SC-200 Respond to security incidents Practice Test 14 — 15 Questions

Question 1

Your organization uses Microsoft Sentinel with Microsoft Defender XDR integrated. A critical incident has been raised involving a user account that was used to access a confidential SharePoint site from an unusual location at 2:00 AM. The incident includes alerts from Microsoft Defender for Cloud Apps, Microsoft Defender for Identity, and Microsoft Defender for Office 365. The analyst needs to contain the incident, investigate the scope, and begin remediation. The environment has the following: Microsoft Entra ID with conditional access policies, Microsoft Intune for device management, and Microsoft Defender for Endpoint on all devices. The analyst has identified the user account and the device used. Which course of action should the analyst take first?

Accepted Answer

Disable the user account in Microsoft Entra ID and revoke all sessions.. Disabling the user account in Microsoft Entra ID is the fastest way to stop access. Option B is secondary; Option C doesn't stop access; Option D is for future, not immediate containment.

Answer

Create a conditional access policy to block the user.

Answer

Isolate the user's device using Microsoft Defender for Endpoint.

Answer

Run a KQL query to find all resources accessed by the user.

Question 2

You are a SOC analyst at Contoso Ltd. The company uses Microsoft Sentinel and Microsoft Defender XDR. A high-severity incident is generated from a Sentinel analytics rule that detects multiple failed logins followed by a successful login from a geographically unusual location for a user. The incident includes an alert from Microsoft Defender for Identity indicating a possible brute-force attack. The user's account is a privileged administrator. Your organization has strict compliance requirements: any privileged account compromise must be contained within 15 minutes of detection. You have the following tools available: Microsoft Entra ID with Privileged Identity Management (PIM), Microsoft Defender for Cloud Apps, and Microsoft 365 Defender automation rules. The incident is now 5 minutes old. What should you do to meet the compliance requirement?

Accepted Answer

Disable the user account in Microsoft Entra ID immediately.. Disabling the account is the fastest containment; PIM may take extra steps; alerting is not containment; policies are slower.

Answer

Create an automation rule in Microsoft 365 Defender to alert the security team.

Answer

Create a conditional access policy to block the user's sign-ins.

Answer

Activate PIM and remove the user's role assignments.

Question 3

Your company uses Microsoft Sentinel as its SIEM. You are investigating an incident where a user reported receiving a phishing email that appeared to come from the CEO requesting a wire transfer. The user did not respond. However, the incident also contains alerts from Microsoft Defender for Office 365 indicating that other users clicked on a malicious link in a similar email. The email was sent to 100 users. The company has Microsoft Defender for Endpoint deployed on all devices. The incident requires immediate containment to prevent further compromise. What should you do first?

Accepted Answer

Block the malicious URL using Microsoft Defender for Cloud Apps.. Blocking the malicious URL in Defender for Cloud Apps or Defender for Endpoint prevents users from accessing it. Option B is for email but not real-time; Option C is later; Option D is for the user's device only.

Answer

Run a threat hunting query to find all users who clicked the link.

Answer

Isolate the device of the user who reported the email.

Answer

Delete the email from all users' mailboxes using Microsoft 365 Defender.

Question 4

A security analyst detects a suspicious sign-in from an unfamiliar IP address for a user with high privileges. The analyst wants to immediately contain the threat while preserving the user's ability to work with proper approvals. What is the most effective first step?

Accepted Answer

Initiate a user risk remediation in Microsoft Entra ID Protection by confirming compromise and resetting password with session revocation.. Option B is correct because it immediately revokes sessions and requires reauthentication, containing the threat while allowing work after reauth. Option A is wrong because disabling the account permanently is too aggressive and may disrupt work without investigation. Option C is wrong because resetting password doesn't revoke active sessions. Option D is wrong because the user may be compromised.

Answer

Block the IP address in the firewall.

Answer

Disable the user account in Microsoft Entra ID.

