SC-200 Respond to security incidents Practice Test 13 — 15 Questions

Question 1

Your organization uses Microsoft Sentinel. You have a scheduled analytics rule that queries Windows Security Events to detect local admin group modifications. The rule runs every hour and looks back 1 hour. However, you are missing events that occur within the first few minutes of the hour. What is the most likely cause?

Accepted Answer

The event time is in local time, and the query uses UTC, causing events near the boundary to be excluded.. By default, Sentinel uses UTC time, but the Windows event time may be in local time. If the local time is ahead of UTC, events near the hour boundary may fall outside the query period due to time conversion. Option A is incorrect because ingestion delay is usually not minutes. Option C is incorrect because the query period is already 1 hour. Option D is incorrect because the rule's schedule should capture events within the lookback period.

Answer

The query period is too short; it should be 2 hours.

Answer

The rule is using 'Last activity' instead of 'TimeGenerated'.

Answer

There is a 5-minute ingestion delay for Windows events.

Question 2

Your organization uses Microsoft Defender XDR. You receive an alert about a potentially unwanted application (PUA) being installed on a device. The PUA is not blocked by your current policy. You need to prevent future installations of this PUA without affecting other software. What should you do?

Accepted Answer

Create a custom indicator of compromise (IoC) to block the specific file's hash.. Adding the file's SHA-256 hash to the custom indicator allows Defender to block it specifically. Option A is incorrect because blocking all PUAs is too broad. Option C is incorrect because a full scan does not prevent future installations. Option D is incorrect because resetting the device is excessive.

Answer

Enable blocking of all potentially unwanted applications in the antivirus policy.

Answer

Reset the device to its factory settings.

Answer

Run a full scan on the device to remove the PUA.

Question 3

Your organization uses Microsoft Sentinel and Microsoft Defender XDR (including Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps). You have an incident response team that operates 24/7. Recently, there have been multiple incidents involving users receiving phishing emails that lead to credential theft. The phishing emails are sophisticated and bypass Exchange Online Protection (EOP) and Defender for Office 365's built-in phishing filters. The emails contain links to fake login pages that harvest credentials. Once credentials are stolen, the attacker uses them to sign in from anonymous IP addresses and attempts to access sensitive data in SharePoint Online. You need to design a response strategy that includes automated containment and investigation. The solution must:
- Automatically disable user accounts when a phishing incident is confirmed.
- Automatically trigger an investigation into the user's activity in Microsoft Defender for Cloud Apps.
- Send a notification to the incident response team with a summary of the incident.
- Minimize manual effort.

You have the following components available:
- Microsoft Sentinel with automation rules and playbooks.
- Microsoft Defender XDR with advanced hunting.
- Microsoft Power Automate.

What is the most efficient way to achieve these requirements?

Accepted Answer

Create a playbook in Microsoft Sentinel that uses the Microsoft Graph API to disable the user account in Microsoft Entra ID, trigger an investigation in Microsoft Defender for Cloud Apps, and send an email notification. Associate the playbook with an automation rule that runs when the incident is created.. Creating a playbook in Microsoft Sentinel that uses the Microsoft Graph API to disable the user in Microsoft Entra ID, triggers an investigation in Defender for Cloud Apps, and sends an email notification, then associating it with an automation rule that runs automatically when the incident is created, meets all requirements with minimal manual effort. Option B is incorrect because it requires manual triggering. Option C is incorrect because Power Automate is not as tightly integrated as a Sentinel playbook. Option D is incorrect because it still requires manual investigation steps.

Answer

Use Microsoft Defender XDR's automated investigation and response (AIR) to automatically disable the user account.

Answer

Create an automation rule in Microsoft Sentinel that triggers a webhook to a third-party system, which then disables the user account.

Answer

Configure a Playbook in Power Automate that monitors Microsoft Sentinel incidents and automatically disables the user account.

Question 4

Your organization uses Microsoft Sentinel. A security analyst receives an alert for a suspicious sign-in from an unfamiliar IP address. The analyst wants to quickly check if the same IP address has been associated with any other alerts in the past 30 days. Which action should the analyst take?

Accepted Answer

Run a KQL query in the Logs blade to search the Alert table for the IP.. Using KQL to query the Alert table for the specific IP address allows the analyst to quickly find related alerts. Option A is too broad; Option B doesn't involve event correlation; Option D is for automation.

Answer

Create an automation rule to block the IP address.

Answer

Submit the IP address to Microsoft for threat intelligence.

Answer

Create a new analytics rule to detect the IP address.

Question 5

During an incident response, a security analyst identifies that a user's account was used to access sensitive data from an anomalous location. The analyst needs to immediately prevent further access from that account while preserving forensic data. Which action should the analyst take?

Accepted Answer

Disable the user account in Microsoft Entra ID.. Disabling the user account in Microsoft Entra ID stops access immediately and preserves data. Option A only revokes sessions; Option C is too broad; Option D affects all users.

Answer

Revoke the user's current sessions in Microsoft Entra ID.

Answer

Block the IP address of the anomalous location in the firewall.

Answer

Enable multi-factor authentication (MFA) for the user.

Question 6

The exhibit shows an automation rule in Microsoft Sentinel. The analyst reports that the playbook is not triggered for high-severity incidents. What is the most likely cause?

