsoft Entra ID is broader but also effective; however, suspending in Defender for Cloud Apps is more immediate for cloud app access. Option D is not directly possible.

Answer

Disable the user account in Microsoft Entra ID.

Answer

Create an IP range policy in Defender for Cloud Apps to block the anonymous IP.

Answer

Change the user's password and revoke sessions.

Question 4

A security analyst in Microsoft Sentinel receives an incident with a high severity alert from Microsoft Defender for Identity. The incident description mentions a suspected lateral movement pass-the-hash attack. What should the analyst do first?

Accepted Answer

Isolate the affected device from the network.. Isolating the affected device prevents further lateral movement. Option A is for future detection; Option C is not immediate; Option D is for cloud apps.

Answer

Reset the password of the compromised account.

Answer

Review the Microsoft Defender for Cloud Apps logs.

Answer

Create a new analytics rule to detect pass-the-hash attacks.

Question 5

During a ransomware incident, security team needs to prevent encryption while preserving forensic data. Which action best achieves this balance?

Accepted Answer

Enable network micro-segmentation to isolate affected systems from file servers and take memory snapshots.. Option C is correct because it prevents encryption and contains the threat without destroying data. Option A is wrong because it destroys data. Option B is wrong because it allows encryption to continue. Option D is wrong because it only notifies.

Answer

Shut down all affected servers immediately.

Answer

Run a full antivirus scan on all endpoints.

Answer

Disconnect the network but leave systems running.

Question 6

Which TWO are valid methods to collect forensic evidence from a compromised Windows endpoint during an incident? (Choose TWO.)

Accepted Answer

Run KAPE (Kroll Artifact Parser and Extractor) to collect artifacts.. Option A is correct because KAPE collects live forensic data. Option C is correct because memory dump captures volatile data. Option B is wrong because it overwrites data. Option D is wrong because it's not a forensic tool. Option E is wrong because it's for disk imaging after shutdown.

Answer

Run Windows Update to fix vulnerabilities.

Answer

Reboot the system and boot from a forensic USB drive.

Answer

Use FTK Imager to create a forensically sound image of the hard drive.

Question 7

Your organization uses Microsoft 365 Defender. You are investigating a potential malware outbreak on several endpoints. Which TWO actions should you take to isolate affected devices and prevent lateral movement?

Accepted Answer

Use Microsoft Defender for Endpoint to initiate device isolation on affected devices.. Options B and D are correct. Isolating devices from the network (B) prevents communication with other devices, and blocking the malicious file hash (D) prevents execution on other endpoints. Option A is wrong because resetting passwords does not stop lateral movement. Option C is wrong because running a full scan takes time and does not immediately isolate. Option E is wrong because deleting user accounts is too drastic and not focused on lateral movement.

Answer

Run a full antivirus scan on all endpoints.

Answer

Reset the passwords of all users on the affected devices.

Answer

Delete the user accounts that logged into the affected devices.

Question 8

An analyst is investigating a phishing campaign that targeted multiple users. The analyst needs to identify if any users clicked a malicious link in the email. Which Microsoft Defender for Office 365 feature should be used?

Accepted Answer

Threat Explorer. Option A is correct because the Threat Explorer in Defender for Office 365 shows click activity on URLs. Option B is wrong because Safe Attachments checks attachments, not links. Option C is wrong because Safe Links protects in real-time but does not provide historical click data. Option D is wrong because the Attack Simulator is for testing, not investigation.

Answer

Safe Attachments

Answer

Attack Simulator

Answer

Safe Links

Question 9

Your organization uses Microsoft Sentinel. A security analyst reports that an incident was automatically closed by a playbook before the investigation was complete. What should you do to prevent automatic closure in the future?

Accepted Answer

Modify the analytics rule to not automatically close incidents. Option C is correct because modifying the analytics rule to disable automatic incident closure stops the playbook from closing incidents automatically. Option A is wrong because disabling the playbook stops all its actions, not just closure. Option B is wrong because it disables all automation rules. Option D is wrong because removing the playbook entirely is too drastic and unnecessary.

Answer

Disable the playbook

Answer

Remove the playbook from the automation rule

Answer

Disable the automation rule that triggers the playbook

Question 10

Which THREE actions should be taken when a phishing attack is detected in Microsoft Defender XDR?

Accepted Answer

Report the email as phishing in Microsoft Defender for Office 365. Options B, C, and D are correct. Reporting the email trains the system, deleting from user's mailbox removes access, and blocking the sender prevents further emails. Option A is wrong because resetting password is not immediate. Option E is wrong because running a scan on the user's device may be done later, but not a priority.

Answer

Run a full antivirus scan on the user's device

Answer

Reset the user's password

Question 11

Your organization uses Microsoft Defender for Cloud Apps. You receive an alert that an administrator performed an unusual bulk download from SharePoint. What is the recommended first step to respond?

Accepted Answer

Review the activity log in Defender for Cloud Apps to determine the context.. The first step is to investigate the activity by reviewing the user's activity log in Defender for Cloud Apps to understand if it is legitimate or malicious. Suspending the account immediately may disrupt legitimate work. Reporting to Microsoft is not immediate. Blocking the IP might be too broad.

Answer

Report the activity to Microsoft for further analysis.

Answer

Suspend the administrator's account immediately.

Answer

Block the IP address of the administrator's device.

Question 12

Your organization is using Microsoft Defender for Office 365. A user reports receiving a suspicious email that appears to be from the CEO requesting an urgent wire transfer. You need to investigate the email and take immediate action. What should you do first?

Accepted Answer

Use Threat Explorer in the Microsoft 365 Defender portal to find and delete the email.. Using Threat Explorer allows you to quickly search for the specific email and take action such as soft delete or quarantine. Option A is incorrect because email trace is less detailed for security investigations. Option C is incorrect because Security & Compliance Center is legacy. Option D removes the email without proper investigation.