Answer

Reset the user's password without revoking sessions.

Question 5

During a ransomware incident, security team needs to prevent encryption while preserving forensic data. Which action best achieves this balance?

Accepted Answer

Enable network micro-segmentation to isolate affected systems from file servers and take memory snapshots.. Option C is correct because it prevents encryption and contains the threat without destroying data. Option A is wrong because it destroys data. Option B is wrong because it allows encryption to continue. Option D is wrong because it only notifies.

Answer

Shut down all affected servers immediately.

Answer

Run a full antivirus scan on all endpoints.

Answer

Disconnect the network but leave systems running.

Question 6

An incident response playbook in Microsoft Sentinel has a step: 'Investigate the user's recent activities using Microsoft 365 Defender.' Which data source would provide the most relevant information for this step?

Accepted Answer

Microsoft 365 Defender's user investigation page. Option B is correct because Microsoft 365 Defender provides user investigation details across email, endpoints, and apps. Option A is wrong because it's for configuration changes. Option C is wrong because it's for Azure resources. Option D is wrong because it's for data loss prevention, not investigation.

Answer

Azure Activity Log

Answer

Microsoft Purview Data Loss Prevention reports

Answer

Azure Resource Graph

Question 7

The analyst notices that the rule does not fire for a user who has 12 sign-ins from the same IP address, but all are low risk. The expected behavior is to alert when a single user has more than 10 sign-ins from the same IP with at least one high-risk sign-in. What is the issue?

Accepted Answer

The query requires a high-risk sign-in from the same IP, but none exist, so no match.. Option D is correct. The join requires high-risk sign-ins from the same IP, but the threshold only applies to the first aggregation. If all sign-ins are low risk, no high-risk join match occurs. Option A is wrong because the threshold is 10. Option B is wrong because the join is inner, which filters out non-matching. Option C is wrong because the join is on both fields.

Answer

The join should be on UserPrincipalName only, not IPAddress.

Answer

The join should be leftouter to include sign-ins without high risk.

Answer

The threshold is set to 10, but the user has 12 sign-ins, so it should fire.

Question 8

A SOC analyst needs to automate response to a phishing email reported by a user. The playbook should automatically block the sender in Exchange Online and delete the email from all recipients. Which Microsoft Sentinel automation action should the analyst use?

Accepted Answer

Use the Microsoft Teams connector to post an adaptive card for approval, then use the Exchange Online PowerShell connector to run a script to block sender and delete email.. Option C is correct because Microsoft Teams connector can trigger adaptive cards to get analyst approval before blocking. Option A is wrong because email connector sends emails, not blocks. Option B is wrong because ServiceNow is for ticketing, not immediate blocking. Option D is wrong because Azure Automation can run scripts but is not the primary connector for Exchange Online actions.

Answer

Use the Azure Automation connector to run a runbook that deletes the email only.

Answer

Use the Microsoft 365 Defender connector with an action to run an advanced hunting query.

Answer

Use the ServiceNow connector to create an incident ticket.

Question 9

During an incident, an analyst wants to use Microsoft Defender XDR's automatic attack disruption to contain an ongoing attack. What prerequisite must be met?

Accepted Answer

Devices must be onboarded to Microsoft Defender for Endpoint.. Option A is correct because automatic attack disruption requires the device to be onboarded to Microsoft Defender for Endpoint. Option B is wrong because it's not required. Option C is wrong because Sentinel is not required. Option D is wrong because it's not required.

Answer

Microsoft Purview compliance portal must be configured.

Answer

Users must have Azure AD Premium P2 licenses.

Answer

Microsoft Sentinel must be enabled and connected to Defender XDR.

Question 10

A company uses Microsoft Sentinel with Microsoft Defender for Cloud Apps. An incident is created when a user downloads 500 GB from SharePoint in one hour. The analyst wants to create a playbook that automatically suspends the user in Microsoft Entra ID when such activity is detected. Which connector and action should the analyst use in the playbook?

