SC-200 Respond to security incidents — 40 Questions

Question 1

Your organization uses Microsoft Defender for Office 365. A user reports receiving a phishing email that bypassed the default policy. You need to create a custom anti-phishing policy to block similar emails in the future. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable spoof intelligence and add the sender domain to the blocked senders list.. Spoof intelligence in anti-phishing policies can detect spoofed senders, and adding the sender domain to the blocked senders list prevents similar emails. Option A (Safe Attachments) is incorrect because it focuses on attachment scanning, not phishing content. Option B (impersonation protection) is incorrect because it specifically protects against impersonation of users or domains, but the scenario describes a generic phishing email bypassing default policy; spoof intelligence is more appropriate. Option D (mail flow rule) is incorrect because mail flow rules are transport rules, not part of an anti-phishing policy.

Answer

Enable Safe Attachments for the organization.

Answer

Configure impersonation protection for the user's domain.

Answer

Create a mail flow rule to block the sender's domain.

Question 2

Your organization uses Microsoft Defender for Office 365. A user reports receiving a phishing email that bypassed the default policy. You need to create a custom anti-phishing policy to block similar emails in the future. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Review the alert details in Microsoft Defender for Cloud to identify the vulnerability and follow the remediation steps.. The first step in responding to a security alert is to validate the alert by reviewing the details in Microsoft Defender for Cloud, which provides information about the vulnerability, affected resources, and recommended remediation steps. This allows you to understand the threat before taking action. Option A is wrong because contacting support is not an immediate validation step; the alert details are already available in Defender for Cloud. Option B is wrong because applying patches without first validating the alert could cause unnecessary downtime or incompatibility issues. Option C is wrong because isolating the VM is a containment action that should be taken after validating the alert, not as the first step for validation.

Answer

Contact Microsoft support to request a vulnerability assessment.

Answer

Immediately apply the latest security patches to the VM using Azure Update Manager.

Answer

Isolate the VM from the network by applying a network security group rule.

Question 3

Which TWO actions should an analyst take when triaging a Microsoft Sentinel incident that involves a user who clicked a malicious link in a phishing email? (Choose two.)

Accepted Answer

Run a KQL query on EmailEvents to identify the email and recipient.. When triaging a Microsoft Sentinel incident involving a user who clicked a malicious link in a phishing email, the analyst should first identify the affected email and user to understand the scope. Option C is correct because running a KQL query on EmailEvents allows the analyst to pinpoint the specific email and recipient. Option E is correct because checking the email's status in Microsoft Defender for Office 365 Threat Explorer provides additional threat intelligence and confirms the email's disposition. Options A, B, and D are incorrect: resetting the password (A) is premature without evidence of compromise; blocking the sender's domain (B) may be done later but is not an immediate triage action; deleting the email (D) should not be done before investigation as it may be needed for evidence.

Answer

Reset the user's password immediately.

Answer

Block the sender's domain in the tenant's block list.

Answer

Delete the email from the user's mailbox immediately.

Question 4

Which TWO actions are valid for containing a compromised user account in Microsoft 365 Defender? (Choose two.)

Accepted Answer

Disable the user account in Microsoft Entra ID.. The correct answers are A and C. Disabling the user account in Microsoft Entra ID immediately blocks all access by preventing authentication. Resetting the user's password forces the user to change credentials, invalidating current sessions and preventing further unauthorized access. B is incorrect because blocking the user's IP address may affect other users behind the same IP and does not fully contain the account compromise. D (Revoke session tokens) is not a primary containment action because it only terminates current sessions but does not prevent new sign-ins if the credentials remain valid. E (Delete the user's mailbox) is overly destructive and unnecessary for containment; it should only be considered after legal and data preservation requirements are met.

Answer

Block the user's IP address in Defender for Cloud Apps.

Answer

Revoke the user's session tokens.

Answer

Delete the user's mailbox in Exchange Online.

Question 5

You are investigating a security incident in Microsoft Sentinel. You want to visualize the relationships between entities such as IP addresses, users, and hosts. Which tool should you use?

Accepted Answer

Investigation graph. The Investigation graph in Microsoft Sentinel is specifically designed to visualize relationships between entities such as IP addresses, users, and hosts, making it the correct tool for this task. Analytics rules (B) are used for detection, automation rules (C) for automated responses, and workbooks (D) for dashboards and reporting, not for entity relationship visualization.

Answer

Analytics rules

Answer

Automation rules

Answer

Workbooks

Question 6

You are investigating a suspicious sign-in to a privileged account. You need to determine if the sign-in was from a known malicious IP address. Which Microsoft Sentinel data source should you query?

