SC-200 Respond to security incidents — 40 Questions

Question 1

Which THREE conditions must be met for Microsoft Sentinel to automatically run a playbook on an incident?

Accepted Answer

The playbook must have the Sentinel Responder role assigned. Option B is correct because the playbook's managed identity (or the service principal it uses) must be granted the Microsoft Sentinel Responder role so it has the permissions needed to act on the incident. Option C is correct because automation rules can only trigger playbooks for incidents generated by scheduled or NRT (near-real-time) analytics rules; incidents from other sources such as Microsoft 365 Defender or manual creation are not supported for automatic playbook triggering. Option E is correct because the automation rule that references the playbook must have its action set to 'Run playbook' with the playbook in the Enabled state, otherwise the automation rule will not invoke it. Option A is not required because automation rules can be configured to run on incidents of any severity (Informational, Low, Medium, High, Critical), so severity is not a mandatory condition. Option D is not required because playbooks run as Logic Apps under their own managed identity or service principal, independent of any interactive user being signed in to the Azure portal.

Answer

The incident severity must be set to High or Critical

Answer

The user must be signed in to the Azure portal

Question 2

Your organization uses Microsoft Defender for Office 365. A user reports receiving a phishing email that bypassed the default policy. You need to create a custom anti-phishing policy to block similar emails in the future. What should you configure?

Accepted Answer

Enable spoof intelligence and add the sender domain to the blocked senders list.. The correct answer is to enable spoof intelligence and add the sender domain to the blocked senders list. Spoof intelligence in Defender for Office 365 detects and blocks spoofed emails, and adding the domain to the blocked senders list ensures that emails from that domain are rejected. This directly addresses the phishing email that bypassed the default policy.

Answer

Enable Safe Attachments for the organization.

Answer

Configure impersonation protection for the user's domain.

Answer

Create a mail flow rule to block the sender's domain.

Question 3

You deploy the above ARM template to create a scheduled analytics rule in Microsoft Sentinel. After deployment, the rule runs but never generates incidents. What is the MOST likely cause?

Accepted Answer

The saved search resource type is incorrectly used; it should not be included in the template.. The ARM template incorrectly includes a saved search resource type (Microsoft.OperationalInsights/workspaces/savedSearches) as a dependency for the scheduled analytics rule. In Microsoft Sentinel, analytics rules do not require or reference saved searches; they use inline KQL queries directly. This misconfiguration prevents the rule from generating incidents because the rule's query logic is not properly associated with the data source.

Answer

The severity level 'Medium' is not supported.

Answer

The rule is disabled because 'enabled' is set to true but there is a typo.

Answer

The query 'SigninLogs | where ResultType == 50057' is invalid.

Question 4

You are responding to a data exfiltration incident in Microsoft Sentinel. The attacker used a PowerShell script to upload data to an external storage account. You need to identify the specific storage account used. Which KQL query should you use in the AzureActivity table?

Accepted Answer

OperationName == 'Storage Blob Upload'. The 'Storage Blob Upload' operation in the AzureActivity table specifically logs uploads to Azure Blob Storage, which is the exact action performed by a PowerShell script exfiltrating data to an external storage account. This operation captures the storage account name and blob details, directly identifying the target of the data exfiltration.

Answer

OperationName == 'Get Storage Account Properties'

Answer

OperationName == 'Create or Update Storage Account'

Answer

OperationName == 'List Storage Account Keys'

Question 5

Which TWO actions are valid for containing a compromised user account in Microsoft 365 Defender? (Choose two.)

Accepted Answer

Disable the user account in Microsoft Entra ID.. Option A is correct because disabling the account in Microsoft Entra ID immediately prevents the compromised user from signing in and blocks further authentication, which is a standard containment action in Microsoft 365 Defender's incident response guidance. Option C is correct because resetting the user's password invalidates the old credentials, ensuring that any stolen or guessed password can no longer be used to access the account. Option B is not a valid containment action for a user account because blocking an IP address in Defender for Cloud Apps addresses network-level access rather than the compromised identity itself. Option D is not listed as correct here, and while session revocation is a related remediation step, it is not one of the two marked correct answers for this question. Option E is not correct because deleting the mailbox is a destructive data-loss action, not a containment step, and would impede investigation and recovery.

