SC-200 Practice Exam 70 — 20 Questions

Question 1

After a security incident, the SOC team needs to preserve forensic evidence from a compromised Microsoft Entra ID joined Windows 10 device. The device is still online. Which tool should the team use to collect a forensic image of the hard drive?

Accepted Answer

Microsoft Defender for Endpoint. Option D is correct because Microsoft Defender for Endpoint can collect a full forensic image from the device via Live Response. Option A is wrong because BitLocker is encryption, not imaging. Option B is wrong because Intune does not support forensic imaging. Option C is wrong because Azure AD is identity, not device management for imaging.

Answer

Microsoft BitLocker Administration and Monitoring

Answer

Microsoft Entra ID

Answer

Microsoft Intune

Question 2

Your organization uses Microsoft Sentinel. An incident with severity Medium is created from an analytics rule that detects brute-force attempts against on-premises domain controllers. The incident contains alerts from multiple machines. You need to automatically run a playbook that collects evidence from affected machines and then changes the incident severity to High. What should you configure?

Accepted Answer

Create an automation rule that triggers on incident creation with severity Medium, runs the playbook, and then changes severity to High.. Automation rules in Microsoft Sentinel allow you to trigger playbooks automatically based on conditions. The automation rule can be set to trigger when an incident is created, check the severity condition, run a playbook, and then change the severity. Option A is correct because it enables a single automation rule to orchestrate both the playbook execution and severity change. Option B is wrong because analytics rules only trigger alert creation, not incident-level actions. Option C is wrong because playbooks cannot change severity directly without an automation rule. Option D is wrong because the alert details enrichment is for adding context, not running playbooks or changing severity.

Answer

Configure the incident creation settings to enrich the incident with the playbook output.

Answer

Modify the analytics rule to include the playbook as an automated response.

Answer

Edit the playbook to include a step that changes incident severity after collecting evidence.

Question 3

You run the above KQL query in Microsoft Sentinel to detect encoded PowerShell commands. The query returns no results, even though you know that some devices have executed encoded PowerShell commands. What is the most likely reason?

Accepted Answer

The query only looks for 'powershell.exe', but the command might have been run using 'pwsh.exe' or 'powershell_ise.exe'.. Option B is correct because the query filters where FileName == 'powershell.exe' exactly, but the process might be named 'powershell_ise.exe' or 'pwsh.exe' (PowerShell Core). Option A is wrong because base64_decode_tostring should decode properly if the command is base64-encoded. Option C is wrong because the query does not filter by -EncodedCommand; it uses contains to check if the decoded command contains '-EncodedCommand', which is incorrect logic. Option D is wrong because the query uses the DeviceProcessEvents table, which should capture process events.

Answer

The DecodedCommand column is empty because the ProcessCommandLine does not contain an encoded command.

Answer

The base64_decode_tostring function cannot decode PowerShell encoded commands.

Answer

The DeviceProcessEvents table does not contain PowerShell process events.

Question 4

You receive a Microsoft Defender XDR incident alert about a suspicious sign-in from an unfamiliar location. The user confirms they did not perform the sign-in. What should you do to immediately secure the account?

Accepted Answer

Disable the user account in Microsoft Entra ID. Option B is correct because disabling the user account in Microsoft Entra ID immediately prevents further use. Option A is wrong because resetting password alone does not block active sessions. Option C is wrong because MFA registration does not stop ongoing compromise. Option D is wrong because blocking the IP may not be effective if the attacker uses multiple IPs.

Answer

Reset the user's password

Answer

Block the IP address used for the suspicious sign-in

Answer

Require the user to register for Microsoft Entra Multi-Factor Authentication

Question 5

Your organization is responding to a security incident in Microsoft Defender XDR. You need to contain a compromised on-premises Exchange server. Which TWO actions are appropriate? (Choose two.)

Accepted Answer

Disconnect the server from the network.. Options A and C are correct. Blocking the compromised account prevents further access, and disconnecting the server from the network contains the threat. Option B (Running full scan) is a remediation step, not containment. Option D (Collecting investigation package) is evidence collection. Option E (Updating antivirus) is not immediate containment.

Answer

Collect an investigation package from the server.

Answer

Update the antivirus definitions on the server.

Answer

Run a full antivirus scan on the server.

Question 6

Refer to the exhibit. A security analyst creates a scheduled analytics rule in Microsoft Sentinel based on the JSON shown. After enabling the rule, the analyst notices that the rule generates alerts every hour for the same user accounts even after the incidents are resolved. What is the most likely cause?

Accepted Answer

Suppression is disabled, so the rule fires every hour with overlapping results. Option C is correct because suppression is disabled, so the rule fires every hour regardless of previous alerts. Option A is wrong because the query period is 1 day, which is appropriate. Option B is wrong because severity is High, not causing duplicates. Option D is wrong because the trigger threshold is 10, which controls when an alert fires, not duplicate suppression.

Answer

The severity is set to High, causing multiple alerts

Answer

The query period is too short, causing the rule to refetch old data

Answer

The trigger threshold is too low, causing the rule to fire too often

Question 7

During a threat hunt, an analyst discovers a PowerShell script that was executed on multiple servers in the environment. The script connects to an external IP address and downloads a payload. The analyst wants to find all other servers that may have been compromised by the same script. What is the most efficient way to search for this across the environment?

