SC-200 Respond to security incidents Practice Test 1 — 15 Questions

Question 1

Which THREE conditions must be met for Microsoft Sentinel to automatically run a playbook on an incident?

Accepted Answer

The playbook must have the Sentinel Responder role assigned. Option B is correct because the playbook's managed identity (or the service principal it uses) must be granted the Microsoft Sentinel Responder role so it has the permissions needed to act on the incident. Option C is correct because automation rules can only trigger playbooks for incidents generated by scheduled or NRT (near-real-time) analytics rules; incidents from other sources such as Microsoft 365 Defender or manual creation are not supported for automatic playbook triggering. Option E is correct because the automation rule that references the playbook must have its action set to 'Run playbook' with the playbook in the Enabled state, otherwise the automation rule will not invoke it. Option A is not required because automation rules can be configured to run on incidents of any severity (Informational, Low, Medium, High, Critical), so severity is not a mandatory condition. Option D is not required because playbooks run as Logic Apps under their own managed identity or service principal, independent of any interactive user being signed in to the Azure portal.

Answer

The incident severity must be set to High or Critical

Answer

The user must be signed in to the Azure portal

Question 2

Your organization uses Microsoft Defender for Office 365. A user reports receiving a phishing email that bypassed the default policy. You need to create a custom anti-phishing policy to block similar emails in the future. What should you configure?

Accepted Answer

Enable spoof intelligence and add the sender domain to the blocked senders list.. The correct answer is to enable spoof intelligence and add the sender domain to the blocked senders list. Spoof intelligence in Defender for Office 365 detects and blocks spoofed emails, and adding the domain to the blocked senders list ensures that emails from that domain are rejected. This directly addresses the phishing email that bypassed the default policy.

Answer

Enable Safe Attachments for the organization.

Answer

Configure impersonation protection for the user's domain.

Answer

Create a mail flow rule to block the sender's domain.

Question 3

You deploy the above ARM template to create a scheduled analytics rule in Microsoft Sentinel. After deployment, the rule runs but never generates incidents. What is the MOST likely cause?

Accepted Answer

The saved search resource type is incorrectly used; it should not be included in the template.. The ARM template incorrectly includes a saved search resource type (Microsoft.OperationalInsights/workspaces/savedSearches) as a dependency for the scheduled analytics rule. In Microsoft Sentinel, analytics rules do not require or reference saved searches; they use inline KQL queries directly. This misconfiguration prevents the rule from generating incidents because the rule's query logic is not properly associated with the data source.

Answer

The severity level 'Medium' is not supported.

Answer

The rule is disabled because 'enabled' is set to true but there is a typo.

Answer

The query 'SigninLogs | where ResultType == 50057' is invalid.

Question 4

You are responding to a data exfiltration incident in Microsoft Sentinel. The attacker used a PowerShell script to upload data to an external storage account. You need to identify the specific storage account used. Which KQL query should you use in the AzureActivity table?

Accepted Answer

OperationName == 'Storage Blob Upload'. The 'Storage Blob Upload' operation in the AzureActivity table specifically logs uploads to Azure Blob Storage, which is the exact action performed by a PowerShell script exfiltrating data to an external storage account. This operation captures the storage account name and blob details, directly identifying the target of the data exfiltration.

Answer

OperationName == 'Get Storage Account Properties'

Answer

OperationName == 'Create or Update Storage Account'

Answer

OperationName == 'List Storage Account Keys'

Question 5

Which TWO actions are valid for containing a compromised user account in Microsoft 365 Defender? (Choose two.)

Accepted Answer

Disable the user account in Microsoft Entra ID.. Option A is correct because disabling the account in Microsoft Entra ID immediately prevents the compromised user from signing in and blocks further authentication, which is a standard containment action in Microsoft 365 Defender's incident response guidance. Option C is correct because resetting the user's password invalidates the old credentials, ensuring that any stolen or guessed password can no longer be used to access the account. Option B is not a valid containment action for a user account because blocking an IP address in Defender for Cloud Apps addresses network-level access rather than the compromised identity itself. Option D is not listed as correct here, and while session revocation is a related remediation step, it is not one of the two marked correct answers for this question. Option E is not correct because deleting the mailbox is a destructive data-loss action, not a containment step, and would impede investigation and recovery.

