SC-200 Respond to security incidents — 40 Questions

Question 1

You are investigating a security incident in Microsoft Sentinel where a user received a phishing email containing a link to a malicious domain. The link was clicked, but no further actions were observed. Which playbook action should you take immediately to prevent potential lateral movement?

Accepted Answer

Block the malicious domain on the firewall. The correct action is to block the malicious domain at the firewall or proxy to prevent further access. Disabling the user account might be premature if no compromise is confirmed. Resetting password and revoking sessions are post-compromise steps. Blocking the domain is immediate containment.

Answer

Disable the user's account

Answer

Revoke the user's active sessions

Answer

Reset the user's password

Question 2

During a ransomware incident, Microsoft Defender for Cloud Apps alerts indicate that a user is uploading large volumes of data to an external cloud storage provider not approved by your organization. Which two actions should you take first? (Choose two.)

Accepted Answer

Block the unapproved cloud storage app. The immediate actions are to suspend the user's access to prevent further data exfiltration and block the unapproved app to stop data uploads. Initiating a legal hold and notifying the user are later steps.

Answer

Notify the user about the policy violation

Answer

Initiate a legal hold on the user's data

Question 3

Your security team uses Microsoft Sentinel analytics rules to detect brute-force attacks. A rule triggers when more than 10 failed logins occur within 5 minutes from a single IP. An incident is generated. Which first step should the analyst take?

Accepted Answer

Investigate the incident details. The first step is to investigate the incident to confirm it's a true positive and assess scope. Blocking the IP might be premature without verification. Resetting passwords and notifying users come after confirmation.

Answer

Block the source IP address on the firewall

Answer

Notify the users of the failed login attempts

Answer

Reset passwords for all affected accounts

Question 4

An incident in Microsoft Defender XDR involves a device that is suspected to be infected with ransomware. The device is online and actively encrypting files. Which action should you take to contain the threat?

Accepted Answer

Isolate the device from the network. The immediate containment action is to isolate the device from the network to stop lateral movement and encryption. Running antivirus or collecting forensic data is secondary. Disabling the user account does not stop the device.

Answer

Disable the user's account

Answer

Run a full antivirus scan on the device

Answer

Collect a memory dump from the device

Question 5

Your organization uses Microsoft Sentinel with UEBA (User and Entity Behavior Analytics). An alert indicates a user's sign-in from an unusual location, followed by a mass download of sensitive files from SharePoint. The user is a low-privilege employee. What is the most likely conclusion?

Accepted Answer

The user's account is compromised. The combination of unusual location and mass download of sensitive files by a low-privilege user suggests account compromise. It is not necessarily ransomware or a false positive, and insider threat is less likely without evidence of intent.

Answer

The alert is a false positive due to user travel

Answer

The user is an insider threat

Answer

The user is conducting a ransomware attack

Question 6

In Microsoft Sentinel, an incident is created from a Fusion rule that correlates multiple alerts. The incident has a high severity. What should the analyst do first?

Accepted Answer

Triage the incident by reviewing the evidence. Option C is correct because the first step in incident response within Microsoft Sentinel is to triage the incident by reviewing the evidence. A Fusion rule correlates multiple alerts into a single incident, and the analyst must examine the correlated alerts, entities, and timeline to validate the incident's legitimacy and understand the scope before taking any action. Automated playbooks or escalations should only occur after triage confirms the incident is a genuine threat.

Answer

Run an automated playbook to contain the threat

Answer

Close the incident as false positive

Answer

Escalate the incident to senior management

Question 7

You are responding to an incident where a user's credentials were used to access a federated SaaS application from an IP address associated with a known threat actor. The user's account is not disabled. Which action is most effective to prevent further unauthorized access?

Accepted Answer

Reset the user's password and revoke active sessions. Resetting the user's password and revoking tokens is the most effective because it invalidates current sessions and prevents further use of stolen credentials. Disabling the account is also effective but may cause business disruption; resetting and revoking is less disruptive. Blocking IP may not be effective if threat actor uses different IPs. Conditional access policy change is slower.

Answer

Create a Conditional Access policy to block the IP

Answer

Disable the user's account

Answer

Block the source IP address on the firewall

Question 8

During an incident response, you need to collect forensic data from Microsoft Defender for Endpoint (MDE) on a remote device that is currently offline. What is the best approach?

Accepted Answer

Initiate a live response session when the device comes online. The best approach is to initiate a live response once the device is online, because live response allows command execution and data collection. Collecting from cloud store is not direct. Remotely scheduled scan is not forensic collection. Waiting is passive.

Answer

Wait until the device is online and then collect manually

Answer

Run a remotely scheduled antivirus scan

Answer

Collect the data from the device's cloud store

Question 9

An incident in Microsoft Sentinel involves a phishing campaign that delivered a malicious macro-enabled document. The document was opened by 15 users. Which playbook action should be triggered automatically to contain the threat?