Accepted Answer

Use the DeviceProcessEvents table in Microsoft Defender for Endpoint advanced hunting to search for the script's SHA256 hash or command line pattern. Option C (search Microsoft Defender for Endpoint advanced hunting for the PowerShell script content hash or command line) is correct because it uses the known IOCs from the discovered script to find all occurrences. Option A (all servers' event logs) is inefficient and may miss modern logging. Option B (Sysmon) requires Sysmon to be installed. Option D (network logs from firewall) may not capture process details.

Answer

Use Sysmon Event ID 1 (process creation) to find PowerShell executions

Answer

Review the network logs from the firewall for connections to the external IP

Answer

Query the Windows Event Log for Event ID 4104 (PowerShell script block logging) on each server

Question 8

Which TWO actions should you take when responding to a confirmed data exfiltration incident involving Microsoft 365? (Choose two.)

Accepted Answer

Revoke user sessions in Microsoft Entra ID. Option A is correct: Contain the activity by revoking user sessions. Option D is correct: Investigate by reviewing audit logs to determine scope. Option B is wrong because resetting password for all users is excessive. Option C is wrong because disabling all external sharing is too broad. Option E is wrong because blocking tenant access is disruptive and premature.

Answer

Reset passwords for all users

Answer

Disable all external sharing in SharePoint

Answer

Block all access to the tenant

Question 9

You are an incident responder for a company using Microsoft 365 Defender. A critical incident is assigned to you. What is the first action you should take according to best practices?

Accepted Answer

Triage the incident to determine the scope and severity.. Option C is correct because the first step in incident response is to triage the incident to understand its scope and severity before taking any action. Option A is wrong because isolating the device should only be done after assessing the impact. Option B is wrong because you need to investigate before collecting data. Option D is wrong because escalation should occur after initial triage if needed.

Answer

Escalate the incident to senior management.

Answer

Immediately isolate all affected devices.

Answer

Collect a full memory dump from the affected systems.

Question 10

A security analyst receives an alert in Microsoft Defender XDR indicating that a user account was compromised. The analyst needs to isolate the affected device to prevent lateral movement. Which action should the analyst take first?

Accepted Answer

Initiate device isolation from Microsoft Defender for Endpoint. Option C is correct because initiating device isolation in Microsoft Defender for Endpoint is the quickest way to contain a compromised device. Option A is wrong because resetting the password alone does not isolate the device. Option B is wrong because a full scan is slow and may not stop ongoing activity. Option D is wrong because creating a detection rule does not take immediate action.

Answer

Run a full antimalware scan on the device

Answer

Reset the user's password in Microsoft Entra ID

Answer

Create a custom detection rule in Microsoft Sentinel

Question 11

Which THREE data sources should be included in a Microsoft Sentinel workspace to comprehensively monitor for lateral movement within an Azure environment?

Accepted Answer

Azure AD sign-in logs. Options A, B, and C are correct because they cover compute, network, and identity aspects of lateral movement. Option D is wrong because Azure DevOps is for development, not runtime. Option E is wrong because Power BI is not involved in lateral movement.

Answer

Power BI audit logs

Answer

Azure DevOps audit logs

Question 12

Your organization uses Microsoft Sentinel. You are investigating an incident that involves multiple alerts. Which TWO actions can you perform from the incident details page to consolidate the investigation?

Accepted Answer

Create a bookmark to capture relevant evidence.. From the incident details page, you can add alerts to the incident and create a bookmark to preserve evidence. Option A is correct because you can add related alerts. Option D is correct because bookmarks can be created. Option B is wrong because analytics rules are modified in the Analytics blade. Option C is wrong because playbooks are run from the incident page, not created. Option E is wrong because deleting alerts is not a standard action.

Answer

Delete alerts that are not relevant.

Answer

Create a new playbook from the incident page.

Answer

Modify the analytics rule that generated the incident.

Question 13

A security analyst detects a suspicious login from an unusual location for a user in Microsoft Defender XDR. The analyst needs to investigate and contain the incident. Which TWO actions should be taken?

Accepted Answer

Disable the user account from Microsoft Entra ID.. Disabling the user account (B) immediately stops further access. Using Microsoft Entra ID Identity Protection to confirm risk (C) provides additional context. Investigation playbooks (A) are for automation not immediate containment. Resetting password (D) is less immediate than disabling. Hunting queries (E) are for proactive threat hunting.

Answer

Create a custom hunting query in Microsoft 365 Defender advanced hunting.

Answer

Run an automated investigation playbook.

Answer

Reset the user's password.

Question 14

Your company uses Microsoft Defender XDR. During a ransomware incident, you need to isolate a compromised Windows 10 device from the network while allowing connectivity to the Microsoft Defender for Endpoint service. Which action should you take?

