SC-200 Practice Exam 59 — 20 Questions

Question 1

Your company uses Microsoft Sentinel as its SIEM. You are investigating an incident where a user reported receiving a phishing email that appeared to come from the CEO requesting a wire transfer. The user did not respond. However, the incident also contains alerts from Microsoft Defender for Office 365 indicating that other users clicked on a malicious link in a similar email. The email was sent to 100 users. The company has Microsoft Defender for Endpoint deployed on all devices. The incident requires immediate containment to prevent further compromise. What should you do first?

Accepted Answer

Block the malicious URL using Microsoft Defender for Cloud Apps.. Blocking the malicious URL in Defender for Cloud Apps or Defender for Endpoint prevents users from accessing it. Option B is for email but not real-time; Option C is later; Option D is for the user's device only.

Answer

Run a threat hunting query to find all users who clicked the link.

Answer

Isolate the device of the user who reported the email.

Answer

Delete the email from all users' mailboxes using Microsoft 365 Defender.

Question 2

Which TWO actions should an analyst take when a confirmed ransomware incident is detected on multiple endpoints? (Choose TWO.)

Accepted Answer

Isolate affected endpoints using Microsoft Defender for Endpoint.. Option A is correct because isolating endpoints stops encryption. Option C is correct because blocking indicators prevents spread. Option B is wrong because it destroys evidence. Option D is wrong because it allows encryption to continue. Option E is wrong because it's reactive, not immediate containment.

Answer

Run a full antivirus scan on all endpoints.

Answer

Disconnect network cables but leave endpoints powered on.

Answer

Shut down all affected endpoints to prevent data loss.

Question 3

Your organization uses Microsoft Defender for Cloud Apps. A security investigator discovers that a user's session token was stolen and used to access sensitive data in SharePoint Online from an anomalous IP address. You need to immediately revoke the attacker's access while minimizing impact on the legitimate user. What should you do?

Accepted Answer

From Microsoft Defender for Cloud Apps, use the 'Require re-authentication' action on the anomalous session.. Option A is correct because using session control to require re-authentication immediately revokes the compromised session without affecting the user's future sessions. Option B is wrong because suspending the user blocks all access, impacting productivity. Option C is wrong because revoking all sessions also affects the legitimate user's other sessions. Option D is wrong because resetting password does not invalidate the stolen token.

Answer

Suspend the user account in Microsoft Entra ID until the investigation is complete.

Answer

Revoke all refresh tokens for the user in Microsoft Entra ID.

Answer

Reset the user's password immediately.

Question 4

Your organization uses Microsoft Sentinel. A security analyst receives an alert for a suspicious sign-in from an unfamiliar IP address. The analyst wants to quickly check if the same IP address has been associated with any other alerts in the past 30 days. Which action should the analyst take?

Accepted Answer

Run a KQL query in the Logs blade to search the Alert table for the IP.. Using KQL to query the Alert table for the specific IP address allows the analyst to quickly find related alerts. Option A is too broad; Option B doesn't involve event correlation; Option D is for automation.

Answer

Create an automation rule to block the IP address.

Answer

Submit the IP address to Microsoft for threat intelligence.

Answer

Create a new analytics rule to detect the IP address.

Question 5

Which THREE features in Microsoft Sentinel allow an analyst to automate incident response actions?

Accepted Answer

Playbooks (Logic Apps). Automation rules, playbooks (Logic Apps), and analytics rules with automated responses are all automation features. Watchlists are for reference data, not automation. Workbooks are for visualization.

Answer

Watchlists

Answer

Workbooks

Question 6

During an incident, an analyst wants to use Microsoft Defender XDR's automatic attack disruption to contain an ongoing attack. What prerequisite must be met?

Accepted Answer

Devices must be onboarded to Microsoft Defender for Endpoint.. Option A is correct because automatic attack disruption requires the device to be onboarded to Microsoft Defender for Endpoint. Option B is wrong because it's not required. Option C is wrong because Sentinel is not required. Option D is wrong because it's not required.

Answer

Microsoft Purview compliance portal must be configured.

Answer

Users must have Azure AD Premium P2 licenses.

Answer

Microsoft Sentinel must be enabled and connected to Defender XDR.

Question 7

A SOC analyst is responding to a ransomware incident. The analyst identifies that the ransomware encrypted files on a file share and left a ransom note. The analyst needs to prevent the ransomware from spreading to other shares. Which action should the analyst take first?

Accepted Answer

Isolate the server from the network using Microsoft Defender for Endpoint's device isolation.. Option D is correct because isolating the affected server from the network stops the spread. Option A is wrong because restoring files does not prevent spread. Option B is wrong because antivirus may not detect unknown ransomware. Option C is wrong because revoking user access does not stop the ransomware process.

