SC-200 Respond to security incidents Practice Test 10 — 15 Questions

Question 1

During an incident response, you need to collect a forensic image of a Windows 10 device managed by Microsoft Intune. Which Microsoft Defender XDR feature should you use?

Accepted Answer

Microsoft Defender for Endpoint Live Response. Microsoft Defender for Endpoint Live Response (Option C) is the correct feature because it provides a remote shell connection to a Windows 10 device, allowing an incident responder to collect a forensic image by running commands such as `getfile` or `putfile` to acquire disk or memory artifacts. This capability is specifically designed for live incident response on Intune-managed endpoints, enabling acquisition of forensic data without requiring physical access or pre-staged imaging tools.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Purview eDiscovery

Answer

Microsoft Sentinel

Question 2

Your organization uses Microsoft Sentinel. An incident is created from a fusion detection that combines multiple signals. You need to ensure that when the incident is resolved, all related alerts are also resolved automatically. What should you do?

Accepted Answer

Create an automation rule triggered when an incident is closed, with the action 'Close alert'. An automation rule triggered when an incident is closed can include the action 'Close alert', which automatically closes all alerts linked to that incident. This ensures that when the incident is resolved, all related alerts are also resolved without manual intervention.

Answer

Create a playbook triggered on incident creation that closes alerts

Answer

Create an automation rule triggered when an alert is created

Answer

Configure the analytics rule to close alerts when the incident is resolved

Question 3

A security analyst in your SOC receives an alert from Microsoft Defender for Cloud Apps indicating that a user downloaded a large number of files from SharePoint in a short time. What is the most likely classification of this activity?

Accepted Answer

Data exfiltration. A sudden, large-volume download of files from SharePoint within a short time window is a classic indicator of data exfiltration. Microsoft Defender for Cloud Apps uses anomaly detection policies to flag such activity based on user baseline behavior, download velocity, and the total number of files accessed, which aligns with the exfiltration phase of the cyber kill chain.

Answer

Ransomware

Answer

Lateral movement

Answer

Privilege escalation

Question 4

Your organization uses Microsoft Sentinel. You need to create an incident response playbook that automatically isolates a compromised device when a high-severity incident is created. The playbook should only run during business hours (9 AM - 5 PM local time). How should you configure this?

Accepted Answer

Add a condition in the playbook to check the current time. Microsoft Sentinel automation rules cannot evaluate conditions based on the time of day (e.g., creation hour). The appropriate method is to add a condition in the playbook itself (Azure Logic Apps) to check the current time and proceed only during business hours. This approach gives you full control over the playbook's execution schedule without relying on unsupported automation rule conditions.

Answer

Configure the analytics rule to only create incidents during business hours

Answer

Use a workbook to schedule the playbook

Answer

Create an automation rule with a condition on the incident creation time

Question 5

Refer to the exhibit. You are reviewing an automation rule in Microsoft Sentinel that triggers a playbook. The rule is not triggering. What is the most likely cause?

Accepted Answer

The condition 'Status equals Active' is incorrect; incidents are created with status 'New'. The automation rule triggers on incident creation, but the condition filters for incidents with Status equals 'Active'. When an incident is created in Microsoft Sentinel, its default status is 'New', not 'Active', so the condition never matches and the playbook does not trigger. Option A is incorrect because an incorrect Logic App resource ID would result in a different error (e.g., resource not found) rather than the rule not triggering. Option B is incorrect because a missing subscription ID would cause the rule to fail entirely, not silently not trigger. Option D is incorrect because the trigger type 'IncidentCreated' is appropriate for this scenario; the issue is the condition, not the trigger type.

Answer

The Logic App resource ID is incorrect

Answer

The subscription ID is missing

Answer

The trigger type should be 'IncidentUpdated' instead of 'IncidentCreated'

Question 6

Your organization uses Microsoft Defender XDR. A security administrator reports that a user's device is showing high severity alerts for 'Tampering with Microsoft Defender Antivirus' but the device is not isolated. You need to ensure that when such alerts occur, the device is automatically isolated in Microsoft Defender for Endpoint. What should you do?

Accepted Answer

Create a custom detection rule in Microsoft Defender XDR. Microsoft Defender XDR's custom detection rules allow you to create automated actions based on specific alert triggers, such as 'Tampering with Microsoft Defender Antivirus'. By configuring a custom detection rule with an automated response action (e.g., 'Isolate device'), you can ensure the device is automatically isolated in Microsoft Defender for Endpoint when the alert occurs, without requiring manual intervention.

Answer

Create an automation rule in Microsoft Sentinel

Answer

Create an endpoint detection and response policy in Microsoft Intune

Answer

Configure an attack surface reduction rule

Question 7

Your organization uses Microsoft Sentinel. An incident has been identified as a false positive. What is the recommended action to prevent similar false positives in the future?

Accepted Answer

Modify the analytics rule to reduce false positives. Modifying the analytics rule addresses the root cause of the false positive by adjusting the rule's query logic, thresholds, or entity mappings to reduce noise. In Microsoft Sentinel, analytics rules define the conditions that generate incidents; tuning these rules (e.g., changing frequency, lookback period, or adding exclusion filters) directly prevents similar false positives from recurring. Simply closing or classifying incidents does not prevent future occurrences, and deleting the rule would remove all detection capability.

