SC-200 Respond to security incidents Practice Test 14 — 15 Questions

Question 1

Which THREE elements are essential when creating a custom incident response playbook in Microsoft Sentinel? (Choose THREE.)

Accepted Answer

Appropriate permissions via managed identity or service principal for the playbook to execute actions.. A custom incident response playbook in Microsoft Sentinel requires appropriate permissions to execute actions against Azure resources. This is achieved by assigning a managed identity or configuring a service principal for the Logic App, which authenticates and authorizes the playbook to run actions such as blocking IPs, isolating machines, or querying threat intelligence. Without these permissions, the playbook would fail at runtime due to authentication errors, making it non-functional.

Answer

A mandatory approval step before any action is taken.

Answer

An analytics rule that generates the incident.

Question 2

Which TWO are valid methods to collect forensic evidence from a compromised Windows endpoint during an incident? (Choose TWO.)

Accepted Answer

Run KAPE (Kroll Artifact Parser and Extractor) to collect artifacts.. KAPE (Kroll Artifact Parser and Extractor) is a purpose-built tool for collecting and parsing forensic artifacts from live Windows endpoints during incident response. It efficiently gathers critical evidence such as prefetch files, registry hives, event logs, and browser history without altering the system state, making it a valid method for forensic collection.

Answer

Run Windows Update to fix vulnerabilities.

Answer

Reboot the system and boot from a forensic USB drive.

Answer

Use FTK Imager to create a forensically sound image of the hard drive.

Question 3

Which THREE indicators of compromise (IOCs) are commonly used in Microsoft Sentinel to detect advanced persistent threats (APTs)? (Choose THREE.)

Accepted Answer

Suspicious domains and URLs.. Suspicious domains and URLs (Option A) are common IOCs because APTs often use custom domains for command-and-control (C2) communication or phishing. Microsoft Sentinel can ingest threat intelligence feeds and use analytics rules to correlate network logs against these indicators, enabling detection of outbound connections to malicious infrastructure.

Answer

Vulnerability scan results.

Answer

Windows event IDs for successful logins.

Question 4

Which TWO playbook actions can be used to automatically contain a compromised user account in Microsoft Entra ID during an incident? (Choose TWO.)

Accepted Answer

Disable the user account via Microsoft Graph API.. Disabling a user account via Microsoft Graph API is a direct containment action that immediately prevents the compromised account from authenticating and accessing resources. This is a standard automated response in Microsoft Sentinel or Microsoft 365 Defender playbooks to stop an active incident.

Answer

Reset the user's password.

Answer

Send a notification email to the user.

Answer

Add the user to a group that has access to critical resources.

Question 5

Your organization uses Microsoft Sentinel as its SIEM and Microsoft Defender XDR for endpoint protection. You have a custom analytics rule that triggers on suspicious PowerShell activity. The rule uses the following KQL query:

```kql
DeviceProcessEvents
| where Timestamp > ago(1h)
| where FileName == "powershell.exe"
| where ProcessCommandLine contains "-EncodedCommand"
| where InitiatingProcessFileName != "explorer.exe"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine
```

The rule generates incidents that are assigned to the SOC team for investigation. However, analysts report that they are spending too much time manually collecting additional process details for each alert. You need to automate the enrichment of these incidents with additional context, such as parent process details, network connections, and file creation events from the same device within the last hour. The enrichment should be triggered automatically when an incident is created, and the results should be added as a comment to the incident. You have access to Azure Logic Apps and Azure Automation. Which approach should you use?

Accepted Answer

Create an automation rule in Microsoft Sentinel that triggers a Logic App playbook when an incident is created. The playbook uses the Microsoft 365 Defender connector to run advanced hunting queries for parent process, network connections, and file creation events from the same device in the last hour, then adds the results as a comment to the incident.. To automate enrichment of incidents with additional context from Defender XDR, you should create an automation rule in Microsoft Sentinel that triggers a Logic App playbook when an incident is created. The playbook uses the Microsoft 365 Defender connector to run advanced hunting queries for parent process details, network connections, and file creation events from the same device within the last hour, then adds the results as a comment to the incident. This approach efficiently automates the manual task. Option A is incorrect because watchlists are intended for static reference data, not for dynamic query results, and creating a second analytics rule is unnecessary. Option C is incorrect because Power Automate is not directly integrated with Sentinel for this purpose; Logic Apps provide deeper integration. Option D is incorrect because modifying the analytics rule query to join additional tables would increase alert latency and query complexity, and it would not add comments to the incident—enrichment should be handled by a playbook.

Answer

Create a second analytics rule that triggers on the same events and sends the additional context to a watchlist, then use a playbook to read the watchlist and add comments.

Answer

Use Microsoft Power Automate to create a flow that is triggered when a new incident appears in Sentinel, then use the flow to query Defender XDR and update the incident.

