SC-200 Respond to security incidents Practice Test 13 — 15 Questions

Question 1

You are investigating a brute force attack on a user account in Microsoft Entra ID. The sign-in logs show multiple failed attempts from different IP addresses. Which property in the sign-in logs indicates the type of authentication used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

authenticationRequirement. The `authenticationRequirement` property in Microsoft Entra ID sign-in logs specifies the type of authentication used for the sign-in attempt, such as single-factor authentication (password), multi-factor authentication, or passwordless authentication. In a brute force attack investigation, this property helps determine whether the failed attempts were against password-based authentication or a more secure method, providing critical context for the attack vector.

Answer

riskEventTypes

Answer

conditionalAccessStatus

Answer

clientAppUsed

Question 2

Which THREE data sources in Microsoft Sentinel can be used to detect lateral movement in a network? (Choose three.)

Accepted Answer

Microsoft Defender for Endpoint (device events). Microsoft Defender for Endpoint (MDE) provides detailed device-level events, including process creation, network connections, and logon sessions. These telemetry points are critical for detecting lateral movement because they reveal anomalous remote logins, service creation, or file execution on multiple endpoints, which are hallmarks of an attacker moving laterally.

Answer

DNS logs

Answer

Microsoft Entra ID sign-in logs

Question 3

Your organization uses Microsoft Sentinel. A security analyst reports that an incident was automatically closed without investigation. You need to identify why the incident was closed automatically. Which Sentinel feature should you review?

Accepted Answer

Automation rules. Automation rules in Microsoft Sentinel allow you to define automated responses to incidents, including automatically closing them based on specific conditions (e.g., severity, title, or entity). If an incident was closed without investigation, an automation rule likely triggered a closure action, such as setting the status to 'Closed' with a specific classification. Reviewing the automation rules list and their trigger conditions will reveal which rule caused the automatic closure.

Answer

Analytics rules

Answer

Playbooks

Answer

Workbooks

Answer

Watchlists

Question 4

During an incident response, you need to collect a memory dump from a compromised Windows 10 device managed by Microsoft Defender for Endpoint. Which action should you take in the Microsoft Defender XDR portal?

Accepted Answer

Initiate a Live Response session and run the 'memdump' command. To collect a memory dump from a compromised Windows 10 device managed by Microsoft Defender for Endpoint, you must initiate a Live Response session and run the 'memdump' command. Live Response provides a remote shell that allows forensic commands like 'memdump' to capture the full memory contents of the target machine, which is essential for analyzing volatile data during incident response. Other options, such as custom detection scripts or automated investigations, do not directly support memory acquisition.

Answer

Run a custom detection script

Answer

Execute a Power Automate flow to collect memory

Answer

Start a full antivirus scan

Answer

Submit the device for automated investigation

Question 5

An incident in Microsoft Sentinel was assigned to you. After investigation, you determine it is a false positive. What should you do to resolve the incident?

Accepted Answer

Close the incident with classification 'FalsePositive'. In Microsoft Sentinel, when an incident is determined to be a false positive, the correct resolution is to close it with the classification 'FalsePositive'. This action properly documents the outcome, updates the incident status to 'Closed', and ensures the incident is tracked for reporting and analytics. Leaving it open or changing status to 'Active' does not resolve it, while deleting is not supported and reassignment does not address the determination.

Answer

Add a comment and leave it open

Answer

Delete the incident

Answer

Reassign to another analyst

Answer

Change the status to 'Active'

Question 6

Refer to the exhibit. You are reviewing an automation rule in Microsoft Sentinel. What will happen when a new incident with severity Medium is created?

Accepted Answer

The rule will not trigger because severity is Medium. The automation rule is configured with a condition that triggers only when the incident severity is 'High'. Since the new incident has a severity of 'Medium', the condition is not met, and the rule does not trigger. Automation rules in Microsoft Sentinel evaluate conditions based on the incident's properties at creation time; if the condition fails, no actions (including playbook execution or incident creation) occur.

Answer

The rule will trigger and create a new incident

Answer

The rule will trigger and run the playbook

Answer

The rule will update the incident severity to High

Answer

The rule will trigger but skip the playbook

Question 7

Your Microsoft 365 tenant is protected by Microsoft Defender for Office 365. A user reports receiving a suspicious email with a link. You need to investigate whether the link was malicious and if any other users clicked it. Which tool should you use first?

Accepted Answer

Threat Explorer. Threat Explorer (Option D) is the correct first tool because it provides a centralized view of email threats, including malicious links and clicks. You can filter by URL or sender to identify if the specific link was detected as malicious and then use the 'Click to allow/block' feature or the 'URL clicks' view to see which users clicked it. This aligns with the incident response workflow for investigating phishing campaigns in Defender for Office 365.

Answer

Microsoft Entra ID sign-in logs

Answer

Microsoft Purview compliance portal

Answer

Email Entity page in Microsoft Defender XDR

Answer

Attack Simulation Training

Question 8

Refer to the exhibit. A security analyst runs this PowerShell script to query a Log Analytics workspace. What is the purpose of this query?

Accepted Answer

Detect suspicious PowerShell activity using encoded commands. The PowerShell script uses the `| where {$_ -match 'powershell.*-enc'} ` filter to search for command lines containing 'powershell' followed by '-enc', which is the alias for the `-EncodedCommand` parameter. This parameter is commonly used by attackers to obfuscate malicious PowerShell commands by passing them as a Base64-encoded string. The query is specifically designed to detect suspicious PowerShell executions that use encoded commands, making option D correct.

