SC-200 Respond to security incidents Practice Test 10 — 15 Questions

Question 1

You are a SOC analyst using Microsoft Sentinel. An incident named 'Suspicious Azure AD sign-in from anonymous IP' is assigned to you. After investigation, you determine that the sign-in was from a known corporate VPN and the user confirmed it was legitimate. The incident contains no other alerts. You need to close the incident and ensure it does not affect future analytics. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set the incident status to Closed, set the classification to Benign, and set the determination to 'Not malicious'.. The incident was triggered by a real sign-in that was later confirmed as legitimate. In Microsoft Sentinel, closing an incident requires a classification (Benign, False positive, or Undetermined) and, for Benign and False positive, a determination. Benign with 'Not malicious' accurately captures that the activity was real but harmless, ensuring correct reporting and avoiding false-positive tagging.

Answer

Set the incident status to Closed, set the classification to False positive, and set the determination to 'Not malicious'.

Answer

Set the incident status to Closed, set the classification to Benign, and set the determination to 'Security testing or authorized activity'.

Answer

Set the incident status to Closed, set the classification to True positive, and set the determination to 'Suspicious but expected'.

Question 2

You are a SOC analyst using Microsoft Defender XDR. An incident has been automatically created from multiple alerts related to a compromised user account. You need to prevent further malicious activity from this user without deleting the account. Which action should you take from the incident's user entity page?

Accepted Answer

Force a password reset and revoke active sessions. The correct action is to force a password reset and revoke active sessions. This directly neutralizes the threat by invalidating the attacker's access tokens and credentials without deleting the account, aligning with the least disruptive containment strategy in Microsoft Defender XDR. Other options either do not stop the attack or are not available as integrated actions from the incident entity page.

Answer

Mark the user as compromised

Answer

Add the user to a restricted access group

Answer

Disable the user account in Microsoft Entra ID

Question 3

You are investigating a ransomware incident in Microsoft Sentinel. The incident includes alerts for file encryption and lateral movement. You need to identify the initial entry point and the compromised accounts used for lateral movement. You have enabled the Microsoft Defender XDR connector and the Microsoft Defender for Identity connector. Which data source should you query to find the compromised accounts and the initial access vector?

Accepted Answer

IdentityLogonEvents table in Microsoft Sentinel. IdentityLogonEvents from Microsoft Defender for Identity provides the authentication telemetry needed to trace lateral movement and identify compromised accounts. By querying this table, you can see logon events, source IPs, and account names, enabling you to reconstruct the attack path and find the initial access vector.

Answer

SecurityAlert table in the Log Analytics workspace

Answer

DeviceEvents table in Microsoft Sentinel

Answer

OfficeActivity table in Microsoft Sentinel

Question 4

You are investigating a compromised user account in Microsoft Sentinel. The account was used to access a sensitive SharePoint site and exfiltrate data. You need to identify all anomalous activities associated with this user across Microsoft 365 and Azure AD, including unusual file access, sign-in locations, and mailbox rule changes. You have UEBA enabled. Which feature should you use to visualize and explore the user's related entities and activities?

Accepted Answer

The User and Entity Behavior Analytics (UEBA) entity page for the user. The UEBA entity page in Microsoft Sentinel is designed to aggregate and highlight anomalous behavior for a specific user or entity. It pulls data from multiple sources, including Microsoft Entra ID sign-ins, Office 365 activities, and Azure resource logs, and uses machine learning to surface deviations. This directly addresses the need to identify all anomalous activities for the compromised user.

Answer

The investigation graph in Microsoft Sentinel

Answer

A custom workbook that queries OfficeActivity and SigninLogs tables

Answer

Advanced hunting in Microsoft Defender XDR with a query for the user's activities

Question 5

You are a Security Operations Analyst using Microsoft Defender for Endpoint. A device in your environment is flagged as having an active 'Suspicious PowerShell' alert. Your manager asks you to perform live response on the device to collect volatile evidence and contain the threat. Which two actions can you perform using a live response session in Microsoft Defender for Endpoint? (Choose two.)

