SC-200 Respond to security incidents Practice Test 12 — 15 Questions

Question 1

Your organization uses Microsoft Sentinel. You have been asked to configure automated responses to security incidents. Which TWO of the following can be used to automate responses in Microsoft Sentinel?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Playbooks (Azure Logic Apps). Playbooks in Microsoft Sentinel are built on Azure Logic Apps, allowing you to automate complex, multi-step response workflows triggered by security incidents. They can execute actions like blocking IPs, resetting passwords, or enriching alerts with threat intelligence, making them a core automation tool for incident response.

Answer

Workbooks

Answer

Power Automate flows

Answer

Custom connectors

Question 2

Your organization uses Microsoft Defender XDR. A security incident involving a compromised user account has been identified. Which THREE actions should you take to contain and remediate the incident?

Accepted Answer

Disable the user account in Microsoft Entra ID.. Disabling the user account in Microsoft Entra ID is a critical containment step because it immediately prevents the compromised account from authenticating to any Microsoft cloud services, including Exchange Online, SharePoint, and Teams. This action blocks further unauthorized access at the identity level, which is the foundation of the attack vector in a user account compromise. It is a direct and effective way to stop the attacker from using the account for lateral movement or data exfiltration.

Answer

Block all IP addresses that the user has connected from.

Answer

Restore the user's mailbox from a backup.

Question 3

Your organization uses Microsoft Defender for Identity and Microsoft Defender XDR. You receive an alert about a suspicious LDAP query originating from a domain controller. The alert indicates potential use of the DCSync attack technique. What is the most effective immediate action to contain the attack?

Accepted Answer

Disable the account that initiated the suspicious replication request.. The DCSync attack abuses the Directory Replication Service Remote Protocol (MS-DRSR) to impersonate a domain controller and request replication of credentials. Disabling the compromised account that initiated the suspicious LDAP replication request immediately stops the attacker's ability to request further replication, effectively containing the attack at the source without disrupting the entire domain.

Answer

Block all LDAP traffic at the firewall.

Answer

Restart the domain controller to clear any malicious processes.

Answer

Reset the krbtgt account password twice.

Question 4

Your organization uses Microsoft Sentinel. You have been asked to configure automated responses to security incidents. Which TWO of the following can be used to automate responses in Microsoft Sentinel?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Check the connector health page in Microsoft Sentinel.. The connector health page provides status and error messages for data connectors, making it the first place to troubleshoot. Options A, C, and D are less direct or irrelevant to connector issues.

Answer

Check the firewall's syslog server configuration.

Answer

Verify that the workspace is in the correct region.

Answer

Reinstall the Log Analytics agent on the firewall.

Question 5

Your organization uses Microsoft Defender for Cloud Apps. You discover that a user has been accessing sensitive data from an anonymous IP address. The user's account appears to be compromised. You need to prevent further data exfiltration. What should you do?

Accepted Answer

Suspend the user in Microsoft Defender for Cloud Apps.. Suspending the user in Microsoft Defender for Cloud Apps immediately blocks all access to cloud apps monitored by Defender for Cloud Apps, preventing further data exfiltration. Option A is incorrect because disabling the user account in Microsoft Entra ID is a broader action that may affect access to all Microsoft services, but it is not as immediate for cloud app access and does not directly stop an ongoing exfiltration through Defender for Cloud Apps. Option B is incorrect because creating an IP range policy to block the anonymous IP address would only block that specific IP, but the attacker could easily switch to a different IP, and it does not address the compromised user account. Option C is incorrect because changing the user's password and revoking sessions may not stop data exfiltration if the attacker has already established persistent access or if the sessions are not fully terminated; suspending the user in Defender for Cloud Apps is a more direct and effective method to stop access to cloud apps.

Answer

Disable the user account in Microsoft Entra ID.

Answer

Create an IP range policy in Defender for Cloud Apps to block the anonymous IP.

Answer

Change the user's password and revoke sessions.

Question 6

Your organization uses Microsoft Sentinel. You have been asked to configure automated responses to security incidents. Which TWO of the following can be used to automate responses in Microsoft Sentinel?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The event time is in local time, and the query uses UTC, causing events near the boundary to be excluded.. The scheduled analytics rule uses a lookback period of 1 hour, but if the event time is stored in local time while the query uses UTC, events near the hour boundary can be excluded due to time zone offset. Microsoft Sentinel stores events in UTC by default, and the query's time filter (e.g., 'TimeGenerated > ago(1h)') compares against UTC timestamps. If the Windows Security Events are logged in local time and not converted, events occurring just after the hour in local time may fall outside the UTC lookback window, causing them to be missed.

