SC-200 Respond to security incidents — 50 Questions

Question 1

You are investigating a security incident in Microsoft Sentinel where a user received a phishing email containing a link to a malicious domain. The link was clicked, but no further actions were observed. Which playbook action should you take immediately to prevent potential lateral movement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Block the malicious domain on the firewall. The user only clicked the link without performing any further actions (e.g., no credential entry or file download). Blocking the malicious domain on the firewall immediately prevents the user or any other host from reaching the domain, stopping potential lateral movement via subsequent connections. This aligns with the principle of containing the threat at the network layer before it can spread.

Answer

Disable the user's account

Answer

Revoke the user's active sessions

Answer

Reset the user's password

Question 2

During a ransomware incident, Microsoft Defender for Cloud Apps alerts indicate that a user is uploading large volumes of data to an external cloud storage provider not approved by your organization. Which two actions should you take first? (Choose two.)

Accepted Answer

Block the unapproved cloud storage app. Blocking the unapproved cloud storage app in Microsoft Defender for Cloud Apps immediately stops the ongoing data exfiltration by preventing further uploads to that external provider. This is a direct, real-time containment action that leverages Defender for Cloud Apps's app governance and conditional access controls to enforce organizational policies without disrupting the user's access to other resources.

Answer

Notify the user about the policy violation

Answer

Initiate a legal hold on the user's data

Question 3

Your security team uses Microsoft Sentinel analytics rules to detect brute-force attacks. A rule triggers when more than 10 failed logins occur within 5 minutes from a single IP. An incident is generated. Which first step should the analyst take?

Accepted Answer

Investigate the incident details. The first step in incident response within Microsoft Sentinel is to investigate the incident details to validate the alert and understand the scope. This aligns with the NIST incident response lifecycle (identification and analysis) and Sentinel's built-in investigation graph, which allows analysts to correlate entities, timelines, and related events before taking any containment action.

Answer

Block the source IP address on the firewall

Answer

Notify the users of the failed login attempts

Answer

Reset passwords for all affected accounts

Question 4

An incident in Microsoft Defender XDR involves a device that is suspected to be infected with ransomware. The device is online and actively encrypting files. Which action should you take to contain the threat?

Accepted Answer

Isolate the device from the network. Isolating the device from the network (Option A) is the correct immediate action because it stops the ransomware from communicating with its command-and-control (C2) server and prevents further lateral movement or encryption of network shares. In Microsoft Defender for Endpoint, device isolation blocks all inbound and outbound traffic at the OS kernel level, while still allowing the device to remain online for forensic analysis and remediation. This containment strategy is critical when the device is actively encrypting files, as it halts the attack's spread without losing the ability to investigate or remediate.

Answer

Disable the user's account

Answer

Run a full antivirus scan on the device

Answer

Collect a memory dump from the device

Question 5

Your organization uses Microsoft Sentinel with UEBA (User and Entity Behavior Analytics). An alert indicates a user's sign-in from an unusual location, followed by a mass download of sensitive files from SharePoint. The user is a low-privilege employee. What is the most likely conclusion?

Accepted Answer

The user's account is compromised. The combination of unusual location and mass download of sensitive files by a low-privilege user suggests account compromise. It is not necessarily ransomware or a false positive, and insider threat is less likely without evidence of intent.

Answer

The alert is a false positive due to user travel

Answer

The user is an insider threat

Answer

The user is conducting a ransomware attack

Question 6

In Microsoft Sentinel, an incident is created from a Fusion rule that correlates multiple alerts. The incident has a high severity. What should the analyst do first?

Accepted Answer

Triage the incident by reviewing the evidence. The first step in incident response within Microsoft Sentinel is to triage the incident by reviewing the evidence. A Fusion rule correlates multiple alerts into a single incident, and the analyst must examine the correlated alerts, entities, and timeline to validate the incident's legitimacy and understand the scope before taking any action. Automated playbooks or escalations should only occur after triage confirms the incident is a genuine threat.

Answer

Run an automated playbook to contain the threat

Answer

Close the incident as false positive

Answer

Escalate the incident to senior management

Question 7

You are responding to an incident where a user's credentials were used to access a federated SaaS application from an IP address associated with a known threat actor. The user's account is not disabled. Which action is most effective to prevent further unauthorized access?

Accepted Answer

Reset the user's password and revoke active sessions. Resetting the user's password and revoking active sessions immediately invalidates the compromised credentials and terminates any existing authenticated sessions, including the session used by the threat actor. This directly addresses the root cause—credential compromise—without unnecessarily disrupting the user's account permanently. In a federated SaaS scenario, password reset combined with session revocation ensures the threat actor cannot re-authenticate even if they possess the previous password hash or tokens.

Answer

Create a Conditional Access policy to block the IP

Answer

Disable the user's account

Answer

Block the source IP address on the firewall

Question 8

During an incident response, you need to collect forensic data from Microsoft Defender for Endpoint (MDE) on a remote device that is currently offline. What is the best approach?