Answer

Revoke the user's access to the file share.

Answer

Run a full antivirus scan on the server.

Answer

Restore the encrypted files from backup.

Question 8

Your organization uses Microsoft Defender for Cloud Apps. An alert indicates that a user is downloading large amounts of data from SharePoint Online. What should you do first to investigate?

Accepted Answer

Review the user's activity log in Defender for Cloud Apps.. Option B is correct because the user's activity log provides detailed information about the downloads and can help identify if it's malicious. Option A is wrong because blocking the app is too broad. Option C is wrong because creating an IP range is proactive but not investigative. Option D is wrong because it's a reactive step that might be premature.

Answer

Govern the user by suspending their account.

Answer

Create a new IP address range for the organization.

Answer

Block the SharePoint Online app for all users in Defender for Cloud Apps.

Question 9

A SOC analyst is reviewing an incident in Microsoft Sentinel that involves a user receiving a phishing email with a malicious attachment. The attachment was opened on a device managed by Microsoft Intune. Which Microsoft Defender XDR component would have provided the earliest detection of the malicious file?

Accepted Answer

Microsoft Defender for Endpoint. The correct answer is B. Microsoft Defender for Endpoint (now part of Microsoft Defender XDR) provides real-time antimalware protection and would detect the file when opened. The other options are either not involved in file detection or are cloud-specific.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Office 365

Answer

Microsoft Purview Data Loss Prevention

Question 10

The exhibit shows an automation rule in Microsoft Sentinel. The analyst reports that the playbook is not triggered for high-severity incidents. What is the most likely cause?

Accepted Answer

The rule triggers only on incident creation, not on updates.. The trigger type 'IncidentCreated' only fires when a new incident is created. If incidents are updated to high severity, they are not created again, so the rule won't trigger. Option B is wrong because the condition is correctly written; Option C is irrelevant; Option D is a possible issue but less likely given the rule is already created.

Answer

The playbook resource ID is invalid.

Answer

The condition syntax is incorrect.

Answer

The tenant ID is missing.

Question 11

Your organization uses Microsoft Sentinel with Microsoft Defender XDR integrated. A critical incident has been raised involving a user account that was used to access a confidential SharePoint site from an unusual location at 2:00 AM. The incident includes alerts from Microsoft Defender for Cloud Apps, Microsoft Defender for Identity, and Microsoft Defender for Office 365. The analyst needs to contain the incident, investigate the scope, and begin remediation. The environment has the following: Microsoft Entra ID with conditional access policies, Microsoft Intune for device management, and Microsoft Defender for Endpoint on all devices. The analyst has identified the user account and the device used. Which course of action should the analyst take first?

Accepted Answer

Disable the user account in Microsoft Entra ID and revoke all sessions.. Disabling the user account in Microsoft Entra ID is the fastest way to stop access. Option B is secondary; Option C doesn't stop access; Option D is for future, not immediate containment.

Answer

Create a conditional access policy to block the user.

Answer

Isolate the user's device using Microsoft Defender for Endpoint.

Answer

Run a KQL query to find all resources accessed by the user.

Question 12

An analyst is investigating a potential data exfiltration incident involving a user who accessed sensitive files from a personal device. The analyst wants to gather evidence about the device's compliance status and recent activity. Which Microsoft Intune feature should the analyst use?

Accepted Answer

Microsoft Intune device inventory and compliance reports. Option D is correct because Microsoft Intune's device compliance and inventory provide the needed information. Option A is wrong because it audits Azure resource changes. Option B is wrong because it's for service health. Option C is wrong because it's for email flow.

Answer

Exchange Online message trace

Answer

Azure Activity Log

Answer

Microsoft 365 Defender's service health dashboard

Question 13

Your organization uses Microsoft Sentinel. A security analyst reports a high number of false positives from a scheduled analytics rule that detects anomalous sign-ins. The rule uses the 'UserAgent' field in the SigninLogs table. What is the best practice to reduce false positives while maintaining detection coverage?

Accepted Answer

Add a condition to the rule query to filter out known legitimate user agents.. Option B is correct because adding a filter to exclude known legitimate user agents reduces noise without removing the rule. Option A is wrong because disabling the rule removes coverage. Option C is wrong because creating a watchlist is useful but does not directly reduce false positives from the rule. Option D is wrong because increasing the threshold may miss real attacks.

Answer

Increase the alert threshold to require more than one anomalous sign-in per hour.

Answer

Create a watchlist of legitimate IP addresses and reference it in the rule.

Answer

Disable the analytics rule and create a new one with different MITRE tactics.

Question 14

You are a security analyst for a company using Microsoft Defender XDR. An incident is detected involving a device that has been communicating with a known command-and-control (C2) server. The device is currently online and the user is active. What should you do first to contain the threat?

