SC-200 Respond to security incidents Practice Test 12 — 15 Questions

Question 1

A SOC analyst is investigating an incident where a user's credentials were compromised. The analyst uses Microsoft Sentinel to find all activities performed by the user in the last 24 hours. Which data source should the analyst query FIRST to get the most comprehensive view of the user's actions across Microsoft 365?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

OfficeActivity. OfficeActivity (Option B) is the correct first query because it captures user actions across Exchange Online, SharePoint Online, OneDrive for Business, Teams, and other Microsoft 365 workloads via the unified audit log. This provides the most comprehensive view of a user's activities—including email sends, file accesses, and Teams messages—within the last 24 hours, which is essential for investigating compromised credentials.

Answer

DeviceEvents

Answer

AzureActivity

Answer

SigninLogs

Question 2

During a security incident, you need to block a malicious IP address at the network level for all Azure resources in a subscription. You have Azure Firewall deployed. What is the MOST efficient method to implement the block?

Accepted Answer

Use Azure Firewall Manager to create a global deny rule for the IP address across all firewalls.. Azure Firewall Manager provides centralized management of Azure Firewall policies across multiple firewalls, allowing you to create a global deny rule that applies to all firewalls in a subscription. This is the most efficient method because it avoids configuring individual firewalls or NSGs, and it ensures consistent enforcement at the network level for all Azure resources.

Answer

Block the IP using Microsoft Defender for Cloud's adaptive network hardening.

Answer

Create a network security group (NSG) rule on each virtual network subnet to deny the IP.

Answer

Add a rule to the Azure Firewall policy to deny outbound traffic to the IP address.

Question 3

Your organization uses Microsoft Defender for Endpoint. An endpoint is detected as infected with a trojan. The analyst needs to isolate the device from the network while preserving forensic data. What action should the analyst take?

Accepted Answer

Initiate the 'Isolate device' action from the Microsoft Defender XDR portal.. The 'Isolate device' action in Microsoft Defender XDR (formerly Microsoft 365 Defender) disconnects the device from all network traffic except the Defender for Endpoint service, preserving forensic data on the device while preventing the trojan from communicating with command-and-control servers. This action uses a built-in network isolation mechanism that blocks inbound and outbound connections at the OS level, ensuring the device remains accessible for investigation and remediation.

Answer

Remove the device from the Active Directory domain.

Answer

Disable the network adapter on the device.

Answer

Perform a full reimage of the device.

Question 4

Which TWO actions should an analyst take when triaging a Microsoft Sentinel incident that involves a user who clicked a malicious link in a phishing email? (Choose two.)

Accepted Answer

Run a KQL query on EmailEvents to identify the email and recipient.. Option C is correct because running a KQL query against the EmailEvents table in Microsoft Sentinel (or Advanced Hunting) lets the analyst locate the exact phishing message and confirm the recipient, delivery time, and network message ID, which is essential for scoping the incident. Option E is correct because Microsoft Defender for Office 365 Threat Explorer provides the email's current status (e.g., delivered, blocked, quarantined) and allows further investigation such as viewing the message header, URL detonation results, and related campaigns. Option A is not the right first triage action because a password reset is only warranted if credential compromise is confirmed, and doing it blindly can disrupt the user without addressing the email threat. Option B is not appropriate during triage because blocking the sender's domain tenant-wide is a containment/remediation step that should follow confirmation of the malicious domain and may cause false positives. Option D is also not a triage action; deleting the email is remediation, and it should be performed after confirming the message is malicious and after preserving evidence for the investigation.

Answer

Reset the user's password immediately.

Answer

Block the sender's domain in the tenant's block list.

Answer

Delete the email from the user's mailbox immediately.

Question 5

Which THREE are valid data connectors in Microsoft Sentinel for ingesting security events from Microsoft 365 services? (Choose three.)