Answer

Modify the analytics rule query to join with additional tables to include parent process details, network connections, and file creation events directly in the alert.

Question 6

You are a security analyst at Contoso. A user reports that they received a suspicious email with an attachment named "Invoice.pdf.exe". The user did not open the attachment. You need to investigate this potential threat using Microsoft Defender XDR. You want to determine if any other users received the same email, and whether the attachment was detonated in a sandbox. You also want to block the sender domain and the attachment hash across the organization if it is malicious. You have the email message ID from the user. You have appropriate permissions to use advanced hunting and take action. Which set of actions should you take in Microsoft 365 Defender?

Accepted Answer

Use Advanced hunting to query EmailEvents for the message ID to find other recipients, then query EmailAttachmentInfo to get the attachment hash. Use the sandbox data in EmailUrlInfo to check detonation. Then create an indicator block rule for the sender domain and file hash in the Settings > Indicators.. Advanced hunting in Microsoft 365 Defender allows querying EmailEvents with the message ID to find other recipients and EmailAttachmentInfo to obtain the attachment hash. Sandbox detonation can be checked via EmailUrlInfo or similar tables. Then, creating indicator block rules under Settings > Indicators provides a centralized way to block the sender domain and file hash across the organization. Options A, B, and C are incorrect because they rely on separate tools (Exchange admin center, Quarantine, manual PowerShell) or do not fully utilize Defender XDR's integrated hunting and response capabilities.

Answer

Use the Exchange admin center to run a message trace for the email, then use the Malware section to block the attachment hash.

Answer

Use the Email & collaboration > Explorer to find the email, then use the Quarantine section to block the sender domain.

Answer

Use the Threat Explorer to find the email, then manually block the sender domain in the Exchange Online PowerShell.

Question 7

Your company uses Microsoft Sentinel with the Microsoft Defender for Cloud Apps connector. An incident is created when a user performs an unusual mass download from SharePoint Online. The playbook assigned to the incident automatically suspends the user account in Microsoft Entra ID. However, after investigation, the user's activity is determined to be legitimate (they were backing up data for a migration). You need to restore the user's account and ensure that the user can access all resources immediately. You also need to update the incident to reflect the findings. What should you do?

Accepted Answer

Re-enable the user account in Microsoft Entra ID and set the incident status to Closed with classification 'False positive'.. The user account was suspended by the playbook, so you must manually re-enable it in Microsoft Entra ID to restore access immediately. Setting the incident status to 'Closed' with classification 'False positive' accurately reflects that the alert was triggered by legitimate activity, which is the proper way to close a false positive in Microsoft Sentinel.

Answer

Send a new invitation to the user via Microsoft Entra ID and close the incident as resolved.

Answer

Reset the user's password in Microsoft Entra ID and force a password change at next sign-in.

Answer

Edit the playbook to remove the suspend action and re-run it for the incident.

Question 8

Your organization uses Microsoft Sentinel. A security analyst reports a high number of false positives from a scheduled analytics rule that detects anomalous sign-ins. The rule uses the 'UserAgent' field in the SigninLogs table. What is the best practice to reduce false positives while maintaining detection coverage?

Accepted Answer

Add a condition to the rule query to filter out known legitimate user agents.. The high number of false positives is caused by legitimate user agents triggering the anomaly detection. By adding a condition to the KQL query that filters out known legitimate user agents (e.g., 'Mozilla/5.0' for standard browsers), you reduce noise without losing detection of truly anomalous sign-ins. This preserves the rule's coverage for unknown or malicious user agents while eliminating predictable false positives.

Answer

Increase the alert threshold to require more than one anomalous sign-in per hour.

Answer

Create a watchlist of legitimate IP addresses and reference it in the rule.

Answer

Disable the analytics rule and create a new one with different MITRE tactics.

Question 9

Your company uses Microsoft Defender for Office 365. A user reports receiving a phishing email that bypassed the default policy. The email contains an external link to a credential harvesting site. You need to block similar emails in the future. What should you do?

Accepted Answer

Create a Safe Links policy and add the malicious domain to the blocked URLs list.. The phishing email contains a link to a credential harvesting site, so the most direct way to block similar emails in the future is to use a Safe Links policy. Safe Links proactively scans and blocks URLs at time of click, and you can add the malicious domain to the blocked URLs list to prevent users from accessing that site. This addresses the specific threat vector (malicious URL) rather than the sender's domain or attachment type.

Answer

Create an anti-spam policy to block the sender's domain.

Answer

Create an anti-malware policy to block the attachment type.

Answer

Add the sender's domain to the Tenant Allow/Block List.