Accepted Answer

Initiate a live response session when the device comes online. When a device is offline, Microsoft Defender for Endpoint cannot establish a live response session because the device must be connected to the MDE service to execute commands. Initiating a live response session when the device comes online is the best approach because it allows you to run forensic collection commands (e.g., 'getfile', 'run') directly on the device via the MDE API, without requiring manual intervention or additional infrastructure.

Answer

Wait until the device is online and then collect manually

Answer

Run a remotely scheduled antivirus scan

Answer

Collect the data from the device's cloud store

Question 9

An incident in Microsoft Sentinel involves a phishing campaign that delivered a malicious macro-enabled document. The document was opened by 15 users. Which playbook action should be triggered automatically to contain the threat?

Accepted Answer

Block the file hash using Microsoft Defender for Endpoint. The automatic playbook action should block the file hash at the endpoint to prevent further execution. Isolating devices may be too aggressive. Blocking sender IP is not effective against phishing. Disabling user accounts is not direct.

Answer

Isolate all affected devices from the network

Answer

Block the sender's IP address on the email gateway

Answer

Disable the user accounts of those who opened the document

Question 10

An analyst creates a playbook in Microsoft Sentinel to automatically block an IP address when an alert fires. However, the playbook fails to block the IP. What is the most likely cause?

Accepted Answer

The IP address is being extracted from an incorrect field in the alert. The most likely cause is that the playbook is extracting the IP address from an incorrect field in the alert. In Microsoft Sentinel, playbooks use the SecurityAlert schema, where the IP address may be stored in different fields (e.g., 'RemoteIP', 'SourceIP', 'DestinationIP') depending on the alert provider. If the playbook references the wrong field, it will pass a null or incorrect value to the block action, causing the automation to fail silently or target the wrong entity.

Answer

The block duration is set to one day, which is too short

Answer

The playbook actions array has only one action, which is insufficient

Answer

The playbook is using the wrong trigger type; it should be on incident creation

Question 11

You run the above KQL query in Microsoft Sentinel to identify ransomware alerts from the last day. The result shows zero rows. Which is the most likely reason?

Accepted Answer

No alerts with 'ransomware' in the name occurred in the last day. The KQL query filters for alerts where the name contains 'ransomware'. If no such alerts were generated in the last day, the query returns zero rows. This is the most likely reason because the query logic is correct, and the absence of data is a valid outcome, not an error.

Answer

The table name 'SecurityAlert' is incorrect; it should be 'Alert'

Answer

The user does not have permission to access the SecurityAlert table

Answer

The time filter of 1 day is too restrictive; need to increase range

Question 12

An administrator creates a Microsoft Defender for Cloud Apps policy to block unsanctioned cloud storage apps. Despite the policy, users can still access these apps. What is the most likely cause?

Accepted Answer

The policy mode is set to 'Monitor', which only alerts and does not block. When a Microsoft Defender for Cloud Apps policy is set to 'Monitor' mode, it only generates alerts and does not enforce any blocking action. To actually block unsanctioned cloud storage apps, the policy must be configured with a 'Block' action type, typically in conjunction with a 'Governance' action that applies the block at the proxy or API level. The 'Monitor' mode is designed for detection and logging, not enforcement.

Answer

The action type 'Block' is incorrect; it should be 'Alert'

Answer

The policy requires a 'Device' filter to apply to all users

Answer

The filter uses 'Unsanctioned' tag, but apps are tagged 'Sanctioned'

Question 13

Which TWO actions are appropriate when responding to a confirmed data exfiltration incident via email?

Accepted Answer

Block the recipient domain on the email gateway. Blocking the recipient domain on the email gateway (A) is appropriate because it immediately prevents further data exfiltration to that external domain by rejecting all outbound emails to that domain at the transport layer. Placing a legal hold on the user's mailbox (B) preserves all mailbox content, including deleted items, as an immutable copy for forensic investigation and potential legal proceedings, ensuring evidence is not lost during the incident response.

Answer

Disable the user's account immediately

Answer

Delete all sent items from the user's mailbox

Answer

Run a full antivirus scan on the user's device

Question 14

Which THREE steps should be included in a Microsoft Sentinel playbook for automatic incident response when a high-severity alert fires?

Accepted Answer

Investigate the alert by enriching with threat intelligence. Microsoft Sentinel playbooks, built on Azure Logic Apps, can automatically enrich alerts with threat intelligence from sources like the Threat Intelligence API or integrated TI platforms (e.g., VirusTotal, AlienVault OTX). This enrichment provides context (e.g., known malicious IPs, hashes, or domains) directly within the incident, enabling faster triage and informed response decisions without manual investigation.

Answer

Pause the incident for 24 hours before taking action

Answer

Create a new Azure resource for logging

Question 15

Which THREE conditions must be met for Microsoft Sentinel to automatically run a playbook on an incident?

Accepted Answer

The playbook must have the Sentinel Responder role assigned. Microsoft Sentinel requires the playbook to have the 'Microsoft Sentinel Responder' role assigned to its managed identity (or service principal) in order to execute actions on incidents. This role grants the necessary permissions to update incidents, add comments, and perform other responder actions. Without this role assignment, the automation rule will fail to trigger the playbook.