Accepted Answer

Initiate a Full isolation from the device's action menu.. Option D is correct because the Full isolation type in Microsoft Defender for Endpoint blocks all network traffic except to the Defender service. Option A (Selective isolation) is not a valid isolation type. Option B (Contain) is not an isolation action. Option C (Block all traffic) would prevent the device from receiving updates and reporting to Defender.

Answer

Contain the device from the Microsoft Defender XDR portal.

Answer

Apply a firewall rule to block all outbound traffic.

Answer

Run a selective isolation to block only external connections.

Question 15

Your organization uses Microsoft Defender for Office 365. A user reports receiving a phishing email. You need to investigate the email and take action. Which TWO actions can you perform? (Choose two.)

Accepted Answer

Use the email entity page to take action like 'Soft delete'.. Options B and D are correct. Threat Explorer allows you to find the email and take actions like delete or soft delete. Option A (Submitting to Microsoft) is for analysis, not direct action. Option C (Creating a mail flow rule) is not immediate. Option E (Blocking sender) is possible but not directly from the incident investigation.

Answer

Create a mail flow rule to block similar emails.

Answer

Submit the email to Microsoft for analysis.

Answer

Block the sender's email address.

Question 16

A security analyst uses Microsoft Sentinel to investigate an incident involving data exfiltration from Azure Blob Storage. The analyst needs to determine which user accessed the storage account and from which IP address. Which data source should the analyst query?

Accepted Answer

Azure Activity logs. Option B is correct because Azure Activity logs storage account management events, including access logs. Option A is wrong because Azure AD sign-in logs only show authentication to Azure AD, not storage access. Option C is wrong because Azure Monitor metrics are aggregated and don't show per-user access. Option D is wrong because Azure Security Center provides security recommendations, not access logs.

Answer

Azure AD sign-in logs

Answer

Azure Security Center alerts

Answer

Azure Monitor metrics

Question 17

A security analyst in your company uses Microsoft Defender XDR to investigate an incident involving a user who received a malicious email. The analyst needs to block the sender's email address across all tenants in the organization. What is the most efficient way to achieve this?

Accepted Answer

In the Microsoft 365 Defender portal, use the action center to block the sender's email address across all tenants.. Microsoft Defender XDR allows you to take action on entities like email senders. Using the action center, you can block the sender's email address globally, which applies to all tenants. Option C is correct. Option A is wrong because Exchange admin center works per tenant and is not as efficient for cross-tenant blocking. Option B is wrong because Microsoft Entra ID admin center manages identities, not email blocking. Option D is wrong because Microsoft Purview is for compliance, not email threat protection.

Answer

From the Microsoft 365 Defender portal, go to Email & collaboration > Exchange admin center and block the sender.

Answer

In Microsoft Purview, create a data loss prevention policy to block the sender.

Answer

In Microsoft Entra ID admin center, create a conditional access policy to block the sender.

Question 18

Your organization uses Microsoft Sentinel. You have a playbook that sends an email notification to the SOC team when a new incident is created. The playbook is currently triggered manually. You want the playbook to run automatically every time an incident of severity High is created. What should you do?

Accepted Answer

Create an automation rule that triggers when an incident is created with severity High and runs the playbook.. Automation rules in Sentinel can automatically trigger playbooks based on incident conditions. Option A is correct. Option B is wrong because automation rules are created in the Automation blade. Option C is wrong because the analytics rule does not directly run playbooks. Option D is wrong because the playbook trigger is not configured in Logic Apps designer.

Answer

Edit the analytics rule that generates the incident to include the playbook as an automated response.

Answer

Modify the playbook to add a trigger of 'When an incident is created' and set the severity condition.

Answer

Configure the playbook's Logic Apps designer to use an HTTP trigger that polls Sentinel for new incidents.

Question 19

You are investigating a phishing incident in Microsoft Defender XDR. The user reported receiving an email with a malicious link. You need to identify all users who received the same email. Which feature should you use?

Accepted Answer

Threat Explorer. Option A is correct because Threat Explorer in Microsoft Defender for Office 365 allows you to search and filter email messages by various attributes, including subject, sender, and recipients, to identify all users who received a specific email. Option B (Hunting) is for proactive threat hunting, not for investigating a known email. Option C (Incidents) shows aggregated alerts but not detailed email tracking. Option D (Automation) is for automated investigation and response.

Answer

Automation & investigations

Answer

Incidents view

Answer

Advanced Hunting

Question 20

During an incident response, a security engineer needs to block an attacker's IP address at the network level for all devices in the organization. The organization uses Microsoft Defender for Endpoint and Microsoft Intune for device management. What is the most efficient way to achieve this?

Accepted Answer

Create a custom indicator (IOC) for the IP address in Microsoft Defender for Endpoint. Option A is correct because a custom indicator in Defender for Endpoint blocks the IP across all onboarded devices. Option B is wrong because blocking in Microsoft Sentinel only affects log ingestion, not network traffic. Option C is wrong because Intune policies are for configuration, not real-time blocking. Option D is wrong because Azure Firewall would need to be in the network path and is a separate product.

Answer

Add the IP address to a blocklist in Microsoft Sentinel

Answer

Create a device configuration policy in Microsoft Intune to block the IP

Answer

Configure Azure Firewall to block the IP