Answer

Count the number of unique devices

Answer

Identify all PowerShell executions in the last 7 days

Answer

List all processes run by a specific account

Answer

Find devices that have not run PowerShell recently

Question 9

During an incident, you need to isolate a compromised device from the network while allowing communication with Microsoft Defender for Endpoint cloud services. Which isolation type should you choose in Microsoft Defender XDR?

Accepted Answer

Selective isolation. Selective isolation (E) is the correct choice because it restricts network communication to only Microsoft Defender for Endpoint cloud services, blocking all other inbound and outbound traffic. This allows the compromised device to remain manageable and receive security updates while preventing lateral movement and further compromise. Full isolation would block all network traffic, including Defender services, rendering the device unmanageable.

Answer

Controlled folder access

Answer

Network protection

Answer

Block file

Answer

Full isolation

Question 10

Your organization uses Microsoft Defender for Cloud Apps. You receive an alert about an impossible travel activity for a user. What is the best first step to validate if this is a true positive?

Accepted Answer

Review the user's sign-in logs in Microsoft Entra ID. Impossible travel alerts in Microsoft Defender for Cloud Apps are generated based on sign-in activity and user location data. The most direct way to validate whether the alert is a true positive is to review the user's sign-in logs in Microsoft Entra ID (formerly Azure AD), which provides detailed information about each sign-in attempt, including IP addresses, locations, timestamps, and authentication details. This allows you to confirm whether the two sign-ins occurred within an unrealistic time frame for the geographic distance, or if there are anomalies such as VPN usage or IP spoofing that indicate a false positive.

Answer

Block the user immediately

Answer

Run an advanced hunting query in Microsoft Sentinel

Answer

Contact the user's manager

Answer

Check the user's device compliance in Microsoft Intune

Question 11

During an incident investigation in Microsoft Sentinel, you need to gather related events from multiple data sources into a single view for analysis. Which feature should you use?

Accepted Answer

Investigation graph. The Investigation graph in Microsoft Sentinel is specifically designed to visually correlate and explore related entities and events across multiple data sources within a single investigation. It allows you to pivot from an alert or entity to see connected users, hosts, IP addresses, and other events, providing a unified view for analysis. This feature directly addresses the need to gather related events from disparate sources into one cohesive view during incident response.

Answer

Workbooks

Answer

Watchlists

Answer

Logs blade

Answer

Analytics rules

Question 12

Refer to the exhibit. You are deploying this analytics rule in Microsoft Sentinel. Which activity will trigger an alert?

Accepted Answer

Word launching cmd.exe. The analytics rule is configured to trigger an alert when a process creation event (Event ID 4688) has a parent process of 'winword.exe' and a child process of 'cmd.exe'. This specific parent-child relationship indicates that Microsoft Word is launching a command prompt, which is a common technique used in malicious documents to execute commands. The rule's query filters for 'ParentImage' containing 'winword.exe' and 'Image' containing 'cmd.exe', so only when Word launches cmd.exe will the alert fire.

Answer

cmd.exe launching winword.exe

Answer

Any process creation event

Answer

Winword.exe execution

Answer

Any cmd.exe execution

Question 13

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. During an incident investigation, you find that a device is exfiltrating data to an external IP. You need to isolate the device from the network using automated response. Which action should you configure in an automation rule?

Accepted Answer

Run a playbook that triggers a Microsoft Defender for Endpoint 'Isolate device' action.. The scenario requires network isolation of a device that is actively exfiltrating data. Microsoft Defender for Endpoint provides a built-in 'Isolate device' action that can be triggered via a playbook from a Microsoft Sentinel automation rule. This action immediately blocks all inbound and outbound network traffic to and from the device, except for communication with the Defender for Endpoint service, effectively containing the threat.

Answer

Trigger a Microsoft Purview data loss prevention policy.

Answer

Run a Microsoft Entra ID playbook to disable the device.

Answer

Create an automation rule in Microsoft Intune to wipe the device.

Question 14

You are investigating a ransomware incident in Microsoft Sentinel. The incident contains multiple alerts. You need to group related alerts under the same incident to reduce alert fatigue. What should you do?

Accepted Answer

Configure incident creation rules in the analytics rule.. In Microsoft Sentinel, incident creation is configured directly within the analytics rule. When you create or edit an analytics rule, the 'Incident creation' settings allow you to enable incident generation from alerts triggered by that rule. This ensures that all alerts from the same rule are grouped into a single incident, reducing alert fatigue by preventing multiple separate incidents for related alerts.

Answer

Enable User and Entity Behavior Analytics (UEBA).

Answer

Create a new analytics rule to combine alerts.

Answer

Use an automation rule to merge incidents.

Question 15

You are responding to a phishing incident. The investigation reveals that a user clicked a link in a phishing email and entered credentials on a fake site. You need to contain the incident and prevent further compromise. What should you do first?

Accepted Answer

Reset the user's password and revoke sessions.. The immediate priority when credentials have been compromised is to invalidate them, preventing the attacker from using them for further access. Resetting the password and revoking sessions (e.g., via Microsoft Entra ID 'Revoke-AzureADUserAllRefreshToken' or 'Revoke-MgUserSignInSession') ensures the attacker cannot authenticate again, even if they have the password hash or active tokens. This aligns with the NIST SP 800-61 incident response containment phase.

Answer

Report the phishing site to Microsoft.

Answer

Block the phishing URL in Microsoft Defender for Office 365.

Answer

Delete the phishing email from the user's mailbox.