Answer

Block the user's IP address in Defender for Cloud Apps.

Answer

Revoke the user's session tokens.

Answer

Delete the user's mailbox in Exchange Online.

Question 6

Which TWO Microsoft 365 Defender portals provide automated investigation and response capabilities? (Choose two.)

Accepted Answer

Microsoft Defender for Endpoint (security.microsoft.com). Microsoft Defender for Endpoint (D) and Microsoft 365 Defender (E) both provide automated investigation and response (AIR) capabilities. Defender for Endpoint uses AIR to automatically investigate alerts on endpoints and take remediation actions, while Microsoft 365 Defender orchestrates AIR across email, identity, endpoints, and cloud apps. These portals are accessed via security.microsoft.com and offer built-in playbooks for automated response.

Answer

Microsoft Purview compliance portal

Answer

Microsoft Sentinel (portal.azure.com)

Answer

Microsoft Intune admin center

Question 7

Which Microsoft Sentinel feature allows you to automatically respond to incidents by running a playbook when an incident is created?

Accepted Answer

Automation rules. Automation rules in Microsoft Sentinel allow you to define automated responses to incidents, including running a playbook when an incident is created. They provide a centralized way to trigger actions based on incident properties such as severity, status, or specific tactics, without needing to embed automation logic directly in analytics rules.

Answer

Analytics rules

Answer

Playbooks

Answer

Watchlists

Answer

Workbooks

Question 8

During an incident response, you identify that a user's account was used to sign in from an unusual location. You need to contain the incident immediately. What should you do first?

Accepted Answer

Disable the user account in Microsoft Entra ID.. Disabling the user account in Microsoft Entra ID is the fastest and most effective way to immediately prevent any further sign-ins from any location, including the compromised session. This action blocks all authentication attempts instantly, regardless of tokens or session state, and is the recommended first step in containing a confirmed account compromise during incident response.

Answer

Reset the user's password.

Answer

Revoke the user's refresh tokens.

Answer

Create a Conditional Access policy to block the user.

Question 9

You are reviewing an automation rule in Microsoft Sentinel. The rule triggers on incident creation with severity High. However, during a recent High severity incident, the playbook did not run. What is the most likely cause?

Accepted Answer

The automation rule does not have an owner assigned.. Automation rules in Microsoft Sentinel require an owner to be assigned for the rule to be active and execute playbooks. Without an owner, the rule is considered improperly configured and will not trigger, even if all other conditions (such as incident severity) are met. This is a common oversight that prevents playbook execution.

Answer

The action order is set to 1, but another action has a higher priority.

Answer

The condition requires IncidentSeverity equals High, but the incident was classified as Medium.

Answer

The rule triggers on incident creation, but the incident was first closed and then reopened.

Question 10

Which TWO are valid incident response actions in Microsoft Sentinel?

Accepted Answer

Change the incident status to Active.. Option A is correct because Microsoft Sentinel incidents have a status field (New, Active, Closed) and changing an incident's status to Active is a standard triage action that indicates the incident is being investigated. Option C is correct because incidents can be assigned to an owner (an analyst) in Microsoft Sentinel, which is a core incident-management action for routing and accountability. Option B is not a valid incident response action in this context because running a KQL query is done in Logs/Log Analytics, not as an action on the incident itself. Option D is not valid because Microsoft Sentinel does not provide a merge operation for incidents; related alerts can be grouped into an incident, but incidents cannot be merged. Option E is not valid because adding a comment is not an incident response action available on the incident in Microsoft Sentinel.

Answer

Run a KQL query from the incident.

Answer

Merge the incident with another incident.

Answer

Add a comment to the incident.

Question 11

Which THREE are valid ways to automatically respond to a security incident in Microsoft Defender XDR?

