SC-200 Respond to security incidents Practice Test 13 — 15 Questions

Question 1

During a ransomware incident, an analyst needs to identify which files were encrypted on an endpoint. The endpoint is running Windows and is managed by Microsoft Defender for Endpoint. Which data source should the analyst query in Advanced hunting?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

DeviceFileEvents. DeviceFileEvents is the correct data source because it captures file creation, modification, and deletion events on endpoints. During a ransomware incident, encrypted files are typically created with a new extension or modified in place, and DeviceFileEvents logs these changes, allowing the analyst to identify which files were affected.

Answer

DeviceRegistryEvents

Answer

DeviceNetworkEvents

Answer

DeviceProcessEvents

Question 2

Your organization's Microsoft Sentinel workspace ingests logs from multiple regions. During an incident, you need to search for a specific user's activity across all workspaces in a single query. What is the most efficient way to accomplish this?

Accepted Answer

Use a cross-workspace query with the workspace() expression.. The workspace() expression in Kusto Query Language (KQL) allows you to include data from multiple Log Analytics workspaces in a single query. By specifying the workspace ID or name within the expression, you can search across all relevant workspaces without needing to run separate queries or manually combine results. This is the most efficient method because it executes as a single query against the underlying Azure Data Explorer clusters, minimizing latency and administrative overhead.

Answer

Run separate queries in each workspace and combine results manually.

Answer

Create a new analytics rule that queries all workspaces.

Answer

Use the Microsoft Sentinel search feature with the workspace filter.

Question 3

Which TWO actions should be taken immediately when a compromised user account is detected in Microsoft Entra ID?

Accepted Answer

Revoke all current sessions.. Revoking all current sessions (Option A) is a critical immediate action because it terminates all active authentication tokens and sessions for the compromised account, preventing the attacker from continuing to use existing tokens to access resources. This action leverages Microsoft Entra ID's token revocation capabilities, which invalidate refresh tokens and access tokens issued before the revocation, effectively cutting off the attacker's current access without waiting for password changes or other mitigations.

Answer

Notify the user's manager.

Answer

Reset the user's password.

Answer

Block sign-ins from the user's IP address.

Question 4

Which THREE features in Microsoft Sentinel allow an analyst to automate incident response actions?

Accepted Answer

Playbooks (Logic Apps). Playbooks (Logic Apps) are correct because they provide a library of pre-built or custom workflows that can be triggered by automation rules or analytics rules to execute complex, multi-step incident response actions, such as blocking IPs, isolating hosts, or enriching alerts with threat intelligence. They integrate with Azure services and third-party APIs via connectors, enabling automated remediation without manual intervention.

Answer

Watchlists

Answer

Workbooks

Question 5

Which TWO of the following are valid methods to retrieve data from Microsoft Sentinel for external analysis during an incident?

Accepted Answer

Connect Log Analytics workspace to external tools via API.. The Log Analytics workspace that underpins Microsoft Sentinel exposes a REST API, allowing external tools to query and export data programmatically for analysis. This API supports OAuth 2.0 authentication and can retrieve log data via KQL queries, making it a valid method for external integration during incident response.

Answer

Use Microsoft Sentinel PowerShell cmdlets.

Answer

Create a Power BI dashboard.

Answer

Use the Export to CSV feature in the Logs blade.

Question 6

You are a SOC analyst at Contoso Ltd. The company uses Microsoft Sentinel and Microsoft Defender XDR. A high-severity incident is generated from a Sentinel analytics rule that detects multiple failed logins followed by a successful login from a geographically unusual location for a user. The incident includes an alert from Microsoft Defender for Identity indicating a possible brute-force attack. The user's account is a privileged administrator. Your organization has strict compliance requirements: any privileged account compromise must be contained within 15 minutes of detection. You have the following tools available: Microsoft Entra ID with Privileged Identity Management (PIM), Microsoft Defender for Cloud Apps, and Microsoft 365 Defender automation rules. The incident is now 5 minutes old. What should you do to meet the compliance requirement?