Answer

The query period is too short; it should be 2 hours.

Answer

The rule is using 'Last activity' instead of 'TimeGenerated'.

Answer

There is a 5-minute ingestion delay for Windows events.

Question 7

Your organization uses Microsoft Defender XDR. You receive an alert about a potentially unwanted application (PUA) being installed on a device. The PUA is not blocked by your current policy. You need to prevent future installations of this PUA without affecting other software. What should you do?

Accepted Answer

Create a custom indicator of compromise (IoC) to block the specific file's hash.. Creating a custom indicator of compromise (IoC) with the specific file hash allows you to block only that exact PUA file without affecting other software. This leverages Microsoft Defender for Endpoint's custom IoC capability to override the default PUA detection policy, targeting the specific file hash rather than enabling a broad block on all PUAs.

Answer

Enable blocking of all potentially unwanted applications in the antivirus policy.

Answer

Reset the device to its factory settings.

Answer

Run a full scan on the device to remove the PUA.

Question 8

Your organization uses Microsoft Sentinel and Microsoft Defender XDR (including Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps). You have an incident response team that operates 24/7. Recently, there have been multiple incidents involving users receiving phishing emails that lead to credential theft. The phishing emails are sophisticated and bypass Exchange Online Protection (EOP) and Defender for Office 365's built-in phishing filters. The emails contain links to fake login pages that harvest credentials. Once credentials are stolen, the attacker uses them to sign in from anonymous IP addresses and attempts to access sensitive data in SharePoint Online. You need to design a response strategy that includes automated containment and investigation. The solution must:
- Automatically disable user accounts when a phishing incident is confirmed.
- Automatically trigger an investigation into the user's activity in Microsoft Defender for Cloud Apps.
- Send a notification to the incident response team with a summary of the incident.
- Minimize manual effort.

You have the following components available:
- Microsoft Sentinel with automation rules and playbooks.
- Microsoft Defender XDR with advanced hunting.
- Microsoft Power Automate.

What is the most efficient way to achieve these requirements?

Accepted Answer

Create a playbook in Microsoft Sentinel that uses the Microsoft Graph API to disable the user account in Microsoft Entra ID, trigger an investigation in Microsoft Defender for Cloud Apps, and send an email notification. Associate the playbook with an automation rule that runs when the incident is created.. Creating a playbook in Microsoft Sentinel that uses the Microsoft Graph API to disable the user in Microsoft Entra ID, triggers an investigation in Defender for Cloud Apps, and sends an email notification, then associating it with an automation rule that runs automatically when the incident is created, meets all requirements with minimal manual effort. Option B is correct because it enables automated containment and investigation without manual intervention. Option A is incorrect because Microsoft Defender XDR's automated investigation and response (AIR) does not automatically disable user accounts across all services; it focuses on endpoint remediation. Option C is incorrect because relying on a third-party system via webhook introduces additional complexity and may not integrate seamlessly with Microsoft tools. Option D is incorrect because while Power Automate can be used, creating a playbook directly in Microsoft Sentinel is more tightly integrated and efficient for incident response workflows.

Answer

Use Microsoft Defender XDR's automated investigation and response (AIR) to automatically disable the user account.

Answer

Create an automation rule in Microsoft Sentinel that triggers a webhook to a third-party system, which then disables the user account.

Answer

Configure a Playbook in Power Automate that monitors Microsoft Sentinel incidents and automatically disables the user account.

Question 9

Your organization uses Microsoft Sentinel. You have been asked to configure automated responses to security incidents. Which TWO of the following can be used to automate responses in Microsoft Sentinel?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Run a KQL query in the Logs blade to search the Alert table for the IP.. The Alert table in Microsoft Sentinel logs contains historical alert data, including IP addresses associated with each alert. Running a KQL query against this table allows the analyst to quickly search for the same IP address across all alerts generated in the past 30 days, enabling efficient incident correlation without modifying detection or response configurations.

Answer

Create an automation rule to block the IP address.

Answer

Submit the IP address to Microsoft for threat intelligence.

Answer

Create a new analytics rule to detect the IP address.

Question 10

During an incident response, a security analyst identifies that a user's account was used to access sensitive data from an anomalous location. The analyst needs to immediately prevent further access from that account while preserving forensic data. Which action should the analyst take?