Accepted Answer

Microsoft 365 Defender. Microsoft 365 Defender is a valid data connector in Microsoft Sentinel that ingests alerts and incidents from Microsoft 365 Defender components (Microsoft Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps). It uses the Microsoft 365 Defender API to pull correlated security events, enabling centralized investigation of advanced threats across the M365 ecosystem.

Answer

Microsoft Purview

Answer

Microsoft Intune

Question 6

Which TWO are valid incident management actions in Microsoft Sentinel? (Choose two.)

Accepted Answer

Change the incident status to 'Closed'. Changing an incident's status to 'Closed' is a standard incident management action in Microsoft Sentinel. This action finalizes the incident after investigation and remediation, and it is a core part of the incident lifecycle within the Sentinel workspace.

Answer

Merge two incidents into one

Answer

Export the incident to a CSV file

Answer

Delete an incident

Question 7

A SOC analyst needs to investigate a potential data exfiltration incident involving a user uploading files to an external cloud storage service. Which Microsoft Sentinel data source would provide the MOST relevant information?

Accepted Answer

OfficeActivity. OfficeActivity (D) is the correct data source because it captures audit logs from Microsoft 365 services, including SharePoint Online, OneDrive for Business, and Exchange Online. These logs record file uploads, downloads, and sharing events, making them the most relevant for investigating data exfiltration to external cloud storage services like OneDrive or SharePoint.

Answer

SigninLogs

Answer

CommonSecurityLog

Answer

AzureActivity

Question 8

Your organization uses Microsoft Defender for Cloud to monitor hybrid workloads. You receive an alert that a fileless malware attack was detected on an on-premises server connected via Azure Arc. The server is running Windows Server 2019. What is the BEST action to contain the threat?

Accepted Answer

Run a script via Azure Arc to disable the network interfaces on the server.. Disabling the network interfaces via Azure Arc immediately cuts off the compromised server's network connectivity, preventing lateral movement or data exfiltration by the fileless malware. Since fileless malware operates in memory and may not leave persistent artifacts, containment via network isolation is the fastest and most effective initial response.

Answer

Apply a security update using Azure Update Manager.

Answer

Use Azure Automation runbook to restart the server.

Answer

Uninstall the Azure Arc agent from the server to isolate it.

Question 9

Your organization uses Microsoft Defender for Cloud Apps. A security analyst receives an alert for a suspicious sign-in from an IP address in a sanctioned app. The analyst needs to immediately block the user from accessing the app. Which action should the analyst take?

Accepted Answer

Suspend the user account in Microsoft Entra ID.. Suspending the user account in Microsoft Entra ID immediately revokes all access tokens and prevents the user from authenticating to any app, including the sanctioned app. This is the fastest way to block access because it disables the user's ability to sign in entirely, regardless of the app or IP address. Defender for Cloud Apps alerts often require immediate containment, and account suspension is a direct, irreversible action that stops all ongoing sessions.

Answer

Add the IP address to the blocked IP list in Defender for Cloud Apps.

Answer

Create a new access policy in Defender for Cloud Apps to block the user.

Answer

Revoke the user's session tokens in Microsoft Entra ID.

Question 10

You are investigating a ransomware incident in Microsoft Sentinel. The incident contains multiple alerts from Microsoft Defender for Endpoint, Microsoft Defender for Office 365, and Microsoft Defender for Identity. You need to correlate the alerts and identify the initial entry point. Which KQL function should you use to combine the alerts?

Accepted Answer

make_set(). D is correct because `make_set()` is used with `summarize` to create a distinct list of values from a column across multiple rows, which is essential for correlating alerts from different data sources (e.g., DeviceEvents, EmailEvents, IdentityLogonEvents) by a common identifier like `DeviceName` or `AccountUpn`. This allows you to group alerts from Defender for Endpoint, Office 365, and Identity into a single row per entity, making it easier to trace the initial entry point by analyzing the timeline of distinct alert types.

Answer

materialize()

Answer

union

Answer

mv-expand

Question 11

A security analyst receives a Microsoft Defender for Cloud Apps alert about a user performing unusual file downloads from SharePoint. The analyst needs to investigate the user's activity in the last 24 hours. Which log source should the analyst query first?