Accepted Answer

Block the file hash using Microsoft Defender for Endpoint. The automatic playbook action should block the file hash at the endpoint to prevent further execution. Isolating devices may be too aggressive. Blocking sender IP is not effective against phishing. Disabling user accounts is not direct.

Answer

Isolate all affected devices from the network

Answer

Block the sender's IP address on the email gateway

Answer

Disable the user accounts of those who opened the document

Question 10

An analyst creates a playbook in Microsoft Sentinel to automatically block an IP address when an alert fires. However, the playbook fails to block the IP. What is the most likely cause?

Accepted Answer

The IP address is being extracted from an incorrect field in the alert. The playbook references an incorrect field. The IP address should come from the alert's entity, not the alertRuleId. The trigger type is correct but the property path is wrong. Also, the action type should be

Wait, the exhibit shows 'actionType': 'BlockIP' which is not a standard action type. The correct action type might be 'Run playbook' or a connector. However, the most obvious error is the property path: 'alertRuleId' is not an IP address. Also, 'BlockIP' action type does not exist; actual block action is performed via a connector like Azure Firewall or Defender. But given the options, the incorrect property path is the key issue.

Answer

The block duration is set to one day, which is too short

Answer

The playbook actions array has only one action, which is insufficient

Answer

The playbook is using the wrong trigger type; it should be on incident creation

Question 11

You run the above KQL query in Microsoft Sentinel to identify ransomware alerts from the last day. The result shows zero rows. Which is the most likely reason?

Accepted Answer

No alerts with 'ransomware' in the name occurred in the last day. The query uses 'SecurityAlert' which may not be the correct table name for alerts in Sentinel. Also, the time filter is 1d, but the issue is likely table name or that no alerts match. However, the most likely reason is that the table name is incorrect; alerts are stored in 'SecurityIncident' or 'Alert' depending on version. But the official table is 'SecurityAlert'? Actually, it's 'SecurityAlert' in common schema. Yet, if no alerts, maybe the name is wrong. Option B suggests table name incorrect. Also, time range could be too short. But given the options, 'SecurityAlert' is correct? Wait, the correct table for alerts is 'SecurityAlert' in Sentinel. But if it returns zero rows, maybe no ransomware alerts. However, the question expects a diagnostic: the query is correct, but maybe the alert name doesn't contain 'ransomware' because it's named differently. Option A suggests that. But let's evaluate: The query uses 'contains' which is case-insensitive. The most plausible reason is that the alert name does not contain 'ransomware' exactly; it might be 'Ransomware' with capital R? No, 'contains' is case-insensitive. Option C: time range is too short? Possibly, but 1d is typical. Option D: user lacks permissions? Unlikely. The best answer is that the alert name does not contain 'ransomware' because Microsoft uses 'Ransomware' with capital R? Actually, 'contains' is case-insensitive in KQL. So it should match. However, the alert name might be 'Ransomware activity' which contains 'ransomware'? Yes. So maybe the table name is wrong. The correct table is 'SecurityAlert' but sometimes it's 'Alert'? In Sentinel's common schema, it's 'SecurityAlert'. I recall that in some workspaces, the table is 'Alert'. So Option B is plausible. But the exhibit explicitly shows 'SecurityAlert'. Let's go with Option A: no alerts with that substring because the naming convention might be different. I'll choose A.

Answer

The table name 'SecurityAlert' is incorrect; it should be 'Alert'

Answer

The user does not have permission to access the SecurityAlert table

Answer

The time filter of 1 day is too restrictive; need to increase range

Question 12

An administrator creates a Microsoft Defender for Cloud Apps policy to block unsanctioned cloud storage apps. Despite the policy, users can still access these apps. What is the most likely cause?

Accepted Answer

The policy mode is set to 'Monitor', which only alerts and does not block. The policy mode is set to 'Monitor' instead of 'Govern' or 'Block'. In Microsoft Defender for Cloud Apps, policies in 'Monitor' mode only generate alerts, not block. The action 'Block' is defined but the policy mode must be set to 'Block' or 'Govern' to enforce. The filter and actions are correct.

Answer

The action type 'Block' is incorrect; it should be 'Alert'

Answer

The policy requires a 'Device' filter to apply to all users

Answer

The filter uses 'Unsanctioned' tag, but apps are tagged 'Sanctioned'

Question 13

Which TWO actions are appropriate when responding to a confirmed data exfiltration incident via email?

Accepted Answer

Block the recipient domain on the email gateway. Appropriate actions are to block the recipient domain and place a legal hold on the mailbox. Disabling the user account might be premature. Scanning the device is not directly for email. Deleting sent items is not forensic.

Answer

Disable the user's account immediately

Answer

Delete all sent items from the user's mailbox

Answer

Run a full antivirus scan on the user's device

Question 14

Which THREE steps should be included in a Microsoft Sentinel playbook for automatic incident response when a high-severity alert fires?

Accepted Answer

Investigate the alert by enriching with threat intelligence. The playbook should investigate, contain, and notify. Pausing the incident is not standard; the playbook should run immediately. Creating a new Azure resource is not typically part of incident response.