Accepted Answer

Configure an automated investigation and response (AIR) playbook.. Option A is correct because Microsoft Defender XDR supports automated investigation and response (AIR) playbooks that run automatically when an incident is triggered, enabling actions such as quarantining files, isolating devices, and blocking senders without manual intervention. Option B is correct because custom detection rules in Microsoft Defender XDR can be configured with automatic remediation actions, so when the rule's logic matches suspicious activity, Defender XDR can automatically contain or remediate the threat. Option C is correct because integrating threat intelligence (for example, via Microsoft Defender Threat Intelligence or the Graph Security API / TIP connectors) allows indicators of compromise to be ingested and automatically blocked across Defender XDR workloads, providing an automated response to known malicious indicators. Option D is not correct because manually running a playbook from an incident is a manual, analyst-driven action rather than an automatic response. Option E is not correct because attack simulation training is used to simulate phishing attacks and train users; it does not automatically isolate devices.

Answer

Manually run a playbook from the incident.

Answer

Use attack simulation training to automatically isolate devices.

Question 12

Your organization uses Microsoft Defender for Identity. You receive an alert about a suspicious Kerberos authentication attempt. What is the best first step to contain the potential threat?

Accepted Answer

Disable the account that was used for the authentication.. Immediately disabling the suspicious account prevents further authentication attempts and contains the threat. Option A is incorrect because reviewing logs is an investigative step that does not directly contain the threat. Option C is incorrect because resetting the krbtgt account password twice is a recovery step typically performed after a compromise to mitigate Golden Ticket attacks, not the first action during an active alert. Option D is incorrect because investigating the source IP is also an investigative step and does not immediately stop the attack.

Answer

Review the Active Directory logs for related events.

Answer

Reset the krbtgt account password twice.

Answer

Investigate the source IP address of the authentication attempt.

Question 13

During a ransomware incident, you need to prevent the encryption of files on a server running Windows Server 2022. You have Microsoft Defender for Endpoint Plan 2. Which attack surface reduction rule should you enable?

Accepted Answer

Use advanced protection against ransomware. The 'Use advanced protection against ransomware' attack surface reduction (ASR) rule specifically targets ransomware behavior by blocking untrusted processes from writing to protected folders, such as those defined in Controlled Folder Access (CFA). This rule is designed to prevent file encryption during a ransomware incident, aligning with the scenario's requirement to protect files on a Windows Server 2022 with Microsoft Defender for Endpoint Plan 2.

Answer

Block executable files from running unless they meet a prevalence, age, or trusted list criterion

Answer

Block credential stealing from the Windows local security authority subsystem

Answer

Block Adobe Reader from creating child processes

Question 14

Which TWO actions can be performed using Microsoft Sentinel's automation rules? (Choose two.)

Accepted Answer

Change the severity of an incident.. Option B is correct because automation rules in Microsoft Sentinel can modify incident properties, including changing the severity level of an incident. Option C is correct because automation rules support assigning an incident owner, allowing analysts or teams to be set as the owner. Option D is correct because automation rules can trigger a playbook (Logic App) as an action when the rule conditions are met. Option A is not correct because blocking an IP in Azure Firewall is an action performed by a playbook, not directly by an automation rule. Option E is not correct because running a KQL query against a Log Analytics workspace is an analytics rule or playbook activity, not an automation rule action.

Answer

Block an IP address in Azure Firewall.

Answer

Run a KQL query against a Log Analytics workspace.

Question 15

Which THREE are valid containment actions in Microsoft Defender for Endpoint? (Choose three.)

Accepted Answer

Contain device. In Microsoft Defender for Endpoint, 'Contain device' (B) is a valid containment action that restricts a device to only essential network traffic while allowing Defender to continue communicating with it, preventing lateral movement during an active incident. 'Run antivirus scan' (C) is a valid response action available from the device page that triggers a Microsoft Defender Antivirus scan (quick or full) to detect and remediate threats on the endpoint. 'Isolate device' (E) is a valid containment action that cuts the device off from the network entirely (full isolation) or selectively (selective isolation) to stop an ongoing attack. 'Reset password' (A) is not a Defender for Endpoint device action — it is an identity/Active Directory operation, not offered as a containment action on the device. 'Collect investigation package' (D) is a valid action but it is an investigation/forensics action, not a containment action, so it does not belong in this list.

