SC-200 Respond to security incidents Practice Test 11 — 15 Questions

Question 1

Your organization uses Microsoft Sentinel with UEBA (User and Entity Behavior Analytics). An alert indicates a user's sign-in from an unusual location, followed by a mass download of sensitive files from SharePoint. The user is a low-privilege employee. What is the most likely conclusion?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The user's account is compromised. The combination of an unusual-location sign-in followed immediately by mass SharePoint downloads from a low-privilege account is the classic UEBA signature of credential compromise: an attacker authenticates with stolen credentials and exfiltrates data the account can reach. A low-privilege user has no legitimate business reason to suddenly download large volumes of sensitive files from a new geography, so the behavior deviates sharply from the account's established baseline. Microsoft Sentinel's UEBA correlates the anomalous sign-in with the abnormal data-access activity to surface this as a high-confidence compromise indicator.

Answer

The alert is a false positive due to user travel

Answer

The user is an insider threat

Answer

The user is conducting a ransomware attack

Question 2

In Microsoft Sentinel, an incident is created from a Fusion rule that correlates multiple alerts. The incident has a high severity. What should the analyst do first?

Accepted Answer

Triage the incident by reviewing the evidence. The first step in incident response within Microsoft Sentinel is to triage the incident by reviewing the evidence. A Fusion rule correlates multiple alerts into a single incident, and the analyst must examine the correlated alerts, entities, and timeline to validate the incident's legitimacy and understand the scope before taking any action. Automated playbooks or escalations should only occur after triage confirms the incident is a genuine threat.

Answer

Run an automated playbook to contain the threat

Answer

Close the incident as false positive

Answer

Escalate the incident to senior management

Question 3

You are responding to an incident where a user's credentials were used to access a federated SaaS application from an IP address associated with a known threat actor. The user's account is not disabled. Which action is most effective to prevent further unauthorized access?

Accepted Answer

Reset the user's password and revoke active sessions. Resetting the user's password and revoking active sessions immediately invalidates the compromised credentials and terminates any existing authenticated sessions, including the session used by the threat actor. This directly addresses the root cause—credential compromise—without unnecessarily disrupting the user's account permanently. In a federated SaaS scenario, password reset combined with session revocation ensures the threat actor cannot re-authenticate even if they possess the previous password hash or tokens.

Answer

Create a Conditional Access policy to block the IP

Answer

Disable the user's account

Answer

Block the source IP address on the firewall

Question 4

During an incident response, you need to collect forensic data from Microsoft Defender for Endpoint (MDE) on a remote device that is currently offline. What is the best approach?

Accepted Answer

Initiate a live response session when the device comes online. When a device is offline, Microsoft Defender for Endpoint cannot establish a live response session because the device must be connected to the MDE service to execute commands. Initiating a live response session when the device comes online is the best approach because it allows you to run forensic collection commands (e.g., 'getfile', 'run') directly on the device via the MDE API, without requiring manual intervention or additional infrastructure.

Answer

Wait until the device is online and then collect manually

Answer

Run a remotely scheduled antivirus scan

Answer

Collect the data from the device's cloud store

Question 5

An incident in Microsoft Sentinel involves a phishing campaign that delivered a malicious macro-enabled document. The document was opened by 15 users. Which playbook action should be triggered automatically to contain the threat?

Accepted Answer

Block the file hash using Microsoft Defender for Endpoint. The automatic playbook action should block the file hash at the endpoint to prevent further execution. Isolating devices may be too aggressive. Blocking sender IP is not effective against phishing. Disabling user accounts is not direct.

Answer

Isolate all affected devices from the network

Answer

Block the sender's IP address on the email gateway

Answer

Disable the user accounts of those who opened the document

Question 6

An analyst creates a playbook in Microsoft Sentinel to automatically block an IP address when an alert fires. However, the playbook fails to block the IP. What is the most likely cause?