Question 10

Your organization uses Microsoft Defender for Cloud Apps. A security investigator discovers that a user's session token was stolen and used to access sensitive data in SharePoint Online from an anomalous IP address. You need to immediately revoke the attacker's access while minimizing impact on the legitimate user. What should you do?

Accepted Answer

From Microsoft Defender for Cloud Apps, use the 'Require re-authentication' action on the anomalous session.. The 'Require re-authentication' action in Microsoft Defender for Cloud Apps immediately terminates the attacker's session by invalidating the stolen session token, forcing the attacker to re-authenticate. This action targets only the anomalous session, leaving the legitimate user's other sessions intact and minimizing disruption. It directly addresses the session token theft without affecting the user's account status or requiring password changes.

Answer

Suspend the user account in Microsoft Entra ID until the investigation is complete.

Answer

Revoke all refresh tokens for the user in Microsoft Entra ID.

Answer

Reset the user's password immediately.

Question 11

Your organization uses Microsoft Sentinel. A fusion incident was created involving multiple alerts from different sources. You need to investigate the incident to determine if it is a true positive. What is the first step you should take?

Accepted Answer

Review the incident timeline and entity mapping in the incident details.. The first step in investigating a Fusion incident in Microsoft Sentinel is to review the incident timeline and entity mapping. This provides a consolidated view of all correlated alerts, their timestamps, and the entities involved (e.g., IP addresses, user accounts), enabling you to quickly assess whether the alerts are logically connected and indicative of a true positive attack chain. Starting with this high-level overview is efficient before diving into raw logs.

Answer

Run a KQL query on the raw logs to see if the alerts are connected.

Answer

Assign the incident to a senior analyst for further investigation.

Answer

Close the incident as a false positive if the alerts seem unrelated.

Question 12

Your organization uses Microsoft 365 Defender. You are investigating a potential malware outbreak on several endpoints. Which TWO actions should you take to isolate affected devices and prevent lateral movement?

Accepted Answer

Use Microsoft Defender for Endpoint to initiate device isolation on affected devices.. Microsoft Defender for Endpoint's device isolation feature disconnects the device from the network while keeping the endpoint connected to the Defender service for monitoring and remediation. This prevents lateral movement by stopping all inbound and outbound communication, effectively containing the malware without losing visibility or control.

Answer

Run a full antivirus scan on all endpoints.

Answer

Reset the passwords of all users on the affected devices.

Answer

Delete the user accounts that logged into the affected devices.

Question 13

Your organization uses Microsoft Sentinel. A new analytics rule is needed to detect brute-force attacks against your Azure SQL databases. The rule should minimize false positives and trigger only when multiple failed logins occur from a single IP address within a short time window. Which THREE components are essential for building this rule?

Accepted Answer

An alert threshold set to trigger when the count exceeds 10 failed attempts in 5 minutes.. Setting an alert threshold to trigger when the count exceeds 10 failed attempts in 5 minutes directly reduces false positives by requiring a meaningful number of failures before alerting. This threshold aligns with common brute-force detection patterns, ensuring the rule only fires when there is a high likelihood of an actual attack rather than occasional user errors.

Answer

A reference to the SQLInsights table for performance data.

Answer

A watchlist containing known malicious IP addresses.

Question 14

Your organization uses Microsoft Defender for Cloud. You need to remediate a security recommendation that indicates a virtual machine is missing critical security updates. Which TWO actions should you take to remediate this recommendation?

Accepted Answer

Connect to the VM and install the missing updates.. Installing the missing updates directly on the VM resolves the underlying vulnerability that Defender for Cloud identified. Option D is correct because configuring automatic updates ensures the VM receives future critical security patches without manual intervention, which proactively remediates the recommendation over time.

Answer

Add a network security group to block inbound traffic to the VM.

Answer

Create an exemption for the recommendation in Defender for Cloud.

Answer

Restart the VM to trigger update installation.

Question 15

Refer to the exhibit. An alert in Microsoft Defender for Identity shows suspicious PowerCLI execution on an Exchange server. The service account 'svc_exchange' is used. What is the most likely true-positive scenario?

Accepted Answer

An attacker using a compromised service account to access mailboxes via remote PowerShell. PowerCLI execution on an Exchange server, especially using a service account like 'svc_exchange', is a strong indicator of an attacker leveraging compromised credentials to remotely access Exchange via PowerShell. Microsoft Defender for Identity detects this because PowerCLI is not a native Exchange management tool; it is typically used by attackers to interact with Exchange Web Services (EWS) or Remote PowerShell (WinRM) for mailbox access, data exfiltration, or persistence. The combination of a service account (often over-privileged and not monitored) and PowerCLI from an unusual source or time makes this a true-positive compromise scenario.

Answer

A security tool scanning for vulnerabilities

Answer

A misconfigured backup application running from an external IP

Answer

A legitimate IT admin running Exchange management scripts