SC-200 Respond to security incidents Practice Test 15 — 15 Questions

Question 1

Your organization uses Microsoft Sentinel. You are responsible for responding to incidents. A new 'MFA Denied' incident is created from Microsoft Entra ID sign-in logs, indicating that a user in your organization had multiple MFA denials from a suspicious IP address (203.0.113.5). The user is a sales representative who frequently travels. The incident severity is Medium. The incident contains entities: user 'jsmith@contoso.com', IP address 203.0.113.5, and a device running Windows 11. You need to investigate and determine if this is a true positive. The user is currently on a business trip in Europe, but the sign-in attempts originated from an IP address in a different region. What should you do first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Contact the user to confirm if they attempted to sign in at the time of the alerts.. Verifying with the user if they attempted to sign in is the fastest way to confirm if the MFA denials were legitimate. Option A is wrong because changing the password prematurely may lock out the user without confirmation. Option C is wrong because containing the device may disrupt the user's work. Option D is wrong because blocking the IP may be premature if the user's IP changes frequently.

Answer

Immediately reset the user's password and revoke sessions.

Answer

Block the suspicious IP address in the Conditional Access policy.

Answer

Isolate the user's device using Microsoft Defender for Endpoint.

Question 2

Your organization uses Microsoft Sentinel. You are responsible for responding to incidents. A new 'MFA Denied' incident is created from Microsoft Entra ID sign-in logs, indicating that a user in your organization had multiple MFA denials from a suspicious IP address (203.0.113.5). The user is a sales representative who frequently travels. The incident severity is Medium. The incident contains entities: user 'jsmith@contoso.com', IP address 203.0.113.5, and a device running Windows 11. You need to investigate and determine if this is a true positive. The user is currently on a business trip in Europe, but the sign-in attempts originated from an IP address in a different region. What should you do first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an app connector for SharePoint and a session policy that targets the user, site, and device tag 'Unmanaged' with the action 'Block download'.. It involves creating an app connector for SharePoint to enable session control, followed by a session policy in Microsoft Defender for Cloud Apps that targets the specific user (jdoe@contoso.com), the specific site (ExecConfidential), and the device tag 'Unmanaged' with the action 'Block download'. This precisely meets the requirement to block downloads from unmanaged devices for that user on that site. Option B is incorrect because device compliance policies in Microsoft Intune are for device management, not session-level control within Defender for Cloud Apps. Option C is incorrect because Conditional Access policies in Microsoft Entra ID can require compliant devices but cannot granularly block downloads. Option D is incorrect because a file policy monitors and quarantines files, it does not provide session-level control to block downloads in real-time.

Answer

Create a device compliance policy in Microsoft Intune to block unmanaged devices from accessing SharePoint.

Answer

Create a Conditional Access policy in Microsoft Entra ID to require compliant device for the SharePoint site.

Answer

Create a file policy in Defender for Cloud Apps to quarantine files downloaded from the site.

Question 3

Your organization uses Microsoft 365 Defender. A security analyst detects a malware infection on a single endpoint named 'SalesPC01'. The malware is identified as 'Trojan:Win32/Emotet'. The endpoint is currently isolated from the network by the automatic response. You need to remediate the infection. The malware has been detected and the endpoint is isolated. What should you do next?

Accepted Answer

Initiate a full antivirus scan using Microsoft Defender Antivirus.. After the endpoint is isolated, the next step is to initiate a full antivirus scan using Microsoft Defender Antivirus to detect and remove the malware. Option A is incorrect because deleting the user account does not remove the malware and is an excessive step. Option B is incorrect because the endpoint is already isolated by automatic response, so manually disconnecting is redundant. Option C is incorrect because reimaging is a more drastic measure that should be taken only if other remediation steps fail.

Answer

Delete the user account that was logged in when the malware was detected.

Answer

Disconnect the endpoint from the network manually.

Answer

Reimage the endpoint to ensure complete removal.

Question 4

Your organization uses Microsoft Sentinel with the Microsoft Defender for Cloud connector enabled. You receive an incident that alerts on 'Suspicious resource deployment' from a user who has been compromised. The incident involves the deployment of a virtual machine in a subscription that is normally not used by that user. The incident severity is High. You need to contain the threat immediately. The deployment is still in progress. What should you do first?

Accepted Answer

Apply a resource lock to the subscription to block all deployments.. Locking the subscription prevents any further resource creation, containing the threat immediately. Option A is wrong because investigating logs takes time. Option B is wrong because deleting the VM may not stop other deployments. Option D is wrong because disabling the user account does not stop the deployment session.

Answer

Investigate the Azure Activity logs to see what other resources were deployed.

Answer

Disable the user account in Microsoft Entra ID.

Answer

Delete the virtual machine that is being deployed.