Answer

Pause the incident for 24 hours before taking action

Answer

Create a new Azure resource for logging

Question 15

Which THREE conditions must be met for Microsoft Sentinel to automatically run a playbook on an incident?

Accepted Answer

The playbook must have the Sentinel Responder role assigned. The playbook must be enabled for automatic triggers, the incident must be created by an analytics rule, and the playbook must have the correct permissions. The user does not need to be signed in, and the incident does not need to be of a specific severity.

Answer

The incident severity must be set to High or Critical

Answer

The user must be signed in to the Azure portal

Question 16

A security analyst receives a high-severity alert for a suspicious login from an unusual location. The alert was generated by Microsoft Sentinel from Microsoft Entra ID sign-in logs. The analyst needs to determine if the login was successful and if any data exfiltration occurred. What is the MOST efficient first step?

Accepted Answer

Run a KQL query in Microsoft Sentinel to review the SigninLogs table for the user within the alert time range.. Option B is correct because examining Microsoft Entra ID sign-in logs in Sentinel provides immediate details about login success/failure. Option A is wrong because Defender for Cloud Apps alerts may not include sign-in details. Option C is wrong because reviewing all firewalls is too broad and inefficient. Option D is wrong because checking Microsoft Defender XDR does not directly show sign-in details.

Answer

Use Microsoft Defender XDR to check the user's device timeline for suspicious activity.

Answer

Run a KQL query in Microsoft Sentinel to check Microsoft Defender for Cloud Apps alerts for the user.

Answer

Check the firewall logs in Azure Firewall for outbound connections from the user's IP.

Question 17

Your organization uses Microsoft Defender for Office 365. A user reports receiving a phishing email that bypassed the default policy. You need to create a custom anti-phishing policy to block similar emails in the future. What should you configure?

Accepted Answer

Enable spoof intelligence and add the sender domain to the blocked senders list.. Option D is correct because spoof intelligence identifies and blocks spoofed senders. Option A is wrong because impersonation protection addresses CEO fraud, not general phishing. Option B is wrong because mail flow rules are transport rules, not anti-phishing. Option C is wrong because Safe Attachments handles attachments, not phishing content.

Answer

Enable Safe Attachments for the organization.

Answer

Configure impersonation protection for the user's domain.

Answer

Create a mail flow rule to block the sender's domain.

Question 18

A security team is investigating a ransomware incident that encrypted files on several Windows servers. Microsoft Defender for Endpoint detected the ransomware but the initial infection vector is unknown. Which KQL query in Microsoft Sentinel would BEST identify the initial process that executed the ransomware?

Accepted Answer

DeviceProcessEvents | where FileName contains 'ransomware.exe' | project DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, Timestamp. Option B is correct because DeviceProcessEvents tracks process creation events and can trace parent-child relationships. Option A is wrong because DeviceFileEvents tracks file changes, not process creation. Option C is wrong because DeviceNetworkEvents tracks network connections, not processes. Option D is wrong because DeviceEvents includes various events but not as directly for process ancestry.

Answer

DeviceNetworkEvents | where RemoteUrl contains 'malicious' | project DeviceName, RemoteIP, Timestamp

Answer

DeviceFileEvents | where FileName contains 'ransomware.exe' | project DeviceName, ActionType, Timestamp

Answer

DeviceEvents | where ActionType == 'RansomwareDetection' | project DeviceName, Timestamp

Question 19

You have a Microsoft Sentinel analytical rule with the above configuration. During a security incident, multiple high-severity alerts are generated within a 5-minute window. How does the rule handle these alerts?

Accepted Answer

Alerts with the same entities are grouped into a single incident.. Option C is correct because grouping is enabled with a 5-minute lookback and 'All' entities matching method, meaning alerts with identical entities are grouped into one incident. Option A is wrong because grouping is enabled, not disabled. Option B is wrong because alerts are grouped, not created separately. Option D is wrong because alerts are not suppressed; suppression is disabled.

Answer

Only the first alert creates an incident; subsequent alerts are ignored.

Answer

Each alert creates a separate incident.

Answer

Alerts are suppressed for 5 minutes after the first alert.

Question 20

You are deploying Microsoft Sentinel using the above ARM template parameters. After deployment, you notice that Microsoft Defender for Cloud alerts are not being ingested. What is the MOST likely reason?

Accepted Answer

The 'MicrosoftThreatProtection' connector only ingests Microsoft Defender XDR signals, not Defender for Cloud alerts.. Option C is correct because 'MicrosoftThreatProtection' in the dataConnectors list refers to Microsoft Defender XDR, not Defender for Cloud. Defender for Cloud requires the 'AzureSecurityCenter' data connector. Option A is wrong because UEBA is enabled but does not affect data ingestion. Option B is wrong because location does not affect connector availability. Option D is wrong because workspace name is valid.

Answer

UEBA is enabled, which conflicts with Defender for Cloud data ingestion.

Answer

The workspace location (eastus) does not support Defender for Cloud connector.

Answer

The workspace name 'sentinel-workspace' is reserved for internal use.