Answer

Delete the analytics rule

Answer

Close the incident and set the classification to 'False positive'

Answer

Mark the incident as 'False positive' and add a comment

Question 8

Refer to the exhibit. You are investigating why the query returns only two rows (High and Medium) even though there are Low severity alerts. What is the problem?

Accepted Answer

The case statement does not handle integer severity values. The CASE statement in the query maps integer severity values (3 → 'High', 2 → 'Medium') but does not handle the value 1 (Low). Without an ELSE clause, severity values not explicitly matched (like 1) return NULL, and those rows are filtered out from the results. This explains why only 'High' and 'Medium' rows appear. Option D's statement about a missing default refers to the lack of an ELSE clause, but the root cause is the absence of a WHEN clause for severity 1. The explanation is updated to avoid any contradiction: the CASE statement has no WHEN for 1 and no ELSE, so unmatched values become NULL.

Answer

The order by clause sorts numerically, causing incorrect grouping

Answer

The query does not filter on a specific time range

Answer

The case statement is missing a default value

Question 9

Which TWO actions should you take when responding to a confirmed ransomware incident in Microsoft Defender XDR?

Accepted Answer

Run a full antivirus scan. Running a full antivirus scan (Option A) is a critical containment and remediation step in a confirmed ransomware incident because it detects and removes malicious files, including ransomware binaries and associated artifacts, from affected devices. In Microsoft Defender XDR, a full scan leverages the Microsoft Defender Antivirus engine to inspect all files and running processes, ensuring that the ransomware payload is eliminated from the system. This action helps prevent further encryption or lateral movement by the malware.

Answer

Reset the user's password

Answer

Restore files from backup

Answer

Disable the user account

Question 10

Which THREE actions should be taken when a phishing attack is detected in Microsoft Defender XDR?

Accepted Answer

Report the email as phishing in Microsoft Defender for Office 365. Reporting the email as phishing in Microsoft Defender for Office 365 triggers automated investigation and remediation workflows, including tenant-level block actions and threat intelligence updates. This action directly supports the incident response process by enabling the security team to analyze the phishing attempt and prevent further delivery to other users.

Answer

Run a full antivirus scan on the user's device

Answer

Reset the user's password

Question 11

Which TWO are valid incident classification categories in Microsoft Sentinel?

Accepted Answer

True positive. In Microsoft Sentinel, incident classification categories are used to determine the disposition of an alert. 'True positive' (Option C) is a valid classification indicating that the alert correctly identified a real security threat, and 'False positive' (Option E) is also valid, meaning the alert was triggered incorrectly. These two are part of the standard classification options in Sentinel's incident management.

Answer

Benign positive

Answer

Unknown

Answer

Informational

Question 12

Refer to the exhibit. You are configuring an analytics rule in Microsoft Sentinel. What is the effect of this configuration?

Accepted Answer

Alerts that share all the same entities are grouped into one incident within 5 hours. The configuration groups alerts into a single incident only when they share all the same entities (e.g., same IP, same host, same account) and are generated within a 5-hour window. This is controlled by the 'Group alerts into incidents' settings, specifically the 'Group alerts into a single incident if all entities match' option combined with the 5-hour re-open period. Option C correctly describes this behavior.

Answer

All alerts that share any entity are grouped into one incident

Answer

Each alert creates a separate incident

Answer

Alerts are grouped by alert type

Question 13

Your organization uses Microsoft Sentinel. You need to implement a custom incident response process that requires approval before taking action on an incident. What should you use?

Accepted Answer

Playbook with Microsoft Teams connector for approval. A playbook with a Microsoft Teams connector is the correct choice because it enables an interactive approval workflow directly within Teams. When an incident is triggered, the playbook can send an adaptive card to a Teams channel or user, pause execution until an approval decision is made, and then continue with the next steps based on that decision. This satisfies the requirement for a custom approval process before taking action on an incident.

Answer

Automation rules with conditions

Answer

Watchlist for approval status

Answer

Analytics rule with custom details

Question 14

A security analyst receives an alert from Microsoft Defender for Identity about a suspicious Kerberos ticket request. What is the first step the analyst should take?

Accepted Answer

Validate the alert by checking the user's recent activity. When Microsoft Defender for Identity alerts on a suspicious Kerberos ticket request, the first step is to validate the alert by checking the user's recent activity. This ensures the alert is not a false positive caused by legitimate behavior (e.g., scheduled tasks or application service tickets) before taking any disruptive action. Defender for Identity uses network traffic and event logs to detect anomalies like overpass-the-hash or Kerberoasting, but initial validation prevents unnecessary account lockouts or password resets.

Answer

Disable the user account

Answer

Reset the user's password

Answer

Run a full antivirus scan on the user's device

Question 15

During a ransomware incident, the security team needs to prevent the encryption of files while allowing the investigation to continue. Which feature in Microsoft Defender for Endpoint should be used to achieve this?

Accepted Answer

Controlled folder access.. Controlled folder access (CFA) blocks unauthorized applications from modifying files in protected folders, which is exactly what ransomware does. ASR rules are broader and may not target file encryption specifically. Device isolation disconnects the device from the network but stops the investigation. Custom detection rules are reactive.

Answer

Device isolation.

Answer

Attack surface reduction (ASR) rules.

Answer

Custom detection rules.