Accepted Answer

Disable the user account in Microsoft Entra ID.. Disabling the user account in Microsoft Entra ID immediately prevents any further authentication or access to resources, including sensitive data, while preserving the account's forensic data (e.g., sign-in logs, audit events) for investigation. This action stops all current and future sessions without deleting the account or its associated data, which is critical for incident response.

Answer

Revoke the user's current sessions in Microsoft Entra ID.

Answer

Block the IP address of the anomalous location in the firewall.

Answer

Enable multi-factor authentication (MFA) for the user.

Question 11

The exhibit shows an automation rule in Microsoft Sentinel. The analyst reports that the playbook is not triggered for high-severity incidents. What is the most likely cause?

Accepted Answer

The rule triggers only on incident creation, not on updates.. The automation rule is configured to trigger 'When incident is created,' which means it only runs the playbook at the moment the incident is first generated. If the incident's severity is updated after creation (e.g., from medium to high), the rule does not re-trigger, so the playbook will not execute for that high-severity incident. This is the most likely cause because the analyst reports that high-severity incidents are not triggering the playbook, and the rule's trigger condition explicitly excludes updates.

Answer

The playbook resource ID is invalid.

Answer

The condition syntax is incorrect.

Answer

The tenant ID is missing.

Question 12

A SOC analyst receives a Microsoft Defender for Cloud Apps alert about a mass download of files from a SharePoint site by a single user. The analyst needs to contain the incident. Which action should be taken first?

Accepted Answer

Suspend the user account in Microsoft Entra ID.. Suspending the user account in Microsoft Entra ID immediately revokes all access tokens and prevents further authentication, stopping the mass download in progress. This is the fastest containment action because it disables the user's ability to access any Microsoft 365 resource, including SharePoint, without waiting for other processes like scanning or notifications.

Answer

Increase the SharePoint download limit.

Answer

Notify the user's manager.

Answer

Run a malware scan on the downloaded files.

Question 13

Your organization uses Microsoft Defender XDR. The incident queue shows multiple alerts related to a single endpoint: malware detected, suspicious PowerShell execution, and data exfiltration attempts. The analyst needs to investigate the incident. Which tool should the analyst use to correlate these events?

Accepted Answer

Advanced hunting in Microsoft Defender XDR.. Advanced hunting in Microsoft Defender XDR allows the analyst to query across multiple data sources—including endpoint detection and response (EDR), identity, email, and cloud app data—using Kusto Query Language (KQL). This enables correlation of the malware detection, suspicious PowerShell execution, and data exfiltration alerts on the same device by joining tables such as DeviceEvents, DeviceProcessEvents, and DeviceNetworkEvents, providing a unified timeline of the attack chain.

Answer

Microsoft Defender for Office 365 Explorer.

Answer

Microsoft Defender for Cloud Apps activity log.

Answer

Microsoft Sentinel incident workspace.

Question 14

The exhibit shows a KQL query used during incident investigation. The analyst wants to identify devices with an unusually high number of outbound connections to public IPs. The query returns no results, though the analyst suspects there should be some. What is the most likely reason?

Accepted Answer

The 'summarize' operator is misused.. The 'summarize' operator in KQL must be followed by an aggregation function (e.g., count(), dcount(), sum(), etc.) to produce a result. In the query, if 'summarize' is used without an aggregation function, it would not output any rows. This is a common mistake. The field 'RemoteIPType' does exist in DeviceNetworkEvents, so option C is incorrect. The timeframe (option A) and data retention (option B) are unlikely to cause zero results in this context.

Answer

The timeframe is too short.

Answer

Data retention for DeviceNetworkEvents is less than 1 day.

Answer

The field 'RemoteIPType' does not exist in DeviceNetworkEvents.

Question 15

A security analyst in Microsoft Sentinel receives an incident with a high severity alert from Microsoft Defender for Identity. The incident description mentions a suspected lateral movement pass-the-hash attack. What should the analyst do first?

Accepted Answer

Isolate the affected device from the network.. The immediate priority in a suspected lateral movement pass-the-hash attack is to contain the threat by isolating the affected device from the network. This prevents the attacker from using the compromised account's NTLM hash to authenticate to other systems, stopping the lateral spread while preserving forensic evidence for further investigation.

Answer

Reset the password of the compromised account.

Answer

Review the Microsoft Defender for Cloud Apps logs.

Answer

Create a new analytics rule to detect pass-the-hash attacks.