SC-200 Respond to security incidents — 10 Questions

Question 1

Which THREE conditions must be met for Microsoft Sentinel to automatically run a playbook on an incident?

Accepted Answer

The playbook must have the Sentinel Responder role assigned. Option B is correct because the playbook's managed identity (or the service principal it uses) must be granted the Microsoft Sentinel Responder role so it has the permissions needed to act on the incident. Option C is correct because automation rules can only trigger playbooks for incidents generated by scheduled or NRT (near-real-time) analytics rules; incidents from other sources such as Microsoft 365 Defender or manual creation are not supported for automatic playbook triggering. Option E is correct because the automation rule that references the playbook must have its action set to 'Run playbook' with the playbook in the Enabled state, otherwise the automation rule will not invoke it. Option A is not required because automation rules can be configured to run on incidents of any severity (Informational, Low, Medium, High, Critical), so severity is not a mandatory condition. Option D is not required because playbooks run as Logic Apps under their own managed identity or service principal, independent of any interactive user being signed in to the Azure portal.

Answer

The incident severity must be set to High or Critical

Answer

The user must be signed in to the Azure portal

Question 2

Your organization uses Microsoft Defender for Office 365. A user reports receiving a phishing email that bypassed the default policy. You need to create a custom anti-phishing policy to block similar emails in the future. What should you configure?

Accepted Answer

Enable spoof intelligence and add the sender domain to the blocked senders list.. The correct answer is to enable spoof intelligence and add the sender domain to the blocked senders list. Spoof intelligence in Defender for Office 365 detects and blocks spoofed emails, and adding the domain to the blocked senders list ensures that emails from that domain are rejected. This directly addresses the phishing email that bypassed the default policy.

Answer

Enable Safe Attachments for the organization.

Answer

Configure impersonation protection for the user's domain.

Answer

Create a mail flow rule to block the sender's domain.

Question 3

You deploy the above ARM template to create a scheduled analytics rule in Microsoft Sentinel. After deployment, the rule runs but never generates incidents. What is the MOST likely cause?

Accepted Answer

The saved search resource type is incorrectly used; it should not be included in the template.. The ARM template incorrectly includes a saved search resource type (Microsoft.OperationalInsights/workspaces/savedSearches) as a dependency for the scheduled analytics rule. In Microsoft Sentinel, analytics rules do not require or reference saved searches; they use inline KQL queries directly. This misconfiguration prevents the rule from generating incidents because the rule's query logic is not properly associated with the data source.

Answer

The severity level 'Medium' is not supported.

Answer

The rule is disabled because 'enabled' is set to true but there is a typo.

Answer

The query 'SigninLogs | where ResultType == 50057' is invalid.

Question 4

You are responding to a data exfiltration incident in Microsoft Sentinel. The attacker used a PowerShell script to upload data to an external storage account. You need to identify the specific storage account used. Which KQL query should you use in the AzureActivity table?

Accepted Answer

OperationName == 'Storage Blob Upload'. The 'Storage Blob Upload' operation in the AzureActivity table specifically logs uploads to Azure Blob Storage, which is the exact action performed by a PowerShell script exfiltrating data to an external storage account. This operation captures the storage account name and blob details, directly identifying the target of the data exfiltration.

Answer

OperationName == 'Get Storage Account Properties'

Answer

OperationName == 'Create or Update Storage Account'

Answer

OperationName == 'List Storage Account Keys'

Question 5

Which TWO actions are valid for containing a compromised user account in Microsoft 365 Defender? (Choose two.)

Accepted Answer

Disable the user account in Microsoft Entra ID.. Option A is correct because disabling the account in Microsoft Entra ID immediately prevents the compromised user from signing in and blocks further authentication, which is a standard containment action in Microsoft 365 Defender's incident response guidance. Option C is correct because resetting the user's password invalidates the old credentials, ensuring that any stolen or guessed password can no longer be used to access the account. Option B is not a valid containment action for a user account because blocking an IP address in Defender for Cloud Apps addresses network-level access rather than the compromised identity itself. Option D is not listed as correct here, and while session revocation is a related remediation step, it is not one of the two marked correct answers for this question. Option E is not correct because deleting the mailbox is a destructive data-loss action, not a containment step, and would impede investigation and recovery.