Answer

Block the user's IP address in Defender for Cloud Apps.

Answer

Revoke the user's session tokens.

Answer

Delete the user's mailbox in Exchange Online.

Question 6

Which TWO Microsoft 365 Defender portals provide automated investigation and response capabilities? (Choose two.)

Accepted Answer

Microsoft Defender for Endpoint (security.microsoft.com). Microsoft Defender for Endpoint (D) and Microsoft 365 Defender (E) both provide automated investigation and response (AIR) capabilities. Defender for Endpoint uses AIR to automatically investigate alerts on endpoints and take remediation actions, while Microsoft 365 Defender orchestrates AIR across email, identity, endpoints, and cloud apps. These portals are accessed via security.microsoft.com and offer built-in playbooks for automated response.

Answer

Microsoft Purview compliance portal

Answer

Microsoft Sentinel (portal.azure.com)

Answer

Microsoft Intune admin center

Question 7

Which Microsoft Sentinel feature allows you to automatically respond to incidents by running a playbook when an incident is created?

Accepted Answer

Automation rules. Automation rules in Microsoft Sentinel allow you to define automated responses to incidents, including running a playbook when an incident is created. They provide a centralized way to trigger actions based on incident properties such as severity, status, or specific tactics, without needing to embed automation logic directly in analytics rules.

Answer

Analytics rules

Answer

Playbooks

Answer

Watchlists

Answer

Workbooks

Question 8

During an incident response, you identify that a user's account was used to sign in from an unusual location. You need to contain the incident immediately. What should you do first?

Accepted Answer

Disable the user account in Microsoft Entra ID.. Disabling the user account in Microsoft Entra ID is the fastest and most effective way to immediately prevent any further sign-ins from any location, including the compromised session. This action blocks all authentication attempts instantly, regardless of tokens or session state, and is the recommended first step in containing a confirmed account compromise during incident response.

Answer

Reset the user's password.

Answer

Revoke the user's refresh tokens.

Answer

Create a Conditional Access policy to block the user.

Question 9

You are reviewing an automation rule in Microsoft Sentinel. The rule triggers on incident creation with severity High. However, during a recent High severity incident, the playbook did not run. What is the most likely cause?

Accepted Answer

The automation rule does not have an owner assigned.. Automation rules in Microsoft Sentinel require an owner to be assigned for the rule to be active and execute playbooks. Without an owner, the rule is considered improperly configured and will not trigger, even if all other conditions (such as incident severity) are met. This is a common oversight that prevents playbook execution.

Answer

The action order is set to 1, but another action has a higher priority.

Answer

The condition requires IncidentSeverity equals High, but the incident was classified as Medium.

Answer

The rule triggers on incident creation, but the incident was first closed and then reopened.

Question 10

Which TWO are valid incident response actions in Microsoft Sentinel?

Accepted Answer

Change the incident status to Active.. Option A is correct because Microsoft Sentinel incidents have a status field (New, Active, Closed) and changing an incident's status to Active is a standard triage action that indicates the incident is being investigated. Option C is correct because incidents can be assigned to an owner (an analyst) in Microsoft Sentinel, which is a core incident-management action for routing and accountability. Option B is not a valid incident response action in this context because running a KQL query is done in Logs/Log Analytics, not as an action on the incident itself. Option D is not valid because Microsoft Sentinel does not provide a merge operation for incidents; related alerts can be grouped into an incident, but incidents cannot be merged. Option E is not valid because adding a comment is not an incident response action available on the incident in Microsoft Sentinel.

Answer

Run a KQL query from the incident.

Answer

Merge the incident with another incident.

Answer

Add a comment to the incident.

Question 11

Which THREE are valid ways to automatically respond to a security incident in Microsoft Defender XDR?