Accepted Answer

The IP address is being extracted from an incorrect field in the alert. The most likely cause is that the playbook is extracting the IP address from an incorrect field in the alert. In Microsoft Sentinel, playbooks use the SecurityAlert schema, where the IP address may be stored in different fields (e.g., 'RemoteIP', 'SourceIP', 'DestinationIP') depending on the alert provider. If the playbook references the wrong field, it will pass a null or incorrect value to the block action, causing the automation to fail silently or target the wrong entity.

Answer

The block duration is set to one day, which is too short

Answer

The playbook actions array has only one action, which is insufficient

Answer

The playbook is using the wrong trigger type; it should be on incident creation

Question 7

You run the above KQL query in Microsoft Sentinel to identify ransomware alerts from the last day. The result shows zero rows. Which is the most likely reason?

Accepted Answer

No alerts with 'ransomware' in the name occurred in the last day. The KQL query filters for alerts where the name contains 'ransomware'. If no such alerts were generated in the last day, the query returns zero rows. This is the most likely reason because the query logic is correct, and the absence of data is a valid outcome, not an error.

Answer

The table name 'SecurityAlert' is incorrect; it should be 'Alert'

Answer

The user does not have permission to access the SecurityAlert table

Answer

The time filter of 1 day is too restrictive; need to increase range

Question 8

An administrator creates a Microsoft Defender for Cloud Apps policy to block unsanctioned cloud storage apps. Despite the policy, users can still access these apps. What is the most likely cause?

Accepted Answer

The policy mode is set to 'Monitor', which only alerts and does not block. When a Microsoft Defender for Cloud Apps policy is set to 'Monitor' mode, it only generates alerts and does not enforce any blocking action. To actually block unsanctioned cloud storage apps, the policy must be configured with a 'Block' action type, typically in conjunction with a 'Governance' action that applies the block at the proxy or API level. The 'Monitor' mode is designed for detection and logging, not enforcement.

Answer

The action type 'Block' is incorrect; it should be 'Alert'

Answer

The policy requires a 'Device' filter to apply to all users

Answer

The filter uses 'Unsanctioned' tag, but apps are tagged 'Sanctioned'

Question 9

Which TWO actions are appropriate when responding to a confirmed data exfiltration incident via email?

Accepted Answer

Block the recipient domain on the email gateway. Blocking the recipient domain on the email gateway (A) is appropriate because it immediately prevents further data exfiltration to that external domain by rejecting all outbound emails to that domain at the transport layer. Placing a legal hold on the user's mailbox (B) preserves all mailbox content, including deleted items, as an immutable copy for forensic investigation and potential legal proceedings, ensuring evidence is not lost during the incident response.

Answer

Disable the user's account immediately

Answer

Delete all sent items from the user's mailbox

Answer

Run a full antivirus scan on the user's device

Question 10

Which THREE steps should be included in a Microsoft Sentinel playbook for automatic incident response when a high-severity alert fires?

Accepted Answer

Investigate the alert by enriching with threat intelligence. Microsoft Sentinel playbooks, built on Azure Logic Apps, can automatically enrich alerts with threat intelligence from sources like the Threat Intelligence API or integrated TI platforms (e.g., VirusTotal, AlienVault OTX). This enrichment provides context (e.g., known malicious IPs, hashes, or domains) directly within the incident, enabling faster triage and informed response decisions without manual investigation.

Answer

Pause the incident for 24 hours before taking action

Answer

Create a new Azure resource for logging

Question 11

A security analyst receives a high-severity alert for a suspicious login from an unusual location. The alert was generated by Microsoft Sentinel from Microsoft Entra ID sign-in logs. The analyst needs to determine if the login was successful and if any data exfiltration occurred. What is the MOST efficient first step?

Accepted Answer

Run a KQL query in Microsoft Sentinel to review the SigninLogs table for the user within the alert time range.. The most efficient first step is to run a KQL query in Microsoft Sentinel against the SigninLogs table for the specific user within the alert time range. This directly confirms whether the suspicious login was successful by checking the 'ResultType' and 'ResultDescription' fields, which is the fastest way to validate the alert's core claim before investigating data exfiltration.