Answer

Use the Exchange admin center to run a message trace.

Answer

Use the Security & Compliance Center to create a mail flow rule.

Answer

Submit the email to Microsoft for analysis using the Submissions page.

Question 13

Your organization uses Microsoft Sentinel. You have a scheduled analytics rule that queries Windows Security Events to detect local admin group modifications. The rule runs every hour and looks back 1 hour. However, you are missing events that occur within the first few minutes of the hour. What is the most likely cause?

Accepted Answer

The event time is in local time, and the query uses UTC, causing events near the boundary to be excluded.. By default, Sentinel uses UTC time, but the Windows event time may be in local time. If the local time is ahead of UTC, events near the hour boundary may fall outside the query period due to time conversion. Option A is incorrect because ingestion delay is usually not minutes. Option C is incorrect because the query period is already 1 hour. Option D is incorrect because the rule's schedule should capture events within the lookback period.

Answer

The query period is too short; it should be 2 hours.

Answer

The rule is using 'Last activity' instead of 'TimeGenerated'.

Answer

There is a 5-minute ingestion delay for Windows events.

Question 14

During a ransomware incident, an analyst needs to identify which files were encrypted on an endpoint. The endpoint is running Windows and is managed by Microsoft Defender for Endpoint. Which data source should the analyst query in Advanced hunting?

Accepted Answer

DeviceFileEvents. DeviceFileEvents tracks file creation, modification, and deletion. Option A is for processes; Option C is for network; Option D is for registry.

Answer

DeviceRegistryEvents

Answer

DeviceNetworkEvents

Answer

DeviceProcessEvents

Question 15

An incident response playbook in Microsoft Sentinel has a step: 'Investigate the user's recent activities using Microsoft 365 Defender.' Which data source would provide the most relevant information for this step?

Accepted Answer

Microsoft 365 Defender's user investigation page. Option B is correct because Microsoft 365 Defender provides user investigation details across email, endpoints, and apps. Option A is wrong because it's for configuration changes. Option C is wrong because it's for Azure resources. Option D is wrong because it's for data loss prevention, not investigation.

Answer

Azure Activity Log

Answer

Microsoft Purview Data Loss Prevention reports

Answer

Azure Resource Graph

Question 16

Which THREE indicators of compromise (IOCs) are commonly used in Microsoft Sentinel to detect advanced persistent threats (APTs)? (Choose THREE.)

Accepted Answer

Suspicious domains and URLs.. Option A, B, and D are common IOCs. Option C is not an IOC, it's a security product. Option E is not typically used as an IOC.

Answer

Vulnerability scan results.

Answer

Windows event IDs for successful logins.

Question 17

Your organization uses Microsoft Sentinel. A new analytics rule is needed to detect brute-force attacks against your Azure SQL databases. The rule should minimize false positives and trigger only when multiple failed logins occur from a single IP address within a short time window. Which THREE components are essential for building this rule?

Accepted Answer

An alert threshold set to trigger when the count exceeds 10 failed attempts in 5 minutes.. Options A, B, and E are correct. The rule must query AzureDiagnostics (A) to get SQL logs, use summarize with count and timebin (B) to aggregate failures, and set an alert threshold (E) to trigger only on multiple failures. Option C is wrong because SQLInsights is not a log table. Option D is wrong because watchlists are not essential for this detection.

Answer

A reference to the SQLInsights table for performance data.

Answer

A watchlist containing known malicious IP addresses.

Question 18

A security analyst is investigating a potential ransomware incident in Microsoft Defender XDR. The analyst needs to confirm the scope of the attack and halt further propagation. Which TWO actions should the analyst take first?

Accepted Answer

Initiate automated investigation on the affected devices. Option A is correct because initiating automated investigation in Microsoft Defender XDR can quickly scope the incident. Option D is correct because isolating affected devices from the network stops lateral movement. Option B is wrong because running a full antivirus scan is reactive, not immediate containment. Option C is wrong because resetting user passwords is important but secondary to containment. Option E is wrong because collecting forensic evidence is for later analysis, not immediate response.

Answer

Reset passwords for all users in the organization

Answer

Collect forensic evidence from affected systems

Answer

Run a full antivirus scan on all endpoints

Question 19

Your organization uses Microsoft Defender for Identity and Microsoft Defender XDR. You receive an alert about a suspicious LDAP query originating from a domain controller. The alert indicates potential use of the DCSync attack technique. What is the most effective immediate action to contain the attack?

Accepted Answer

Disable the account that initiated the suspicious replication request.. The DCSync attack uses replication requests to extract credentials. Disabling the replication permission for the compromised account stops the attack. Option A is incorrect because restarting the domain controller does not stop the attack if the account still has permissions. Option B is incorrect because resetting the krbtgt password is a long-term remediation. Option C is incorrect because blocking LDAP may disrupt legitimate operations.

Answer

Block all LDAP traffic at the firewall.

Answer

Restart the domain controller to clear any malicious processes.

Answer

Reset the krbtgt account password twice.

Question 20

Your organization uses Microsoft Defender XDR. The incident queue shows multiple alerts related to a single endpoint: malware detected, suspicious PowerShell execution, and data exfiltration attempts. The analyst needs to investigate the incident. Which tool should the analyst use to correlate these events?

Accepted Answer

Advanced hunting in Microsoft Defender XDR.. Advanced hunting in Microsoft Defender XDR allows cross-domain queries (endpoint, identity, email). Option A is for email; Option B is for cloud apps; Option D is a different platform.

Answer

Microsoft Defender for Office 365 Explorer.

Answer

Microsoft Defender for Cloud Apps activity log.

Answer

Microsoft Sentinel incident workspace.