Accepted Answer

Disable the user account in Microsoft Entra ID immediately.. Disabling the account is the fastest containment; PIM may take extra steps; alerting is not containment; policies are slower.

Answer

Create an automation rule in Microsoft 365 Defender to alert the security team.

Answer

Create a conditional access policy to block the user's sign-ins.

Answer

Activate PIM and remove the user's role assignments.

Question 7

Your company uses Microsoft Sentinel as its SIEM. You are investigating an incident where a user reported receiving a phishing email that appeared to come from the CEO requesting a wire transfer. The user did not respond. However, the incident also contains alerts from Microsoft Defender for Office 365 indicating that other users clicked on a malicious link in a similar email. The email was sent to 100 users. The company has Microsoft Defender for Endpoint deployed on all devices. The incident requires immediate containment to prevent further compromise. What should you do first?

Accepted Answer

Block the malicious URL using Microsoft Defender for Cloud Apps.. Blocking the malicious URL using Microsoft Defender for Cloud Apps (now part of Microsoft 365 Defender) immediately prevents all users from accessing the phishing link, stopping further compromise at the network level. This is the fastest containment action as it applies a URL block across the tenant without requiring individual mailbox or device actions. The incident involves multiple users clicking the link, so a URL block is the most efficient first step to halt the attack chain.

Answer

Run a threat hunting query to find all users who clicked the link.

Answer

Isolate the device of the user who reported the email.

Answer

Delete the email from all users' mailboxes using Microsoft 365 Defender.

Question 8

A security analyst detects a suspicious sign-in from an unfamiliar IP address for a user with high privileges. The analyst wants to immediately contain the threat while preserving the user's ability to work with proper approvals. What is the most effective first step?

Accepted Answer

Initiate a user risk remediation in Microsoft Entra ID Protection by confirming compromise and resetting password with session revocation.. It directly addresses the immediate threat by confirming compromise in Microsoft Entra ID Protection, which triggers a password reset and revokes all existing sessions, effectively terminating the attacker's access. This approach preserves the user's ability to work after re-authentication with proper approvals, as the account remains enabled and can be restored once the risk is mitigated. It is the most effective first step because it combines containment (session revocation) with remediation (password reset) while maintaining operational continuity.

Answer

Block the IP address in the firewall.

Answer

Disable the user account in Microsoft Entra ID.

Answer

Reset the user's password without revoking sessions.

Question 9

During a ransomware incident, security team needs to prevent encryption while preserving forensic data. Which action best achieves this balance?

Accepted Answer

Enable network micro-segmentation to isolate affected systems from file servers and take memory snapshots.. Network micro-segmentation (e.g., using Azure Network Security Groups or software-defined networking) isolates affected systems from file servers, halting lateral movement and preventing encryption of shared data, while memory snapshots (e.g., via Azure VM snapshots or live memory acquisition tools like WinPmem) preserve volatile forensic evidence such as encryption keys or process artifacts. This balances containment with forensic preservation, unlike destructive actions like shutdown or disconnection that lose memory data.

Answer

Shut down all affected servers immediately.

Answer

Run a full antivirus scan on all endpoints.

Answer

Disconnect the network but leave systems running.

Question 10

An incident response playbook in Microsoft Sentinel has a step: 'Investigate the user's recent activities using Microsoft 365 Defender.' Which data source would provide the most relevant information for this step?

Accepted Answer

Microsoft 365 Defender's user investigation page. The Microsoft 365 Defender user investigation page is the correct data source because it provides a consolidated view of a user's activities across Microsoft 365 services, including email, Teams, and endpoint alerts. This directly supports the incident response step of investigating recent user activities within the Microsoft 365 Defender ecosystem, which is the explicit scope of the playbook step.

Answer

Azure Activity Log

Answer

Microsoft Purview Data Loss Prevention reports

Answer

Azure Resource Graph

Question 11

The analyst notices that the rule does not fire for a user who has 12 sign-ins from the same IP address, but all are low risk. The expected behavior is to alert when a single user has more than 10 sign-ins from the same IP with at least one high-risk sign-in. What is the issue?