Answer

Reset password

Answer

Collect investigation package

Question 16

Your organization uses Microsoft Purview to manage insider risk. A user is suspected of exfiltrating data via email. The incident response team needs to preserve a copy of the user's mailbox for legal hold. Which action should be taken?

Accepted Answer

Place the mailbox on litigation hold.. A litigation hold preserves mailbox content indefinitely for legal proceedings by placing the mailbox on In-Place Hold, preventing deletion or modification of items. This is the correct action when the IR team needs to preserve a mailbox copy for legal hold during an insider risk investigation.

Answer

Place the mailbox on an eDiscovery hold.

Answer

Disable the user's multi-factor authentication to prevent access.

Answer

Apply a Microsoft Purview retention policy to the user's mailbox.

Question 17

A security analyst in your organization receives an alert from Microsoft Defender for Cloud Apps indicating that a user has installed a third-party app with high permissions in Microsoft 365. The analyst suspects a consent phishing attack. Which playbook in Microsoft Sentinel should the analyst use to automate the investigation and remediation?

Accepted Answer

Automation rule. The correct playbook to use for automating investigation and remediation of a suspected consent phishing attack is an Automation rule. In Microsoft Sentinel, an Automation rule can be configured to trigger specific actions, such as revoking permissions or isolating accounts, based on alerts like those from Microsoft Defender for Cloud Apps. This allows for automated response without manual intervention.

Answer

Hunting query

Answer

Entity page

Answer

Workbook

Question 18

Which TWO components are required to enable automated investigation and response (AIR) in Microsoft Defender for Office 365?

Accepted Answer

Microsoft Defender for Endpoint integration. Option D (Office 365 Advanced Threat Protection Plan 2) is correct because AIR is a Plan 2-only capability; the automated investigation and response engine, including automated investigation queues and remediation actions, is licensed exclusively through Microsoft Defender for Office 365 Plan 2 (formerly Office 365 ATP Plan 2). Option A (Microsoft Defender for Endpoint integration) is correct because the AIR engine in Defender for Office 365 relies on the Defender for Endpoint signal to investigate and remediate endpoint-based threats, so the integration must be enabled for full automated investigation and response across email and endpoints. Option B (Attack simulation training) is incorrect because it is a separate security awareness and phishing simulation feature, not a prerequisite for AIR. Option C (Microsoft Defender for Cloud Apps) is incorrect because it is a CASB solution for cloud app discovery and governance, not a required component of the Office 365 AIR engine. Option E (Microsoft Entra ID P2 license) is incorrect because Entra ID P2 provides identity protection and conditional access features, not the email/endpoint AIR capability.

Answer

Attack simulation training

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Entra ID P2 license

Question 19

Refer to the exhibit. This is a snippet from an automation rule in Microsoft Sentinel. What is the purpose of the 'RunQuery' action?

Accepted Answer

To retrieve sign-in logs for the user involved in the incident.. The 'RunQuery' action in Microsoft Sentinel automation rules executes a Kusto Query Language (KQL) query against the Log Analytics workspace. In this context, it retrieves sign-in logs for the user involved in the incident, enabling automated enrichment of incident data with relevant authentication details. This is a common pattern for gathering additional evidence without manual investigation.

Answer

To automatically update the incident status to 'Active'.

Answer

To run a PowerShell script on the affected endpoint.

Answer

To trigger a playbook that isolates the user's device.

Question 20

Your organization uses Microsoft Sentinel. A security analyst reports that an incident was automatically closed by a playbook before the investigation was complete. What should you do to prevent automatic closure in the future?

Accepted Answer

Modify the analytics rule to not automatically close incidents. The analytics rule that generates the incident includes a setting to automatically close incidents when an alert is triggered again. Modifying this setting prevents the incident from being closed prematurely, regardless of any playbook or automation rule. This ensures that incidents remain open for investigation until manually resolved.

Answer

Disable the playbook

Answer

Remove the playbook from the automation rule

Answer

Disable the automation rule that triggers the playbook