Accepted Answer

Isolate the device from the network using Microsoft Defender for Endpoint. Option A is correct because isolating the device from the network immediately stops communication with the C2 server. Option B is wrong because killing processes may not stop network communication. Option C is wrong because scanning is reactive. Option D is wrong because contacting the user could tip off the attacker.

Answer

Run a full antivirus scan on the device

Answer

Notify the user to disconnect the device

Answer

Kill the suspicious processes on the device

Question 15

The exhibit shows a KQL query used during incident investigation. The analyst wants to identify devices with an unusually high number of outbound connections to public IPs. The query returns no results, though the analyst suspects there should be some. What is the most likely reason?

Accepted Answer

The field 'RemoteIPType' does not exist in DeviceNetworkEvents.. The RemoteIPType field may not exist in DeviceNetworkEvents; the correct field for public IP classification is typically RemoteIP. Option A is possible but less likely; Option C is a syntax error; Option D is about data retention.

Answer

The timeframe is too short.

Answer

Data retention for DeviceNetworkEvents is less than 1 day.

Answer

The 'summarize' operator is misused.

Question 16

A security analyst detects a suspicious sign-in from an unfamiliar IP address for a user with high privileges. The analyst wants to immediately contain the threat while preserving the user's ability to work with proper approvals. What is the most effective first step?

Accepted Answer

Initiate a user risk remediation in Microsoft Entra ID Protection by confirming compromise and resetting password with session revocation.. Option B is correct because it immediately revokes sessions and requires reauthentication, containing the threat while allowing work after reauth. Option A is wrong because disabling the account permanently is too aggressive and may disrupt work without investigation. Option C is wrong because resetting password doesn't revoke active sessions. Option D is wrong because the user may be compromised.

Answer

Block the IP address in the firewall.

Answer

Disable the user account in Microsoft Entra ID.

Answer

Reset the user's password without revoking sessions.

Question 17

Which THREE elements are essential when creating a custom incident response playbook in Microsoft Sentinel? (Choose THREE.)

Accepted Answer

Appropriate permissions via managed identity or service principal for the playbook to execute actions.. Option A is correct because triggers define when the playbook runs. Option B is correct because actions are the core of the playbook. Option D is correct because playbooks need proper permissions. Option C is wrong because playbooks are separate from analytics rules. Option E is wrong because playbooks can be triggered manually or automatically.

Answer

A mandatory approval step before any action is taken.

Answer

An analytics rule that generates the incident.

Question 18

Your organization uses Microsoft Sentinel. A fusion incident was created involving multiple alerts from different sources. You need to investigate the incident to determine if it is a true positive. What is the first step you should take?

Accepted Answer

Review the incident timeline and entity mapping in the incident details.. Option C is correct because the first step is to review the incident timeline to understand the sequence of events and correlate the alerts. Option A is wrong because you should not immediately dismiss the incident. Option B is wrong because running KQL queries without context is inefficient. Option D is wrong because assigning to another analyst without investigation delays response.

Answer

Run a KQL query on the raw logs to see if the alerts are connected.

Answer

Assign the incident to a senior analyst for further investigation.

Answer

Close the incident as a false positive if the alerts seem unrelated.

Question 19

Your organization uses Microsoft Sentinel with the Microsoft 365 Defender connector. You receive an incident indicating that a user's account was used to sign in from an unusual location (Russia) while the user is in the United States. The sign-in was successful and no MFA challenge was prompted because the user had a valid session. The incident severity is High. You need to respond immediately. What should you do first?

Accepted Answer

Revoke the user's session in Microsoft Entra ID.. Option A is correct because revoking the user's session invalidates the attacker's access immediately. Option B is wrong because investigating logs takes time and the attacker is still active. Option C is wrong because resetting password does not invalidate the current session. Option D is wrong because blocking the IP may be too broad and not stop session hijacking.

Answer

Block the IP address in the Conditional Access policy.

Answer

Investigate the sign-in logs to determine if there are other compromised accounts.

Answer

Reset the user's password.

Question 20

A security analyst receives an alert from Microsoft Defender for Cloud Apps indicating that a user has signed in from a banned country. The analyst needs to block further access from that country for all users. What should the analyst configure?

Accepted Answer

Create an IP range group for the country and configure a session policy to block it.. Option A is correct because Microsoft Defender for Cloud Apps session policy can block access based on location. Option B is wrong because conditional access policies are in Entra ID, not Defender for Cloud Apps. Option C is wrong because DLP policies don't block access. Option D is wrong because compliance policies don't block access.

Answer

Modify the device compliance policy in Microsoft Intune.

Answer

Configure a data loss prevention (DLP) policy in Microsoft Purview.

Answer

Create a conditional access policy in Microsoft Entra ID to block the country.