Accepted Answer

The query requires a high-risk sign-in from the same IP, but none exist, so no match.. The KQL query uses an inner join on UserPrincipalName and IPAddress, which only returns rows where a high-risk sign-in exists from the same IP. Since all 12 sign-ins from that IP are low risk, the join produces no matching rows, and the rule does not fire. The threshold of 10 is irrelevant when the join condition fails to produce any results.

Answer

The join should be on UserPrincipalName only, not IPAddress.

Answer

The join should be leftouter to include sign-ins without high risk.

Answer

The threshold is set to 10, but the user has 12 sign-ins, so it should fire.

Question 12

A SOC analyst needs to automate response to a phishing email reported by a user. The playbook should automatically block the sender in Exchange Online and delete the email from all recipients. Which Microsoft Sentinel automation action should the analyst use?

Accepted Answer

Use the Microsoft Teams connector to post an adaptive card for approval, then use the Exchange Online PowerShell connector to run a script to block sender and delete email.. It uses the Microsoft Teams connector to post an adaptive card for approval, ensuring human oversight before the automated response, then uses the Exchange Online PowerShell connector to block the sender and delete the email from all recipients. This aligns with best practices for phishing response automation in Microsoft Sentinel. Option A is wrong because the Azure Automation connector alone cannot directly interact with Exchange Online to delete emails; it would require custom scripting and is not the recommended approach. Option C is wrong because the Microsoft 365 Defender connector's advanced hunting query action is used for querying data, not for taking response actions. Option D is wrong because the ServiceNow connector creates a ticket, but does not perform the immediate blocking and deletion required.

Answer

Use the Azure Automation connector to run a runbook that deletes the email only.

Answer

Use the Microsoft 365 Defender connector with an action to run an advanced hunting query.

Answer

Use the ServiceNow connector to create an incident ticket.

Question 13

During an incident, an analyst wants to use Microsoft Defender XDR's automatic attack disruption to contain an ongoing attack. What prerequisite must be met?

Accepted Answer

Devices must be onboarded to Microsoft Defender for Endpoint.. Microsoft Defender XDR's automatic attack disruption relies on Microsoft Defender for Endpoint (MDE) signals to automatically contain compromised devices or user accounts. Devices must be onboarded to MDE so that the high-confidence alerts (e.g., from ransomware or lateral movement) can trigger automated containment actions like device isolation or blocking an IP. Without MDE onboarding, the attack disruption engine has no endpoint telemetry or remediation capability to act upon.

Answer

Microsoft Purview compliance portal must be configured.

Answer

Users must have Azure AD Premium P2 licenses.

Answer

Microsoft Sentinel must be enabled and connected to Defender XDR.

Question 14

An analyst is investigating a potential data exfiltration incident involving a user who accessed sensitive files from a personal device. The analyst wants to gather evidence about the device's compliance status and recent activity. Which Microsoft Intune feature should the analyst use?

Accepted Answer

Microsoft Intune device inventory and compliance reports. Microsoft Intune device inventory and compliance reports provide detailed information about a device's compliance status, including whether it meets security policies, has required updates, and is managed correctly. This is essential for investigating potential data exfiltration from a personal device, as it allows the analyst to verify if the device was compliant and review recent activity logs within Intune.

Answer

Exchange Online message trace

Answer

Azure Activity Log

Answer

Microsoft 365 Defender's service health dashboard

Question 15

A security analyst receives an alert from Microsoft Defender for Cloud Apps indicating that a user has signed in from a banned country. The analyst needs to block further access from that country for all users. What should the analyst configure?

Accepted Answer

Create an IP range group for the country and configure a session policy to block it.. Microsoft Defender for Cloud Apps session policies can block access based on IP address geolocation. By creating an IP range group for the banned country and configuring a session policy to block traffic from that group, the analyst can enforce real-time blocking of all user sessions originating from that country, leveraging the reverse proxy architecture of Defender for Cloud Apps.

Answer

Modify the device compliance policy in Microsoft Intune.

Answer

Configure a data loss prevention (DLP) policy in Microsoft Purview.

Answer

Create a conditional access policy in Microsoft Entra ID to block the country.