Accepted Answer

ThreatIntelligenceIndicator. The ThreatIntelligenceIndicator table in Microsoft Sentinel contains indicators of compromise, including known malicious IP addresses, making it the correct data source to query for this investigation. Option B (SecurityEvent) contains Windows security event logs, not threat intelligence. Option C (SigninLogs) shows sign-in events but does not include threat intelligence data. Option D (AuditLogs) records directory changes and administrative activities, not threat indicators.

Answer

SecurityEvent

Answer

SigninLogs

Answer

AuditLogs

Question 7

You are reviewing an automation rule in Microsoft Sentinel. The rule triggers on incident creation with severity High. However, during a recent High severity incident, the playbook did not run. What is the most likely cause?

Accepted Answer

The automation rule does not have an owner assigned.. Automation rules in Microsoft Sentinel require an owner to be assigned for the rule to be active and execute playbooks. Without an owner, the rule is considered improperly configured and will not trigger, even if all other conditions (such as incident severity) are met. This is a common oversight that prevents playbook execution.

Answer

The action order is set to 1, but another action has a higher priority.

Answer

The condition requires IncidentSeverity equals High, but the incident was classified as Medium.

Answer

The rule triggers on incident creation, but the incident was first closed and then reopened.

Question 8

Your organization has a hybrid identity environment with Microsoft Entra ID and on-premises Active Directory. You suspect a compromised on-premises admin account that has been used to modify security groups. You want to quickly contain the threat. What should you do first?

Accepted Answer

Revoke the user's sessions in Microsoft Entra ID and reset the password in both on-premises AD and Entra ID.. Revoke the user's sessions in Microsoft Entra ID and reset the password in both on-premises AD and Entra ID. This immediately terminates active sessions and prevents further use of the compromised account. Option A is incorrect because moving the user to an OU with blocked logon hours does not revoke current sessions and may not take effect immediately. Option B is incorrect because resetting the password only in on-premises AD does not revoke existing tokens or sessions in the cloud. Option D is incorrect because disabling the account only in Entra ID does not block on-premises access, and the user might still have active sessions.

Answer

Move the user account to an Organizational Unit (OU) with blocked logon hours.

Answer

Reset the user's password in on-premises Active Directory.

Answer

Disable the user account in Microsoft Entra ID.

Question 9

Which THREE are valid ways to automatically respond to a security incident in Microsoft Defender XDR?

Accepted Answer

Configure an automated investigation and response (AIR) playbook.. Options A and B are correct: Microsoft Defender XDR includes automated investigation and response (AIR) playbooks that trigger actions based on incident criteria, and custom detection rules can automatically run remediation actions. Option C is also correct because integrating threat intelligence allows you to automatically block indicators like IPs or domains, acting as an automated response. Option D is manual, not automatic. Option E is incorrect because attack simulation training is for simulation and training, not for automated incident response.

Answer

Manually run a playbook from the incident.

Answer

Use attack simulation training to automatically isolate devices.

Question 10

Your organization uses Microsoft Defender for Identity. You receive an alert about a suspicious Kerberos authentication attempt. What is the best first step to contain the potential threat?

Accepted Answer

Disable the account that was used for the authentication.. Immediately disabling the suspicious account prevents further authentication attempts and contains the threat. Option A is incorrect because reviewing logs is an investigative step that does not directly contain the threat. Option C is incorrect because resetting the krbtgt account password twice is a recovery step typically performed after a compromise to mitigate Golden Ticket attacks, not the first action during an active alert. Option D is incorrect because investigating the source IP is also an investigative step and does not immediately stop the attack.

Answer

Review the Active Directory logs for related events.

Answer

Reset the krbtgt account password twice.

Answer

Investigate the source IP address of the authentication attempt.

Question 11

Which TWO actions can be performed using Microsoft Sentinel's automation rules? (Choose two.)

Accepted Answer

Change the severity of an incident.. Automation rules in Microsoft Sentinel can perform several actions on incidents, including changing severity (B), assigning owner (C), and triggering a playbook (D). Option A is incorrect because blocking an IP address is a more complex remediation typically done via a playbook, not directly by an automation rule. Option E is incorrect because running a KQL query is not an action available in automation rules; queries are executed in the Log Analytics workspace or via analytics rules.

Answer

Block an IP address in Azure Firewall.

Answer

Run a KQL query against a Log Analytics workspace.

Question 12

Your organization uses Microsoft Purview to manage insider risk. A user is suspected of exfiltrating data via email. The incident response team needs to preserve a copy of the user's mailbox for legal hold. Which action should be taken?