Answer

The incident severity must be set to High or Critical

Answer

The user must be signed in to the Azure portal

Question 16

A security analyst receives a high-severity alert for a suspicious login from an unusual location. The alert was generated by Microsoft Sentinel from Microsoft Entra ID sign-in logs. The analyst needs to determine if the login was successful and if any data exfiltration occurred. What is the MOST efficient first step?

Accepted Answer

Run a KQL query in Microsoft Sentinel to review the SigninLogs table for the user within the alert time range.. The most efficient first step is to run a KQL query in Microsoft Sentinel against the SigninLogs table for the specific user within the alert time range. This directly confirms whether the suspicious login was successful by checking the 'ResultType' and 'ResultDescription' fields, which is the fastest way to validate the alert's core claim before investigating data exfiltration.

Answer

Use Microsoft Defender XDR to check the user's device timeline for suspicious activity.

Answer

Run a KQL query in Microsoft Sentinel to check Microsoft Defender for Cloud Apps alerts for the user.

Answer

Check the firewall logs in Azure Firewall for outbound connections from the user's IP.

Question 17

Your organization uses Microsoft Defender for Office 365. A user reports receiving a phishing email that bypassed the default policy. You need to create a custom anti-phishing policy to block similar emails in the future. What should you configure?

Accepted Answer

Enable spoof intelligence and add the sender domain to the blocked senders list.. Spoof intelligence in anti-phishing policies can detect spoofed senders, and adding the sender domain to the blocked senders list prevents similar emails. Option A (Safe Attachments) is incorrect because it focuses on attachment scanning, not phishing content. Option B (impersonation protection) is incorrect because it specifically protects against impersonation of users or domains, but the scenario describes a generic phishing email bypassing default policy; spoof intelligence is more appropriate. Option D (mail flow rule) is incorrect because mail flow rules are transport rules, not part of an anti-phishing policy.

Answer

Enable Safe Attachments for the organization.

Answer

Configure impersonation protection for the user's domain.

Answer

Create a mail flow rule to block the sender's domain.

Question 18

A security team is investigating a ransomware incident that encrypted files on several Windows servers. Microsoft Defender for Endpoint detected the ransomware but the initial infection vector is unknown. Which KQL query in Microsoft Sentinel would BEST identify the initial process that executed the ransomware?

Accepted Answer

DeviceProcessEvents | where FileName contains 'ransomware.exe' | project DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, Timestamp. DeviceProcessEvents captures process creation events, and by filtering for the ransomware executable and projecting the InitiatingProcessFileName and InitiatingProcessCommandLine, you can trace back to the parent process that launched the ransomware. This directly identifies the initial infection vector, which is the core goal of the investigation.

Answer

DeviceNetworkEvents | where RemoteUrl contains 'malicious' | project DeviceName, RemoteIP, Timestamp

Answer

DeviceFileEvents | where FileName contains 'ransomware.exe' | project DeviceName, ActionType, Timestamp

Answer

DeviceEvents | where ActionType == 'RansomwareDetection' | project DeviceName, Timestamp

Question 19

You have a Microsoft Sentinel analytical rule with the above configuration. During a security incident, multiple high-severity alerts are generated within a 5-minute window. How does the rule handle these alerts?

Accepted Answer

Alerts with the same entities are grouped into a single incident.. The analytical rule is configured with 'Group alerts into incidents by: Grouping alerts into a single incident based on matching entities.' This means that when multiple high-severity alerts are generated within a 5-minute window, the rule evaluates the entities (e.g., IP addresses, user accounts) in each alert. If the alerts share the same entities, they are grouped into a single incident, preventing alert flooding and consolidating related security events.

Answer

Only the first alert creates an incident; subsequent alerts are ignored.

Answer

Each alert creates a separate incident.

Answer

Alerts are suppressed for 5 minutes after the first alert.

Question 20

You are deploying Microsoft Sentinel using the above ARM template parameters. After deployment, you notice that Microsoft Defender for Cloud alerts are not being ingested. What is the MOST likely reason?

Accepted Answer

The 'MicrosoftThreatProtection' connector only ingests Microsoft Defender XDR signals, not Defender for Cloud alerts.. The 'MicrosoftThreatProtection' connector is specifically designed to ingest signals from Microsoft Defender XDR (formerly Microsoft 365 Defender), which includes Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps. It does not ingest Microsoft Defender for Cloud alerts. To ingest Defender for Cloud alerts, you must use the dedicated 'Defender for Cloud' data connector in Microsoft Sentinel. Therefore, deploying only the 'MicrosoftThreatProtection' connector will result in Defender for Cloud alerts not being ingested.

Answer

UEBA is enabled, which conflicts with Defender for Cloud data ingestion.

Answer

The workspace location (eastus) does not support Defender for Cloud connector.

Answer

The workspace name 'sentinel-workspace' is reserved for internal use.