Accepted Answer

Configure an automated investigation and response (AIR) playbook.. Option A is correct because Microsoft Defender XDR supports automated investigation and response (AIR) playbooks that run automatically when an incident is triggered, enabling actions such as quarantining files, isolating devices, and blocking senders without manual intervention. Option B is correct because custom detection rules in Microsoft Defender XDR can be configured with automatic remediation actions, so when the rule's logic matches suspicious activity, Defender XDR can automatically contain or remediate the threat. Option C is correct because integrating threat intelligence (for example, via Microsoft Defender Threat Intelligence or the Graph Security API / TIP connectors) allows indicators of compromise to be ingested and automatically blocked across Defender XDR workloads, providing an automated response to known malicious indicators. Option D is not correct because manually running a playbook from an incident is a manual, analyst-driven action rather than an automatic response. Option E is not correct because attack simulation training is used to simulate phishing attacks and train users; it does not automatically isolate devices.

Answer

Manually run a playbook from the incident.

Answer

Use attack simulation training to automatically isolate devices.

Question 12

Your organization uses Microsoft Defender for Identity. You receive an alert about a suspicious Kerberos authentication attempt. What is the best first step to contain the potential threat?

Accepted Answer

Disable the account that was used for the authentication.. Immediately disabling the suspicious account prevents further authentication attempts and contains the threat. Option A is incorrect because reviewing logs is an investigative step that does not directly contain the threat. Option C is incorrect because resetting the krbtgt account password twice is a recovery step typically performed after a compromise to mitigate Golden Ticket attacks, not the first action during an active alert. Option D is incorrect because investigating the source IP is also an investigative step and does not immediately stop the attack.

Answer

Review the Active Directory logs for related events.

Answer

Reset the krbtgt account password twice.

Answer

Investigate the source IP address of the authentication attempt.

Question 13

During a ransomware incident, you need to prevent the encryption of files on a server running Windows Server 2022. You have Microsoft Defender for Endpoint Plan 2. Which attack surface reduction rule should you enable?

Accepted Answer

Use advanced protection against ransomware. The 'Use advanced protection against ransomware' attack surface reduction (ASR) rule specifically targets ransomware behavior by blocking untrusted processes from writing to protected folders, such as those defined in Controlled Folder Access (CFA). This rule is designed to prevent file encryption during a ransomware incident, aligning with the scenario's requirement to protect files on a Windows Server 2022 with Microsoft Defender for Endpoint Plan 2.

Answer

Block executable files from running unless they meet a prevalence, age, or trusted list criterion

Answer

Block credential stealing from the Windows local security authority subsystem

Answer

Block Adobe Reader from creating child processes

Question 14

Which TWO actions can be performed using Microsoft Sentinel's automation rules? (Choose two.)

Accepted Answer

Change the severity of an incident.. Option B is correct because automation rules in Microsoft Sentinel can modify incident properties, including changing the severity level of an incident. Option C is correct because automation rules support assigning an incident owner, allowing analysts or teams to be set as the owner. Option D is correct because automation rules can trigger a playbook (Logic App) as an action when the rule conditions are met. Option A is not correct because blocking an IP in Azure Firewall is an action performed by a playbook, not directly by an automation rule. Option E is not correct because running a KQL query against a Log Analytics workspace is an analytics rule or playbook activity, not an automation rule action.

Answer

Block an IP address in Azure Firewall.

Answer

Run a KQL query against a Log Analytics workspace.

Question 15

Which THREE are valid containment actions in Microsoft Defender for Endpoint? (Choose three.)

Accepted Answer

Contain device. In Microsoft Defender for Endpoint, 'Contain device' (B) is a valid containment action that restricts a device to only essential network traffic while allowing Defender to continue communicating with it, preventing lateral movement during an active incident. 'Run antivirus scan' (C) is a valid response action available from the device page that triggers a Microsoft Defender Antivirus scan (quick or full) to detect and remediate threats on the endpoint. 'Isolate device' (E) is a valid containment action that cuts the device off from the network entirely (full isolation) or selectively (selective isolation) to stop an ongoing attack. 'Reset password' (A) is not a Defender for Endpoint device action — it is an identity/Active Directory operation, not offered as a containment action on the device. 'Collect investigation package' (D) is a valid action but it is an investigation/forensics action, not a containment action, so it does not belong in this list.

Answer

Reset password

Answer

Collect investigation package