Accepted Answer

Run the 'getfile' command to download a file from the device. Live response in Microsoft Defender for Endpoint provides a command-line interface with a specific set of commands. 'analyze' initiates an antivirus scan, and 'getfile' downloads a file for forensic review. Both are supported live response actions for collecting evidence and detecting additional threats. Isolation and remediation are performed outside live response, and there is no remote desktop or 'remediate' command.

Answer

Run the 'connect' command to establish a remote desktop session

Answer

Run the 'remediate' command to apply automatic remediation

Answer

Run the 'isolate' command to isolate the device from the network

Question 6

You are a SOC analyst responding to a ransomware incident in Microsoft Defender XDR. A device has been isolated, and you have identified the ransomware process. You need to perform remediation actions to contain the threat and prevent further spread. Which two actions can you take directly from the device page in the Microsoft Defender Security Center? (Choose two.)

Accepted Answer

Initiate an automated investigation on the device. From the device page in Microsoft Defender Security Center, you can directly initiate an automated investigation and start a live response session. Both actions are designed for immediate investigation and containment of threats on the device. They allow you to quickly assess and remediate the ransomware without navigating to other sections.

Answer

Block the ransomware's hash in the indicator list

Answer

Reset the user's password in Azure Active Directory

Answer

Delete the device from Microsoft Defender for Endpoint

Question 7

You are a Security Operations Analyst responding to an incident in Microsoft Defender XDR. The incident involves a compromised user account and a malicious email. You need to contain the threat. Which two actions can you perform directly from the incident's evidence and response tab? (Choose two.)

Accepted Answer

Disable the compromised user account. The incident response actions in Microsoft Defender XDR allow analysts to contain threats directly from the incident. For a compromised user account, disabling the account is a key containment step. For a malicious email, soft-deleting it from all recipients removes the immediate threat. These actions are available on the respective entities within the incident.

Answer

Isolate the compromised device from the network

Answer

Reset the compromised user's password

Answer

Block the sender's email address in Exchange Online

Question 8

You are a security analyst in Microsoft Defender XDR. An incident contains several alerts related to a malicious PowerShell script executed on multiple devices. You want to automatically run a predefined action to isolate all affected devices and collect investigation packages. What should you use to achieve this with minimal manual effort?

Accepted Answer

Configure an automated investigation and response (AIR) playbook in Microsoft Defender XDR. Automated investigation and response (AIR) playbooks in Microsoft Defender XDR are designed to automate containment and investigation actions. By configuring a playbook that triggers on incidents containing the relevant alerts, you can automatically isolate affected devices and collect investigation packages. This reduces manual effort and ensures consistent response. Other options either do not automate response actions or are not native to Defender XDR for this scenario.

Answer

Use the Action center to manually isolate each device

Answer

Create a scheduled task in Microsoft Sentinel to run a playbook

Answer

Create a custom detection rule with a response action

Question 9

You are a SOC analyst responding to a phishing incident in Microsoft Defender XDR. The incident includes a malicious email that was delivered to multiple mailboxes. You need to perform remediation actions to remove the threat. Which two actions can you take directly from the incident? (Choose two.)

Accepted Answer

Hard delete the email from all affected mailboxes.. In Microsoft Defender XDR, for a phishing incident involving delivered emails, you can perform remediation actions such as soft delete and hard delete directly from the incident's email entity page. Soft delete moves the email to Deleted Items, while hard delete permanently removes it. Both are valid containment and remediation steps to eliminate the threat from user mailboxes.

Answer

Submit the email to Microsoft for analysis.

Answer

Block the sender domain in Microsoft Defender for Office 365.

Answer

Initiate an automated investigation and response (AIR) playbook.

Question 10

You are a Security Operations Analyst using Microsoft Sentinel. An incident has been created for a suspicious sign-in from an anonymous IP address. You need to assign the incident to a specific analyst and change its status to 'Active'. Which feature should you use?

