SC-200 Practice Exam 67 — 20 Questions

Question 1

Your organization uses Microsoft Sentinel and has configured analytics rules for detecting ransomware. You receive an alert indicating possible ransomware activity on a server. Which THREE actions should you take to contain and investigate the incident? (Choose three.)

Accepted Answer

Initiate a live response session to collect forensic artifacts.. Option A, B, and D are correct. Isolating the server prevents further spread. Reviewing the timeline helps understand the attack. Running a live response to collect artifacts aids investigation. Option C is wrong because resetting the password of a compromised account may not be effective if the attacker has local access. Option E is wrong because creating a new rule is for detection, not containment.

Answer

Create a new analytics rule to detect similar behavior.

Answer

Reset the password of the account that showed anomalous behavior.

Question 2

A Microsoft Defender XDR incident shows that a user's device has been communicating with a known malicious C2 server. The device is online and the user is actively working. You need to contain the threat with minimal business disruption. What should you do?

Accepted Answer

Initiate device isolation from Microsoft Defender XDR. Option A is correct because isolating the device stops communication while allowing the user to continue work if they switch to another device. Option B is wrong because shutting down the device causes immediate disruption. Option C is wrong because removing network connectivity may not be possible remotely. Option D is wrong because running antivirus scan does not stop ongoing C2 communication.

Answer

Remove the device from the network by disabling the switch port

Answer

Shut down the device remotely

Answer

Run a full antivirus scan on the device

Question 3

Your Microsoft Sentinel workspace is receiving a high volume of false positive alerts from a specific analytics rule. You need to suppress these alerts without disabling the rule. Which feature should you use?

Accepted Answer

Configure alert suppression in the analytics rule. Option D is correct because alert suppression in Sentinel allows you to temporarily suppress alerts matching specific criteria. Option A is wrong because automation rules execute actions but do not suppress alerts. Option B is wrong because the alert threshold is a rule setting, not a suppression mechanism. Option C is wrong because incident creation setting only controls whether incidents are created, not alert suppression.

Answer

Create an automation rule to close incidents

Answer

Adjust the alert threshold in the analytics rule

Answer

Disable incident creation for the rule

Question 4

Based on the KQL query shown, what is the purpose of the case() function?

Accepted Answer

To reclassify High severity alerts as Critical. Option A is correct because case() reclassifies 'High' severity alerts as 'Critical' for better prioritization. Option B is wrong because case() does not filter alerts; it only transforms the Severity field. Option C is wrong because the query already filters for Malware and Ransomware. Option D is wrong because case() does not aggregate; summarize does that.

Answer

To aggregate counts by severity

Answer

To include alerts with name containing Malware or Ransomware

Answer

To filter alerts with severity High or Critical

Question 5

An organization uses Microsoft Defender XDR. During an incident investigation, the security team needs to determine if a specific file was executed on any devices in the organization over the past 30 days. They have the file hash. What is the most efficient way to get this information?

Accepted Answer

Use advanced hunting to query for file execution events. Option B is correct because advanced hunting in Microsoft Defender XDR allows querying for file execution events across all devices using the file hash. Option A is wrong because the device inventory does not show execution history. Option C is wrong because the incident timeline is for a specific incident, not a file search across devices. Option D is wrong because the action center is for response actions, not queries.

Answer

Use the action center to search for the file

Answer

Review the incident timeline for the file

Answer

Check the device inventory for the file

Question 6

During a ransomware investigation, a security analyst finds that multiple files on a file server have been encrypted. The server runs Microsoft Defender for Cloud and has been onboarded to Microsoft Sentinel. Which data source in Sentinel would provide the most granular information about the file encryption events?

Accepted Answer

Microsoft Defender for Cloud (Azure Defender) alerts. Microsoft Defender for Cloud (formerly Azure Defender) provides file integrity monitoring and security events at the OS level. Sysmon via AMA would need specific configuration; Windows Security Events may not capture encryption; Azure Activity Log is for control plane events.

Answer

Azure Activity Log

Answer

Windows Security Events via MMA

Answer

Sysmon events via Azure Monitor Agent

Question 7

Which THREE conditions must be met for a Microsoft Sentinel incident to be automatically closed by a playbook?

Accepted Answer

The playbook must have the 'Microsoft Sentinel Incident' connector with 'Update incident' action.. The playbook must have a trigger for incident update, the rule must have automatic incident creation enabled, and the playbook must be assigned to the automation rule. Closing reason and classification are not required but may be set.