Question 5

Your organization uses Microsoft 365 Defender. An incident is created for a user who received a phishing email that contained a link to a malicious website. The user clicked the link but did not enter any credentials. The incident includes the alert 'Phishing delivered' from Microsoft Defender for Office 365. You need to remediate the incident and prevent future occurrences. The user is in the Finance department and frequently receives emails from external vendors. What is the best course of action?

Accepted Answer

Use Threat Explorer to delete the email from the user's mailbox and create a Safe Links policy to block the malicious URL.. Threat Explorer allows you to delete the phishing email from the user's mailbox, and creating a Safe Links policy blocks the malicious URL for future emails. Option B is incorrect because while reporting to Microsoft is helpful, it does not immediately remove the email from the user's mailbox or prevent future occurrences. Option C is incorrect because security awareness training is important but does not remediate the current incident. Option D is incorrect because adding the sender domain to the allowed list would increase risk and not block the malicious URL.

Answer

Report the email to Microsoft for analysis and block the sender domain.

Answer

Provide security awareness training to the user and mark the incident as resolved.

Answer

Add the sender's domain to the Tenant Allow/Block List as allowed to avoid future false positives.

Question 6

Your organization uses Microsoft Sentinel with the Microsoft 365 Defender connector. You receive an incident indicating that a user's account was used to sign in from an unusual location (Russia) while the user is in the United States. The sign-in was successful and no MFA challenge was prompted because the user had a valid session. The incident severity is High. You need to respond immediately. What should you do first?

Accepted Answer

Revoke the user's session in Microsoft Entra ID.. Revoking the user's session in Microsoft Entra ID immediately terminates all active tokens and sessions, preventing the attacker from continuing to use the authenticated session. This is the fastest way to stop the ongoing compromise because the sign-in succeeded without MFA due to a valid session, and the attacker is already inside. Other actions like blocking IP or resetting password are slower or less direct in this scenario.

Answer

Block the IP address in the Conditional Access policy.

Answer

Investigate the sign-in logs to determine if there are other compromised accounts.

Answer

Reset the user's password.

Question 7

Your organization uses Microsoft Sentinel. You are responsible for responding to incidents. A new 'MFA Denied' incident is created from Microsoft Entra ID sign-in logs, indicating that a user in your organization had multiple MFA denials from a suspicious IP address (203.0.113.5). The user is a sales representative who frequently travels. The incident severity is Medium. The incident contains entities: user 'jsmith@contoso.com', IP address 203.0.113.5, and a device running Windows 11. You need to investigate and determine if this is a true positive. The user is currently on a business trip in Europe, but the sign-in attempts originated from an IP address in a different region. What should you do first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement the workaround provided by the vendor and create a custom remediation task in Defender for Cloud to track the issue.. Implementing the vendor-provided workaround reduces the immediate risk while awaiting a formal patch, and creating a custom remediation task in Defender for Cloud enables tracking and follow-up. Option A is incorrect because dismissing the alert as a false positive ignores a legitimate high-severity vulnerability, leaving the system exposed. Option B is incorrect because shutting down the virtual machine would cause unacceptable downtime for the critical finance application. Option D is incorrect because applying a network security group to block all inbound traffic may not fully mitigate the vulnerability (e.g., if it is exploitable via outbound or lateral movement) and could impact legitimate traffic.

Answer

Dismiss the alert as a false positive because no patch is available.

Answer

Shut down the virtual machine until a patch is available.

Answer

Apply a network security group to block all inbound traffic to the VM.

Question 8

A security analyst is investigating a potential ransomware incident in Microsoft Defender XDR. The analyst needs to confirm the scope of the attack and halt further propagation. Which TWO actions should the analyst take first?

Accepted Answer

Initiate automated investigation on the affected devices. Initiating automated investigation on affected devices (A) is correct because Microsoft Defender XDR's automated investigation uses built-in playbooks to automatically analyze alerts, determine the scope of compromise, and suggest remediation actions without manual intervention. This is the fastest way to confirm the attack scope while simultaneously halting propagation. Isolating affected devices (D) is correct because network isolation immediately cuts off communication between the compromised device and other systems, preventing lateral movement and further encryption of network shares. Both actions are first-response steps in a ransomware incident.

Answer

Reset passwords for all users in the organization

Answer

Collect forensic evidence from affected systems

Answer

Run a full antivirus scan on all endpoints

Question 9

During a security incident, a Microsoft Sentinel analytics rule generated an alert for a suspicious sign-in from an unusual location. The incident involves a user whose account has been compromised. The security team needs to take immediate actions to remediate and prevent further damage. Which THREE actions should the security team prioritize?

Accepted Answer

Reset the user's password. Resetting the user's password (A) is a critical immediate step because it invalidates the current compromised credentials, preventing the attacker from using the known password to authenticate again. In Microsoft Entra ID, a password reset forces the user to create a new credential, which the attacker does not possess, effectively cutting off one of the most common attack vectors.