Accepted Answer

The rule triggers only on incident creation, not on updates.. The trigger type 'IncidentCreated' only fires when a new incident is created. If incidents are updated to high severity, they are not created again, so the rule won't trigger. Option B is wrong because the condition is correctly written; Option C is irrelevant; Option D is a possible issue but less likely given the rule is already created.

Answer

The playbook resource ID is invalid.

Answer

The condition syntax is incorrect.

Answer

The tenant ID is missing.

Question 7

A SOC analyst receives a Microsoft Defender for Cloud Apps alert about a mass download of files from a SharePoint site by a single user. The analyst needs to contain the incident. Which action should be taken first?

Accepted Answer

Suspend the user account in Microsoft Entra ID.. Suspending the user in Microsoft Entra ID stops all account activity. Option A doesn't prevent further downloads; Option C is reactive; Option D is for other scenarios.

Answer

Increase the SharePoint download limit.

Answer

Notify the user's manager.

Answer

Run a malware scan on the downloaded files.

Question 8

Your organization uses Microsoft Defender XDR. The incident queue shows multiple alerts related to a single endpoint: malware detected, suspicious PowerShell execution, and data exfiltration attempts. The analyst needs to investigate the incident. Which tool should the analyst use to correlate these events?

Accepted Answer

Advanced hunting in Microsoft Defender XDR.. Advanced hunting in Microsoft Defender XDR allows cross-domain queries (endpoint, identity, email). Option A is for email; Option B is for cloud apps; Option D is a different platform.

Answer

Microsoft Defender for Office 365 Explorer.

Answer

Microsoft Defender for Cloud Apps activity log.

Answer

Microsoft Sentinel incident workspace.

Question 9

The exhibit shows a KQL query used during incident investigation. The analyst wants to identify devices with an unusually high number of outbound connections to public IPs. The query returns no results, though the analyst suspects there should be some. What is the most likely reason?

Accepted Answer

The field 'RemoteIPType' does not exist in DeviceNetworkEvents.. The RemoteIPType field may not exist in DeviceNetworkEvents; the correct field for public IP classification is typically RemoteIP. Option A is possible but less likely; Option C is a syntax error; Option D is about data retention.

Answer

The timeframe is too short.

Answer

Data retention for DeviceNetworkEvents is less than 1 day.

Answer

The 'summarize' operator is misused.

Question 10

A security analyst in Microsoft Sentinel receives an incident with a high severity alert from Microsoft Defender for Identity. The incident description mentions a suspected lateral movement pass-the-hash attack. What should the analyst do first?

Accepted Answer

Isolate the affected device from the network.. Isolating the affected device prevents further lateral movement. Option A is for future detection; Option C is not immediate; Option D is for cloud apps.

Answer

Reset the password of the compromised account.

Answer

Review the Microsoft Defender for Cloud Apps logs.

Answer

Create a new analytics rule to detect pass-the-hash attacks.

Question 11

During a ransomware incident, an analyst needs to identify which files were encrypted on an endpoint. The endpoint is running Windows and is managed by Microsoft Defender for Endpoint. Which data source should the analyst query in Advanced hunting?

Accepted Answer

DeviceFileEvents. DeviceFileEvents tracks file creation, modification, and deletion. Option A is for processes; Option C is for network; Option D is for registry.

Answer

DeviceRegistryEvents

Answer

DeviceNetworkEvents

Answer

DeviceProcessEvents

Question 12

Your organization's Microsoft Sentinel workspace ingests logs from multiple regions. During an incident, you need to search for a specific user's activity across all workspaces in a single query. What is the most efficient way to accomplish this?

Accepted Answer

Use a cross-workspace query with the workspace() expression.. A cross-workspace query using the workspace() expression allows querying multiple workspaces in one KQL query. Option B is manual; Option C is for search; Option D is for analytics.

Answer

Run separate queries in each workspace and combine results manually.

Answer

Create a new analytics rule that queries all workspaces.

Answer

Use the Microsoft Sentinel search feature with the workspace filter.

Question 13

Which TWO actions should be taken immediately when a compromised user account is detected in Microsoft Entra ID?

Accepted Answer

Revoke all current sessions.. Revoking all current sessions (Option A) is a critical immediate action because it terminates all active authentication tokens and sessions for the compromised account, preventing the attacker from continuing to use existing tokens to access resources. This action leverages Microsoft Entra ID's token revocation capabilities, which invalidate refresh tokens and access tokens issued before the revocation, effectively cutting off the attacker's current access without waiting for password changes or other mitigations.

Answer

Notify the user's manager.

Answer

Reset the user's password.

Answer

Block sign-ins from the user's IP address.

Question 14

Which THREE features in Microsoft Sentinel allow an analyst to automate incident response actions?

Accepted Answer

Playbooks (Logic Apps). Automation rules, playbooks (Logic Apps), and analytics rules with automated responses are all automation features. Watchlists are for reference data, not automation. Workbooks are for visualization.

Answer

Watchlists

Answer

Workbooks

Question 15

Which TWO of the following are valid methods to retrieve data from Microsoft Sentinel for external analysis during an incident?

Accepted Answer

Connect Log Analytics workspace to external tools via API.. Export data to Log Analytics workspace for external querying and use the Microsoft Sentinel API to programmatically access data. Option A is not a standard method; Option D is for management; Option E is for visualization.

Answer

Use Microsoft Sentinel PowerShell cmdlets.

Answer

Create a Power BI dashboard.

Answer

Use the Export to CSV feature in the Logs blade.