SC-200 Respond to security incidents Practice Test 11 — 15 Questions

Question 1

You have detected a suspicious PowerShell command running on several workstations. The command appears to be downloading a payload from a known malicious URL. What is the most effective immediate response using Microsoft Defender for Endpoint?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add the URL to the custom threat indicator list in Microsoft Defender for Endpoint.. Adding the URL to the custom threat indicator list in Microsoft Defender for Endpoint is the most effective immediate response because it creates a block indicator that applies to all endpoints in the organization. This action prevents any further downloads from that malicious URL across all workstations, stopping the attack in its tracks without disrupting user productivity or requiring manual intervention on each machine.

Answer

Quarantine the affected workstations.

Answer

Enable attack surface reduction rule to block PowerShell scripts.

Answer

Initiate a Live Response session to investigate each workstation.

Question 2

A security administrator receives an alert from Microsoft Defender for Identity about a suspicious Kerberos ticket request from a domain controller. The alert suggests a possible Golden Ticket attack. Which action should the administrator take to validate the alert?

Accepted Answer

Check the domain controller's Security event log for Event ID 4769 with suspicious attributes.. Event ID 4769 (Kerberos Service Ticket Request) on a domain controller is the authoritative source for validating suspicious ticket requests. In a Golden Ticket attack, the forged ticket often exhibits anomalous attributes such as an unusually long lifetime, a non-existent or disabled user account, or encryption type mismatches (e.g., RC4 when AES is expected). Reviewing this log directly confirms whether the ticket characteristics deviate from normal Kerberos behavior, providing definitive evidence for the alert.

Answer

Review Microsoft Defender for Identity alerts for brute force attempts.

Answer

Reset the krbtgt account password twice.

Answer

Verify if the user account associated with the ticket is disabled.

Question 3

Your organization uses Microsoft Defender for Cloud Apps. You receive an alert that an administrator performed an unusual bulk download from SharePoint. What is the recommended first step to respond?

Accepted Answer

Review the activity log in Defender for Cloud Apps to determine the context.. The recommended first step when investigating an alert in Microsoft Defender for Cloud Apps is to review the activity log to understand the context of the alert. This allows the analyst to determine whether the bulk download is legitimate (e.g., a scheduled backup or migration) or malicious (e.g., data exfiltration). Jumping to containment actions without context can disrupt business operations and potentially alert an attacker.

Answer

Report the activity to Microsoft for further analysis.

Answer

Suspend the administrator's account immediately.

Answer

Block the IP address of the administrator's device.

Question 4

You are investigating a lateral movement incident in Microsoft Defender for Endpoint. The timeline shows that a user's credentials were used from a compromised workstation to access a sensitive server. Which action should you take to contain the incident?

Accepted Answer

Reset the compromised user's password and revoke all active sessions.. The incident involves lateral movement using stolen credentials. Resetting the compromised user's password and revoking all active sessions immediately invalidates the credentials the attacker used, preventing further unauthorized access to any resource, including the sensitive server. This directly addresses the root cause (credential theft) rather than just blocking network paths or isolating a single device.

Answer

Disable the sensitive server's network account.

Answer

Isolate the compromised workstation only.

Answer

Block all network traffic from the compromised workstation to the server.

Question 5

An incident is opened in Microsoft Sentinel for multiple sign-in failures from a single IP address targeting a privileged user account. Which action is most effective in automatically responding to this incident?

Accepted Answer

Create a playbook to block the IP address in the firewall.. The most effective automated response is to block the IP address in the firewall via a playbook, as it directly stops the attack source. Disabling the user account is too broad and may affect legitimate access. Enabling MFA does not stop the current attack. Reporting the IP is not immediate.

Answer

Enable conditional access policy to require MFA for the user.

Answer

Create a playbook to automatically disable the user account.

Answer

Report the IP address to Microsoft for threat intelligence.

Question 6

Which TWO actions are appropriate when responding to a confirmed malware outbreak on multiple workstations identified by Microsoft Defender for Endpoint?

Accepted Answer

Collect investigation packages from the affected devices for analysis.. Collecting investigation packages and isolating affected devices are appropriate response actions. Running a full scan is reactive and not immediate. Resetting passwords may be needed later but not first. Blocking indicators is proactive but doesn't contain already infected devices.

Answer

Add the malware hash to the custom threat indicator list.

Answer

Run a full antivirus scan on all workstations.

Answer

Reset passwords of all users who logged into the affected devices.

Question 7

Which TWO actions should be taken to respond to a potential data exfiltration incident detected by Microsoft Defender for Cloud Apps?

Accepted Answer

Suspend the user account in Microsoft Entra ID.. Suspending the user account in Microsoft Entra ID immediately revokes the user's ability to authenticate, preventing further access to cloud resources and stopping potential data exfiltration. This is a direct containment action that aligns with incident response best practices for compromised accounts.

Answer

Block the IP address of the user's device at the firewall.

Answer

Report the user to Microsoft for investigation.

Answer

Run a full antivirus scan on the user's device.

Question 8

Which THREE steps are part of the incident response process when using Microsoft Sentinel?

Accepted Answer

Investigate the incident using hunting queries and entity timelines.. Investigating an incident using hunting queries and entity timelines is a core step in the Microsoft Sentinel incident response process. After an incident is created, analysts use KQL-based hunting queries to proactively search for related threats and leverage entity timelines to visualize the sequence of events and entity interactions, which is essential for understanding the scope and impact of the incident.

Answer

Identify the incident by creating an analytics rule.

Answer

Report the incident to the security team via email.