Accepted Answer

Place the mailbox on litigation hold.. A litigation hold preserves all mailbox content, including deleted and modified items, ensuring the mailbox is preserved for legal hold. Option A is incorrect because an eDiscovery hold is typically used for specific search results rather than full mailbox preservation. Option C is incorrect because disabling MFA does not preserve any data. Option D is incorrect because a retention policy applies to all mailboxes in the organization and may not target this specific user's legal hold need.

Answer

Place the mailbox on an eDiscovery hold.

Answer

Disable the user's multi-factor authentication to prevent access.

Answer

Apply a Microsoft Purview retention policy to the user's mailbox.

Question 13

A security analyst in your organization receives an alert from Microsoft Defender for Cloud Apps indicating that a user has installed a third-party app with high permissions in Microsoft 365. The analyst suspects a consent phishing attack. Which playbook in Microsoft Sentinel should the analyst use to automate the investigation and remediation?

Accepted Answer

Automation rule. The correct playbook to use for automating investigation and remediation of a suspected consent phishing attack is an Automation rule. In Microsoft Sentinel, an Automation rule can be configured to trigger specific actions, such as revoking permissions or isolating accounts, based on alerts like those from Microsoft Defender for Cloud Apps. This allows for automated response without manual intervention.

Answer

Hunting query

Answer

Entity page

Answer

Workbook

Question 14

Which TWO components are required to enable automated investigation and response (AIR) in Microsoft Defender for Office 365?

Accepted Answer

Microsoft Defender for Endpoint integration. Automated investigation and response (AIR) in Microsoft Defender for Office 365 requires two components: Option A (Microsoft Defender for Endpoint integration) enables correlation between email threats and endpoint telemetry, and Option D (Office 365 Advanced Threat Protection Plan 2) provides the automation capabilities including playbooks and incident response workflows. Attack simulation training (B) is not a prerequisite; it is a separate tool for user awareness. The other options are not required: Microsoft Defender for Cloud Apps (C) is a different service, and Microsoft Entra ID P2 (E) is not needed for AIR in Defender for Office 365.

Answer

Attack simulation training

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Entra ID P2 license

Question 15

After a security incident, you need to collect forensic evidence from a Windows 10 machine. Which Microsoft tool should you use to create a memory dump?

Accepted Answer

Microsoft Defender for Endpoint Live Response. Microsoft Defender for Endpoint Live Response provides a `dump` command that can capture a full memory dump from a live Windows 10 system without causing a crash. This preserves volatile forensic evidence such as running processes, network connections, and encryption keys. In contrast, the Microsoft Crash Dump Tool (NotMyFault or Sysinternals) is designed to trigger a system crash (BSOD) for debugging purposes, which is destructive and not appropriate for forensic collection. Therefore, for a security incident requiring a memory dump without system disruption, Live Response is the correct tool.

Answer

Remote Desktop Protocol (RDP)

Answer

Microsoft Crash Dump Tool (e.g., NotMyFault or Sysinternals tools)

Answer

Microsoft Defender for Cloud Apps

Question 16

Your organization uses Microsoft Sentinel. You need to create an incident response playbook that automatically isolates a compromised device when a high-severity incident is created. The playbook should only run during business hours (9 AM - 5 PM local time). How should you configure this?

Accepted Answer

Add a condition in the playbook to check the current time. Microsoft Sentinel automation rules cannot evaluate conditions based on the time of day (e.g., creation hour). The appropriate method is to add a condition in the playbook itself (Azure Logic Apps) to check the current time and proceed only during business hours. This approach gives you full control over the playbook's execution schedule without relying on unsupported automation rule conditions.

Answer

Configure the analytics rule to only create incidents during business hours

Answer

Use a workbook to schedule the playbook

Answer

Create an automation rule with a condition on the incident creation time

Question 17

Refer to the exhibit. You are reviewing an automation rule in Microsoft Sentinel that triggers a playbook. The rule is not triggering. What is the most likely cause?

Accepted Answer

The condition 'Status equals Active' is incorrect; incidents are created with status 'New'. The automation rule triggers on incident creation, but the condition filters for incidents with Status equals 'Active'. When an incident is created in Microsoft Sentinel, its default status is 'New', not 'Active', so the condition never matches and the playbook does not trigger. Option A is incorrect because an incorrect Logic App resource ID would result in a different error (e.g., resource not found) rather than the rule not triggering. Option B is incorrect because a missing subscription ID would cause the rule to fail entirely, not silently not trigger. Option D is incorrect because the trigger type 'IncidentCreated' is appropriate for this scenario; the issue is the condition, not the trigger type.