Accepted Answer

The incident's Overview page in Microsoft Sentinel. Microsoft Sentinel's incident management is performed through the incident's Overview page, where you can assign an owner, change status, and adjust severity. This is the correct interface for the described tasks, allowing analysts to take ownership and track progress.

Answer

The Microsoft Defender XDR portal's Incidents queue

Answer

The Logs blade in Microsoft Sentinel

Answer

The Workbooks blade in Microsoft Sentinel

Question 11

You are a SOC analyst responding to a security incident in Microsoft Defender XDR. The incident involves a compromised device that is communicating with a known malicious IP address. You need to contain the threat. Which two actions can you perform directly from the device entity page in the incident? (Choose two.)

Accepted Answer

Run a full antivirus scan. The two correct actions are isolating the device and running a full antivirus scan. Both are available directly on the device entity page in Microsoft Defender XDR and serve to contain and remediate the threat. Isolation stops communication with the malicious IP, while the antivirus scan identifies and removes malware. Other options are either not available on the device page or do not directly contain the threat.

Answer

Collect an investigation package

Answer

Reset the user's password

Answer

Block the malicious IP address in the firewall

Question 12

You are investigating a security incident in Microsoft Sentinel where a user received a phishing email containing a link to a malicious domain. The link was clicked, but no further actions were observed. Which playbook action should you take immediately to prevent potential lateral movement?

Accepted Answer

Block the malicious domain on the firewall. The user only clicked the link without performing any further actions (e.g., no credential entry or file download). Blocking the malicious domain on the firewall immediately prevents the user or any other host from reaching the domain, stopping potential lateral movement via subsequent connections. This aligns with the principle of containing the threat at the network layer before it can spread.

Answer

Disable the user's account

Answer

Revoke the user's active sessions

Answer

Reset the user's password

Question 13

During a ransomware incident, Microsoft Defender for Cloud Apps alerts indicate that a user is uploading large volumes of data to an external cloud storage provider not approved by your organization. Which two actions should you take first? (Choose two.)

Accepted Answer

Block the unapproved cloud storage app. Blocking the unapproved cloud storage app in Microsoft Defender for Cloud Apps immediately stops the ongoing data exfiltration by preventing further uploads to that external provider. This is a direct, real-time containment action that leverages Defender for Cloud Apps's app governance and conditional access controls to enforce organizational policies without disrupting the user's access to other resources.

Answer

Notify the user about the policy violation

Answer

Initiate a legal hold on the user's data

Question 14

Your security team uses Microsoft Sentinel analytics rules to detect brute-force attacks. A rule triggers when more than 10 failed logins occur within 5 minutes from a single IP. An incident is generated. Which first step should the analyst take?

Accepted Answer

Investigate the incident details. The first step in incident response within Microsoft Sentinel is to investigate the incident details to validate the alert and understand the scope. This aligns with the NIST incident response lifecycle (identification and analysis) and Sentinel's built-in investigation graph, which allows analysts to correlate entities, timelines, and related events before taking any containment action.

Answer

Block the source IP address on the firewall

Answer

Notify the users of the failed login attempts

Answer

Reset passwords for all affected accounts

Question 15

An incident in Microsoft Defender XDR involves a device that is suspected to be infected with ransomware. The device is online and actively encrypting files. Which action should you take to contain the threat?

Accepted Answer

Isolate the device from the network. Isolating the device from the network (Option A) is the correct immediate action because it stops the ransomware from communicating with its command-and-control (C2) server and prevents further lateral movement or encryption of network shares. In Microsoft Defender for Endpoint, device isolation blocks all inbound and outbound traffic at the OS kernel level, while still allowing the device to remain online for forensic analysis and remediation. This containment strategy is critical when the device is actively encrypting files, as it halts the attack's spread without losing the ability to investigate or remediate.

Answer

Disable the user's account

Answer

Run a full antivirus scan on the device

Answer

Collect a memory dump from the device