Answer

The incident must have a classification set.

Answer

The playbook must be triggered on incident creation.

Question 8

You are reviewing this analytics rule in Microsoft Sentinel. What is the problem with this rule?

Accepted Answer

The query is missing a time range filter. Option C is correct because the query does not include a time filter, which would cause it to run on all historical data. Option A is wrong because the syntax is valid. Option B is wrong because the threshold is fine for matching. Option D is wrong because the aggregate is fine.

Answer

The aggregate function should be 'summarize' with 'dcount'

Answer

The trigger threshold should be set to 5

Answer

The query syntax is invalid

Question 9

During a security incident response, you need to collect forensic evidence from a Windows 10 device that is suspected to be compromised. The device is not domain-joined and is located in a remote office. You have remote administrative access. Which Microsoft 365 tool should you use to acquire a memory dump of the device?

Accepted Answer

Microsoft Defender for Endpoint. Option C is correct because Microsoft Defender for Endpoint (MDE) includes live response capabilities that allow you to collect memory dumps from remote devices. Option A is wrong because Microsoft Intune is for device management, not forensic collection. Option B is wrong because Microsoft Purview eDiscovery is for content searches and legal holds, not live memory acquisition. Option D is wrong because Microsoft Sentinel is a SIEM, not a tool for direct forensic collection from endpoints.

Answer

Microsoft Sentinel

Answer

Microsoft Purview eDiscovery

Answer

Microsoft Intune

Question 10

Your Microsoft Sentinel workspace ingests logs from Microsoft Defender for Cloud and Microsoft 365 Defender. You need to create an incident response playbook that automatically responds to high-severity incidents. Which THREE components are required? (Choose three.)

Accepted Answer

An analytics rule that generates the incident. Option A, B, and C are correct. An automation rule triggers the playbook. A Logic Apps workflow defines the playbook actions. A Microsoft Sentinel analytics rule generates the incident. Option D is wrong because a workbook is for visualization, not automation. Option E is wrong because a hunting query is for proactive search, not automated response.

Answer

A workbook to visualize the incident data

Answer

A hunting query to search for similar activity

Question 11

During a ransomware incident, you need to prevent the encryption of files in SharePoint Online and OneDrive for Business. You have already identified the compromised user account. What should you do?

Accepted Answer

Lock the compromised user account in Microsoft Entra ID. Option B is correct because locking the account stops the attacker from accessing files. Option A is wrong because deleting files does not prevent encryption. Option C is wrong because applying a retention policy does not block access. Option D is wrong because disabling external sharing does not stop internal encryption.

Answer

Disable external sharing for SharePoint Online

Answer

Delete the compromised user's OneDrive files

Answer

Apply a retention policy to all SharePoint sites

Question 12

During a security incident, you need to collect forensic evidence from a compromised Windows device. Which Microsoft Defender for Endpoint action should you use to collect a memory dump?

Accepted Answer

Collect investigation package. Option C is correct because 'Collect investigation package' gathers forensic data including memory dump. Option A is wrong because 'Run antivirus scan' only scans for malware. Option B is wrong because 'Isolate device' disconnects from network but does not collect memory. Option D is wrong because 'Initiate Live Response' provides remote shell but does not specifically collect memory dump as a single action.

Answer

Initiate Live Response

Answer

Isolate device

Answer

Run antivirus scan

Question 13

An analyst runs this advanced hunting query to investigate suspicious command-line activity. Which type of activity is this query most likely detecting?

Accepted Answer

Execution of obfuscated scripts via encoded commands. Option B is correct because -enc (encoded command) is commonly used in malicious PowerShell commands to obfuscate. Option A is wrong because port scanning does not use encoded commands. Option C is wrong because data exfiltration typically involves network connections, not encoded commands. Option D is wrong because privilege escalation is not directly indicated by encoded commands.

Answer

Data exfiltration to external IPs

Answer

Privilege escalation attempts

Answer

Port scanning activity

Question 14

A security analyst is investigating a phishing incident in Microsoft Defender XDR. The analyst wants to see the full email content and attachments. Where should the analyst look?

Accepted Answer

The email entity page. Option D is correct because the Email entity page in Microsoft Defender XDR provides detailed information about an email, including content and attachments. Option A is wrong because the user entity page shows user information, not email content. Option B is wrong because the incident timeline shows events, not full email content. Option C is wrong because the action center is for response actions.