Answer

The Logic App resource ID is incorrect

Answer

The subscription ID is missing

Answer

The trigger type should be 'IncidentUpdated' instead of 'IncidentCreated'

Question 18

Refer to the exhibit. You are investigating why the query returns only two rows (High and Medium) even though there are Low severity alerts. What is the problem?

Accepted Answer

The case statement does not handle integer severity values. The CASE statement in the query maps integer severity values (3 → 'High', 2 → 'Medium') but does not handle the value 1 (Low). Without an ELSE clause, severity values not explicitly matched (like 1) return NULL, and those rows are filtered out from the results. This explains why only 'High' and 'Medium' rows appear. Option D's statement about a missing default refers to the lack of an ELSE clause, but the root cause is the absence of a WHEN clause for severity 1. The explanation is updated to avoid any contradiction: the CASE statement has no WHEN for 1 and no ELSE, so unmatched values become NULL.

Answer

The order by clause sorts numerically, causing incorrect grouping

Answer

The query does not filter on a specific time range

Answer

The case statement is missing a default value

Question 19

Your organization uses Microsoft Defender for Office 365. A user reports receiving a phishing email that bypassed the default policy. You need to create a custom anti-phishing policy to block similar emails in the future. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Suspend the user in Microsoft Defender for Cloud Apps.. Suspending the user in Microsoft Defender for Cloud Apps immediately blocks all access to cloud apps monitored by Defender for Cloud Apps, preventing further data exfiltration. Option A is incorrect because disabling the user account in Microsoft Entra ID is a broader action that may affect access to all Microsoft services, but it is not as immediate for cloud app access and does not directly stop an ongoing exfiltration through Defender for Cloud Apps. Option B is incorrect because creating an IP range policy to block the anonymous IP address would only block that specific IP, but the attacker could easily switch to a different IP, and it does not address the compromised user account. Option C is incorrect because changing the user's password and revoking sessions may not stop data exfiltration if the attacker has already established persistent access or if the sessions are not fully terminated; suspending the user in Defender for Cloud Apps is a more direct and effective method to stop access to cloud apps.

Answer

Disable the user account in Microsoft Entra ID.

Answer

Create an IP range policy in Defender for Cloud Apps to block the anonymous IP.

Answer

Change the user's password and revoke sessions.

Question 20

Your organization uses Microsoft Sentinel and Microsoft Defender XDR (including Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps). You have an incident response team that operates 24/7. Recently, there have been multiple incidents involving users receiving phishing emails that lead to credential theft. The phishing emails are sophisticated and bypass Exchange Online Protection (EOP) and Defender for Office 365's built-in phishing filters. The emails contain links to fake login pages that harvest credentials. Once credentials are stolen, the attacker uses them to sign in from anonymous IP addresses and attempts to access sensitive data in SharePoint Online. You need to design a response strategy that includes automated containment and investigation. The solution must:
- Automatically disable user accounts when a phishing incident is confirmed.
- Automatically trigger an investigation into the user's activity in Microsoft Defender for Cloud Apps.
- Send a notification to the incident response team with a summary of the incident.
- Minimize manual effort.

You have the following components available:
- Microsoft Sentinel with automation rules and playbooks.
- Microsoft Defender XDR with advanced hunting.
- Microsoft Power Automate.

What is the most efficient way to achieve these requirements?

Accepted Answer

Create a playbook in Microsoft Sentinel that uses the Microsoft Graph API to disable the user account in Microsoft Entra ID, trigger an investigation in Microsoft Defender for Cloud Apps, and send an email notification. Associate the playbook with an automation rule that runs when the incident is created.. Creating a playbook in Microsoft Sentinel that uses the Microsoft Graph API to disable the user in Microsoft Entra ID, triggers an investigation in Defender for Cloud Apps, and sends an email notification, then associating it with an automation rule that runs automatically when the incident is created, meets all requirements with minimal manual effort. Option B is correct because it enables automated containment and investigation without manual intervention. Option A is incorrect because Microsoft Defender XDR's automated investigation and response (AIR) does not automatically disable user accounts across all services; it focuses on endpoint remediation. Option C is incorrect because relying on a third-party system via webhook introduces additional complexity and may not integrate seamlessly with Microsoft tools. Option D is incorrect because while Power Automate can be used, creating a playbook directly in Microsoft Sentinel is more tightly integrated and efficient for incident response workflows.

Answer

Use Microsoft Defender XDR's automated investigation and response (AIR) to automatically disable the user account.

Answer

Create an automation rule in Microsoft Sentinel that triggers a webhook to a third-party system, which then disables the user account.

Answer

Configure a Playbook in Power Automate that monitors Microsoft Sentinel incidents and automatically disables the user account.