Accepted Answer

Microsoft Entra ID connector with 'Update user' action to set accountEnabled to false.. Option C is correct because the Microsoft Entra ID connector can update user settings, and the action to disable account is available. Option A is wrong because Defender for Cloud Apps connector does not directly disable users. Option B is wrong because Exchange Online is for mailboxes. Option D is wrong because Microsoft Teams is for communication.

Answer

Microsoft Teams connector with 'Post message' action to notify admin.

Answer

Microsoft 365 Defender connector with 'Run advanced hunting' action.

Answer

Exchange Online connector with 'Set mailbox' action.

Question 11

An analyst is investigating a potential data exfiltration incident involving a user who accessed sensitive files from a personal device. The analyst wants to gather evidence about the device's compliance status and recent activity. Which Microsoft Intune feature should the analyst use?

Accepted Answer

Microsoft Intune device inventory and compliance reports. Option D is correct because Microsoft Intune's device compliance and inventory provide the needed information. Option A is wrong because it audits Azure resource changes. Option B is wrong because it's for service health. Option C is wrong because it's for email flow.

Answer

Exchange Online message trace

Answer

Azure Activity Log

Answer

Microsoft 365 Defender's service health dashboard

Question 12

A security analyst receives an alert from Microsoft Defender for Cloud Apps indicating that a user has signed in from a banned country. The analyst needs to block further access from that country for all users. What should the analyst configure?

Accepted Answer

Create an IP range group for the country and configure a session policy to block it.. Option A is correct because Microsoft Defender for Cloud Apps session policy can block access based on location. Option B is wrong because conditional access policies are in Entra ID, not Defender for Cloud Apps. Option C is wrong because DLP policies don't block access. Option D is wrong because compliance policies don't block access.

Answer

Modify the device compliance policy in Microsoft Intune.

Answer

Configure a data loss prevention (DLP) policy in Microsoft Purview.

Answer

Create a conditional access policy in Microsoft Entra ID to block the country.

Question 13

Which TWO actions should an analyst take when a confirmed ransomware incident is detected on multiple endpoints? (Choose TWO.)

Accepted Answer

Isolate affected endpoints using Microsoft Defender for Endpoint.. Option A is correct because isolating endpoints stops encryption. Option C is correct because blocking indicators prevents spread. Option B is wrong because it destroys evidence. Option D is wrong because it allows encryption to continue. Option E is wrong because it's reactive, not immediate containment.

Answer

Run a full antivirus scan on all endpoints.

Answer

Disconnect network cables but leave endpoints powered on.

Answer

Shut down all affected endpoints to prevent data loss.

Question 14

Which THREE elements are essential when creating a custom incident response playbook in Microsoft Sentinel? (Choose THREE.)

Accepted Answer

Appropriate permissions via managed identity or service principal for the playbook to execute actions.. Option A is correct because triggers define when the playbook runs. Option B is correct because actions are the core of the playbook. Option D is correct because playbooks need proper permissions. Option C is wrong because playbooks are separate from analytics rules. Option E is wrong because playbooks can be triggered manually or automatically.

Answer

A mandatory approval step before any action is taken.

Answer

An analytics rule that generates the incident.

Question 15

Which TWO are valid methods to collect forensic evidence from a compromised Windows endpoint during an incident? (Choose TWO.)

Accepted Answer

Run KAPE (Kroll Artifact Parser and Extractor) to collect artifacts.. Option A is correct because KAPE collects live forensic data. Option C is correct because memory dump captures volatile data. Option B is wrong because it overwrites data. Option D is wrong because it's not a forensic tool. Option E is wrong because it's for disk imaging after shutdown.

Answer

Run Windows Update to fix vulnerabilities.

Answer

Reboot the system and boot from a forensic USB drive.

Answer

Use FTK Imager to create a forensically sound image of the hard drive.