Answer

The incident timeline

Answer

The action center

Answer

The user entity page

Question 15

Refer to the exhibit. The KQL query runs in Microsoft Sentinel and returns no results. The analyst expects to see failed logon attempts. What is the most likely reason?

Accepted Answer

The ResultType field does not exist in IdentityLogonEvents.. The query filters on ResultType == 'Failed', but the field is likely named 'Result' or uses different values like 'Failure'. Also, the table 'IdentityLogonEvents' may not exist; it might be 'AADSignInEventsBeta' or similar. But the most common issue is incorrect field name for result type.

Answer

The Application filter is incorrect.

Answer

The summarize operator is misused.

Answer

The TimeRange variable is too short.

Question 16

Refer to the exhibit. An admin creates this activity policy in Microsoft Defender for Cloud Apps. What will happen when a user fails to log in from 3 different IP addresses within 10 minutes?

Accepted Answer

The user will be blocked only if the third IP is different from the first two.. The policy triggers when the count of different IPs for failed logins reaches 3 within 10 minutes. The action is to block the user. 'DifferentCount' means distinct IPs, not total attempts. So exactly 3 different IPs trigger it.

Answer

The policy will generate an alert but not block the user.

Answer

The user will be blocked immediately after the third failed login from any IP.

Answer

The user will be blocked after 10 minutes regardless of the number of IPs.

Question 17

A user reports that they cannot access their Microsoft 365 apps after clicking a link in an email. You suspect token theft. In Microsoft Defender XDR, which incident investigation action should you take first to verify the scope?

Accepted Answer

Review the user's sign-in logs in Microsoft Entra ID for anomalous locations. Option B is correct because reviewing sign-in logs reveals token usage from unusual locations. Option A is wrong because it's not about apps. Option C is wrong because email investigation is secondary. Option D is wrong because device isolation is not the first step.

Answer

Isolate the user's device from the network

Answer

Check the user's device for malware using Microsoft Defender for Endpoint

Answer

Investigate the email in Microsoft Defender for Office 365

Question 18

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You receive an alert about a suspicious sign-in from an IP address associated with a known malicious actor. The sign-in was for a privileged account. You need to immediately contain the incident. What should you do first?

Accepted Answer

Disable the user account in Microsoft Entra ID.. Option B is correct because disabling the user account immediately stops the attacker from using the compromised credentials. Option A is wrong because resetting the password might not be fast enough if the attacker has an active session. Option C is wrong because blocking the IP in the firewall is reactive and may not be effective if the attacker uses a different IP. Option D is wrong because creating an analytics rule does not contain the incident immediately.

Answer

Reset the user's password.

Answer

Create a custom analytics rule in Sentinel to detect similar sign-ins.

Answer

Block the IP address in the firewall.

Question 19

You are investigating a potential data exfiltration incident in Microsoft Purview. A user has been downloading large amounts of data from a SharePoint site to an unmanaged device. Which TWO actions should you take to contain the exfiltration? (Choose two.)

Accepted Answer

Remove the user's permissions to the SharePoint site.. Option A and D are correct. Blocking downloads from unmanaged devices using Conditional Access or DLP policies prevents further exfiltration. Removing the user's access to the site stops immediate access. Option B is wrong because creating a sensitivity label may not apply retroactively. Option C is wrong because disabling the device may not stop the user from accessing data from another device. Option E is wrong because creating a retention policy is for data preservation, not containment.

Answer

Apply a sensitivity label to the SharePoint site to restrict access.

Answer

Disable the user's device in Microsoft Intune.

Answer

Create a retention policy for the SharePoint site.

Question 20

Your organization is using Microsoft Defender XDR. During an incident, you need to create a custom detection rule that triggers when a specific file hash is executed on any device. Which component should you use?

Accepted Answer

Custom detection rules. Option B is correct because custom detection rules in Defender XDR allow you to create detection logic based on advanced hunting queries. Option A is wrong because indicators of compromise (IoC) block or alert but are not detection rules. Option C is wrong because automation rules in Sentinel are for incident response, not detection. Option D is wrong because ASR rules are built-in and cannot be customized for specific file hashes.

Answer

Attack Surface Reduction (ASR) rules

Answer

Automation rules in Microsoft Sentinel

Answer

Indicators of compromise (IoC)