Question 9

The KQL query above is used in a Microsoft Sentinel analytics rule. What is the purpose of this rule?

Accepted Answer

Detect brute force attempts against disabled user accounts.. The KQL query filters for sign-in events where the user account is disabled (e.g., StatusCode = 50057 or UserAccountControl flags indicate disabled) and then groups by source IP and user to count failed attempts over a short window. When the count exceeds a threshold, it signals a brute force attack targeting disabled accounts, which is a common post-exploitation or reconnaissance technique. Option C is correct because the rule specifically detects repeated authentication failures against disabled accounts, not just any sign-in attempt or inactivity.

Answer

Detect when a disabled user account attempts to sign in.

Answer

Identify users who have been disabled due to inactivity.

Answer

Monitor sign-in attempts from suspicious IP addresses.

Question 10

The exhibit shows a partial playbook trigger configuration in Microsoft Sentinel. When will this playbook be triggered?

Accepted Answer

When an incident of severity High is created.. The playbook trigger configuration shown in the exhibit specifies that the playbook runs when an incident is created, and it includes a condition that filters for incidents with a severity of High. In Microsoft Sentinel, playbook triggers can be set on incident creation or alert creation, and conditions like severity are evaluated at the time of the trigger event. Here, the trigger is explicitly set to 'When an incident is created' with a severity condition of 'High', so the playbook only fires when a new incident with High severity is created.

Answer

When an incident is updated with severity High.

Answer

When an alert is generated with severity High.

Answer

When any incident is created.

Question 11

The exhibit shows the output of a Microsoft Defender for Endpoint API call to get machine information. What does the isolationStatus value indicate?

Accepted Answer

The device has been isolated from the network.. The isolationStatus value in Microsoft Defender for Endpoint indicates whether a device has been isolated from the network. When the value is 'Isolated', it means the device is blocked from communicating with other devices or the internet, typically as a response to a security incident. Option D is correct because this status directly reflects that the device is isolated from the network.

Answer

The device is healthy and has no issues.

Answer

The device is currently being scanned for malware.

Answer

The device is not isolated and is fully connected.

Question 12

Your organization is using Microsoft Defender for Office 365. A user reports receiving a suspicious email that appears to be from the CEO requesting an urgent wire transfer. You need to investigate the email and take immediate action. What should you do first?

Accepted Answer

Use Threat Explorer in the Microsoft 365 Defender portal to find and delete the email.. Threat Explorer in the Microsoft 365 Defender portal provides the fastest and most direct way to investigate and remediate a specific suspicious email across all mailboxes. It allows you to search for the email by sender, subject, or recipient, and then take immediate action such as soft-delete or hard-delete to remove it from user inboxes. This is the correct first step for an urgent incident response scenario involving a targeted phishing attack.

Answer

Use the Exchange admin center to run a message trace.

Answer

Use the Security & Compliance Center to create a mail flow rule.

Answer

Submit the email to Microsoft for analysis using the Submissions page.

Question 13

Your organization uses Microsoft Sentinel. A security analyst reports that an incident was automatically created for a sign-in from an unfamiliar location, but after investigation, it was determined to be a false positive. You need to reduce similar false positives in the future without affecting legitimate detections. What should you do?

Accepted Answer

Modify the analytics rule query to exclude sign-ins from the specific location.. Modifying the analytics rule query to exclude sign-ins from the specific location directly addresses the false positive at the detection logic level. This ensures that only sign-ins from that location are ignored, while all other unfamiliar location detections remain active, preserving legitimate detections.

Answer

Disable the analytics rule that created the incident.

Answer

Add the location to a watchlist and reference it in the analytics rule.

Answer

Create an automation rule to close similar incidents automatically.

Question 14

Your organization is using Microsoft Defender for Cloud to protect Azure workloads. A critical vulnerability was discovered in a virtual machine that is part of a production application. The vulnerability has a high severity score and is actively being exploited in the wild. You need to respond quickly to mitigate the risk. What is the most effective immediate action?

Accepted Answer

Enable just-in-time (JIT) VM access in Microsoft Defender for Cloud to lock down inbound traffic.. Enabling just-in-time (JIT) VM access in Microsoft Defender for Cloud immediately reduces the attack surface by locking down inbound traffic to the VM, except for approved connections from specific IP addresses and ports. This is the most effective immediate action when a critical, actively exploited vulnerability exists, as it buys time to apply a patch without exposing the VM to further exploitation. Unlike patching, which may require a reboot or cause downtime, JIT access can be enabled in minutes and does not disrupt production traffic for authorized users.

Answer

Apply the vendor patch immediately during business hours.

Answer

Modify the network security group (NSG) to block all inbound traffic to the VM.

Answer

Use the 'Remediate' option in Defender for Cloud to automatically apply the patch.

Question 15

Your organization uses Microsoft Defender XDR. A user reports that their device is behaving erratically, with unexpected pop-ups and high CPU usage. You suspect malware infection. You need to collect forensic data from the device for analysis. What should you do?

Accepted Answer

Initiate a live response session on the device from the Microsoft 365 Defender portal.. Initiating a live response session from the Microsoft 365 Defender portal allows you to remotely connect to the device and perform real-time forensic data collection, such as running scripts, capturing memory dumps, and collecting files, without disrupting the device's state. This is the appropriate method for gathering forensic evidence when malware is suspected, as it provides deep, interactive access for analysis.

Answer

Create a custom detection rule in Microsoft Defender for Endpoint to capture the behavior.

Answer

Offboard the device and re-onboard it to trigger a fresh investigation.

Answer

Run a full antivirus scan using Microsoft Defender Antivirus.