Answer

Review audit logs for all users

Answer

Raise the user's risk level in Identity Protection

Question 10

Your organization uses Microsoft Defender for Cloud Apps and Microsoft Sentinel. You receive an alert indicating that a user from the finance department accessed a sensitive SharePoint file from an IP address associated with a known malicious Tor exit node. The file contains payment information. The user's account has not been disabled. What should you do first to contain the incident?

Accepted Answer

Suspend the user's account in Microsoft Entra ID. The first step to contain the incident is to suspend the user's account in Microsoft Entra ID (Option D). This immediately revokes access to all resources, preventing further data exfiltration while preserving the current state for investigation. Option A is incorrect because deleting the SharePoint file may destroy evidence. Option B is incorrect because blocking the IP address in Defender for Cloud Apps is less effective; the attacker can easily switch to a different IP address. Option C is incorrect because notifying the user could alert a potential attacker who might have compromised the account, leading to further malicious actions.

Answer

Delete the SharePoint file from the site

Answer

Notify the user of the suspicious activity

Answer

Block the IP address in Microsoft Defender for Cloud Apps

Question 11

Your organization has deployed Microsoft Sentinel with the Microsoft Defender XDR connector. A high-severity incident is created for a user who received a phishing email that contained a malicious link. The user clicked the link, and the attacker gained access to the user's mailbox. The security team needs to remove the attacker's access and prevent future occurrences. What should you do first?

Accepted Answer

Remove any mailbox forwarding rules and delegated access. The immediate priority is to remove the attacker's access to the mailbox, which is achieved by deleting any mailbox forwarding rules and delegated access (option D). While resetting the user's password (option B) is important, it may not terminate existing authenticated sessions or remove forwarding rules already in place. Running a full antivirus scan (option A) is not the first step for a mailbox compromise, as the threat is not on the device. Reporting the incident (option C) is a secondary action after containment. Therefore, option D is the correct first step.

Answer

Run a full antivirus scan on the user's device

Answer

Reset the user's password immediately

Answer

Report the incident to Microsoft for further investigation

Question 12

You are investigating a security incident in Microsoft Sentinel involving a series of failed logon attempts followed by a successful logon from a different geographic location. The user's account is a privileged administrator. The incident is assigned a medium severity. What should you do first to contain the potential breach?

Accepted Answer

Disable the user's account immediately. The correct first step is to disable the user's account immediately. This is the most effective containment action because it prevents any further unauthorized access using that account, even if an attacker has established a session. Resetting the password (option B) would not terminate existing authenticated sessions and is secondary. Reviewing audit logs (option C) is analysis, not containment, and creating a new analytics rule (option D) is a preventative measure that does not address the immediate threat.

Answer

Reset the user's password

Answer

Review the audit logs for the user's activity

Answer

Create a new analytics rule to detect similar attempts

Question 13

You are a security analyst for a company using Microsoft Defender XDR. An incident is detected involving a device that has been communicating with a known command-and-control (C2) server. The device is currently online and the user is active. What should you do first to contain the threat?

Accepted Answer

Isolate the device from the network using Microsoft Defender for Endpoint. Isolating the device from the network using Microsoft Defender for Endpoint immediately cuts off all communication with the C2 server, preventing data exfiltration and further command execution. This is the fastest containment action that does not rely on user compliance or process-level responses, and it preserves the device's state for forensic analysis. In an active incident, stopping network-level communication is the priority over scanning or process termination.

Answer

Run a full antivirus scan on the device

Answer

Notify the user to disconnect the device

Answer

Kill the suspicious processes on the device

Question 14

Your organization uses Microsoft Sentinel and Microsoft Defender for Identity. An incident is created for a user whose credentials were used from an unusual location to access sensitive HR data. The user's account is a domain admin. The security team needs to ensure the attacker cannot use the account again. What should you do first?

Accepted Answer

Reset the user's password and revoke the Kerberos TGT. Resetting the password and revoking the Kerberos TGT ensures the attacker cannot reuse cached credentials. Option A is wrong because disabling the account may disrupt operations but password reset is more precise. Option B is wrong because logging out alone does not invalidate the TGT. Option D is wrong because removing group membership is secondary.

Answer

Remove the user from the Domain Admins group

Answer

Force the user to log out of all sessions

Answer

Disable the user's account in Active Directory

Question 15

You are investigating a low-severity incident in Microsoft Sentinel where a user reported receiving a phishing email. The email was not blocked by the email security solution. The user did not click any links. What should you do first?

Accepted Answer

Report the email for analysis using the Microsoft 365 Defender portal. Reporting the email for analysis helps improve email security and determine if it was a false negative. Option A is wrong because deleting the email destroys evidence. Option C is wrong because resetting password is unnecessary as no credentials were compromised. Option D is wrong because no device isolation is needed.

Answer

Delete the phishing email from the user's inbox

Answer

Reset the user's password as a precaution

Answer

Isolate the user's device from the network