Accepted Answer

Cloud App Security logs in Microsoft Sentinel. D is correct because Cloud App Security logs in Microsoft Sentinel provide the most granular and immediate visibility into user activities within Microsoft Defender for Cloud Apps, including file downloads from SharePoint. These logs capture detailed metadata such as file names, download counts, and user IP addresses, enabling the analyst to quickly identify anomalous behavior without needing to correlate across multiple data sources.

Answer

Microsoft Entra ID sign-in logs

Answer

Microsoft Intune device logs

Answer

Office 365 audit logs

Question 12

Your organization has Microsoft Defender XDR enabled. An incident is generated for a user who clicked a phishing link in an email. The analyst needs to automatically disable the user's mailbox for suspicious activity. Which automated action should the analyst configure in a Microsoft Sentinel automation rule?

Accepted Answer

Run a playbook that uses the Microsoft 365 Defender connector to disable the mailbox.. The goal is to disable the user's mailbox, which is a Microsoft 365 Exchange Online action. A Microsoft Sentinel automation rule can trigger a playbook that uses the Microsoft 365 Defender connector to execute the 'Disable mailbox' action directly against Exchange Online, effectively suspending the user's ability to send or receive email. This aligns with the requirement to automatically respond to a phishing incident by disabling the compromised mailbox.

Answer

Run a playbook that deletes the phishing email from the user's inbox.

Answer

Configure an automation rule to block the sender IP address in Defender for Cloud Apps.

Answer

Run a playbook that resets the user's password.

Question 13

A security analyst needs to contain a compromised device that is spreading malware in the network. The device is enrolled in Microsoft Intune and managed by Microsoft Defender for Endpoint. What is the fastest way to isolate the device from the network?

Accepted Answer

Use Microsoft Defender for Endpoint to initiate device isolation.. Microsoft Defender for Endpoint provides a dedicated 'Device isolation' action that immediately blocks all network traffic to and from the device while maintaining connectivity to the Defender service for management and monitoring. This is the fastest containment method as it can be triggered directly from the Defender portal without requiring additional configuration or user interaction.

Answer

Disable the device in Microsoft Intune.

Answer

Perform a remote wipe of the device from Microsoft Intune.

Answer

Block the user's account in Microsoft Entra ID.

Question 14

During an incident investigation, you discover that an attacker used a legitimate account to access sensitive data in Microsoft Purview Information Protection. You need to identify what data was accessed and by whom. Which log source should you query?

Accepted Answer

Microsoft Purview data access logs. Microsoft Purview data access logs (option B) are the correct source because they specifically record when users access sensitive data labeled with Microsoft Purview Information Protection, including details about what data was accessed and by whom. Unlike other logs, these capture data-level access events such as viewing, downloading, or modifying protected documents, which is essential for investigating an attacker using a legitimate account to exfiltrate sensitive information.

Answer

Microsoft 365 Defender alerts

Answer

Microsoft Entra ID sign-in logs

Answer

Office 365 audit logs (unified audit log)

Question 15

Your organization uses Microsoft Sentinel with Fusion and Microsoft Security incident creation rules. You receive a high-severity incident from Microsoft Defender for Cloud Apps. The incident has a low confidence score. What should you do first?

Accepted Answer

Validate the alert by correlating with other logs.. A low confidence score indicates the alert may be a false positive, but it should not be dismissed without investigation. In Microsoft Sentinel, low confidence alerts from Defender for Cloud Apps require validation through correlation with other logs (e.g., Microsoft Entra ID sign-ins, network logs) to confirm malicious activity before taking action. This aligns with the incident response process of triage and verification, not immediate dismissal or suppression.

Answer

Dismiss the incident as a false positive due to low confidence.

Answer

Suppress all future alerts from Defender for Cloud Apps with low confidence.

Answer

Escalate the incident to the SOC manager immediately.