Answer

Use Microsoft Defender XDR to check the user's device timeline for suspicious activity.

Answer

Run a KQL query in Microsoft Sentinel to check Microsoft Defender for Cloud Apps alerts for the user.

Answer

Check the firewall logs in Azure Firewall for outbound connections from the user's IP.

Question 12

A security team is investigating a ransomware incident that encrypted files on several Windows servers. Microsoft Defender for Endpoint detected the ransomware but the initial infection vector is unknown. Which KQL query in Microsoft Sentinel would BEST identify the initial process that executed the ransomware?

Accepted Answer

DeviceProcessEvents | where FileName contains 'ransomware.exe' | project DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, Timestamp. DeviceProcessEvents captures process creation events, and by filtering for the ransomware executable and projecting the InitiatingProcessFileName and InitiatingProcessCommandLine, you can trace back to the parent process that launched the ransomware. This directly identifies the initial infection vector, which is the core goal of the investigation.

Answer

DeviceNetworkEvents | where RemoteUrl contains 'malicious' | project DeviceName, RemoteIP, Timestamp

Answer

DeviceFileEvents | where FileName contains 'ransomware.exe' | project DeviceName, ActionType, Timestamp

Answer

DeviceEvents | where ActionType == 'RansomwareDetection' | project DeviceName, Timestamp

Question 13

You have a Microsoft Sentinel analytical rule with the above configuration. During a security incident, multiple high-severity alerts are generated within a 5-minute window. How does the rule handle these alerts?

Accepted Answer

Alerts with the same entities are grouped into a single incident.. The analytical rule is configured with 'Group alerts into incidents by: Grouping alerts into a single incident based on matching entities.' This means that when multiple high-severity alerts are generated within a 5-minute window, the rule evaluates the entities (e.g., IP addresses, user accounts) in each alert. If the alerts share the same entities, they are grouped into a single incident, preventing alert flooding and consolidating related security events.

Answer

Only the first alert creates an incident; subsequent alerts are ignored.

Answer

Each alert creates a separate incident.

Answer

Alerts are suppressed for 5 minutes after the first alert.

Question 14

You are deploying Microsoft Sentinel using the above ARM template parameters. After deployment, you notice that Microsoft Defender for Cloud alerts are not being ingested. What is the MOST likely reason?

Accepted Answer

The 'MicrosoftThreatProtection' connector only ingests Microsoft Defender XDR signals, not Defender for Cloud alerts.. The 'MicrosoftThreatProtection' connector is specifically designed to ingest signals from Microsoft Defender XDR (formerly Microsoft 365 Defender), which includes Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps. It does not ingest Microsoft Defender for Cloud alerts. To ingest Defender for Cloud alerts, you must use the dedicated 'Defender for Cloud' data connector in Microsoft Sentinel. Therefore, deploying only the 'MicrosoftThreatProtection' connector will result in Defender for Cloud alerts not being ingested.

Answer

UEBA is enabled, which conflicts with Defender for Cloud data ingestion.

Answer

The workspace location (eastus) does not support Defender for Cloud connector.

Answer

The workspace name 'sentinel-workspace' is reserved for internal use.

Question 15

Your organization uses Microsoft Defender for Cloud to assess the security posture of Azure subscriptions. You receive an alert that a critical vulnerability exists on a virtual machine. What is the BEST immediate action to validate the alert and contain the threat?

Accepted Answer

Review the alert details in Microsoft Defender for Cloud to identify the vulnerability and follow the remediation steps.. The best immediate action is to review the alert details in Microsoft Defender for Cloud because it provides the specific vulnerability, affected resource, and recommended remediation steps. This validation step ensures you understand the threat before taking containment actions, which is critical for an effective and proportionate response. Defender for Cloud's alerts include contextual information such as severity, MITRE tactics, and remediation guidance, enabling informed decision-making.

Answer

Contact Microsoft support to request a vulnerability assessment.

Answer

Immediately apply the latest security patches to the VM using Azure Update Manager.

Answer

Isolate the VM from the network by applying a network security group rule.