Answer

Block the user's IP address in Defender for Cloud Apps.

Answer

Revoke the user's session tokens.

Answer

Delete the user's mailbox in Exchange Online.

Question 6

Which TWO Microsoft 365 Defender portals provide automated investigation and response capabilities? (Choose two.)

Accepted Answer

Microsoft Defender for Endpoint (security.microsoft.com). Microsoft Defender for Endpoint (D) and Microsoft 365 Defender (E) both provide automated investigation and response (AIR) capabilities. Defender for Endpoint uses AIR to automatically investigate alerts on endpoints and take remediation actions, while Microsoft 365 Defender orchestrates AIR across email, identity, endpoints, and cloud apps. These portals are accessed via security.microsoft.com and offer built-in playbooks for automated response.

Answer

Microsoft Purview compliance portal

Answer

Microsoft Sentinel (portal.azure.com)

Answer

Microsoft Intune admin center

Question 7

Which Microsoft Sentinel feature allows you to automatically respond to incidents by running a playbook when an incident is created?

Accepted Answer

Automation rules. Automation rules in Microsoft Sentinel allow you to define automated responses to incidents, including running a playbook when an incident is created. They provide a centralized way to trigger actions based on incident properties such as severity, status, or specific tactics, without needing to embed automation logic directly in analytics rules.

Answer

Analytics rules

Answer

Playbooks

Answer

Watchlists

Answer

Workbooks

Question 8

During an incident response, you identify that a user's account was used to sign in from an unusual location. You need to contain the incident immediately. What should you do first?

Accepted Answer

Disable the user account in Microsoft Entra ID.. Disabling the user account in Microsoft Entra ID is the fastest and most effective way to immediately prevent any further sign-ins from any location, including the compromised session. This action blocks all authentication attempts instantly, regardless of tokens or session state, and is the recommended first step in containing a confirmed account compromise during incident response.

Answer

Reset the user's password.

Answer

Revoke the user's refresh tokens.

Answer

Create a Conditional Access policy to block the user.

Question 9

You are reviewing an automation rule in Microsoft Sentinel. The rule triggers on incident creation with severity High. However, during a recent High severity incident, the playbook did not run. What is the most likely cause?

Accepted Answer

The automation rule does not have an owner assigned.. Automation rules in Microsoft Sentinel require an owner to be assigned for the rule to be active and execute playbooks. Without an owner, the rule is considered improperly configured and will not trigger, even if all other conditions (such as incident severity) are met. This is a common oversight that prevents playbook execution.

Answer

The action order is set to 1, but another action has a higher priority.

Answer

The condition requires IncidentSeverity equals High, but the incident was classified as Medium.

Answer

The rule triggers on incident creation, but the incident was first closed and then reopened.

Question 10

Which TWO are valid incident response actions in Microsoft Sentinel?

Accepted Answer

Change the incident status to Active.. Option A is correct because Microsoft Sentinel incidents have a status field (New, Active, Closed) and changing an incident's status to Active is a standard triage action that indicates the incident is being investigated. Option C is correct because incidents can be assigned to an owner (an analyst) in Microsoft Sentinel, which is a core incident-management action for routing and accountability. Option B is not a valid incident response action in this context because running a KQL query is done in Logs/Log Analytics, not as an action on the incident itself. Option D is not valid because Microsoft Sentinel does not provide a merge operation for incidents; related alerts can be grouped into an incident, but incidents cannot be merged. Option E is not valid because adding a comment is not an incident response action available on the incident in Microsoft Sentinel.

Answer

Run a KQL query from the incident.

Answer

Merge the incident with another incident.

Answer

Add a comment to the incident.