SC-200 Respond to security incidents Practice Test 16 — 15 Questions

Question 1

Your organization uses Microsoft 365 Defender. A security analyst detects a malware infection on a single endpoint named 'SalesPC01'. The malware is identified as 'Trojan:Win32/Emotet'. The endpoint is currently isolated from the network by the automatic response. You need to remediate the infection. The malware has been detected and the endpoint is isolated. What should you do next?

Accepted Answer

Initiate a full antivirus scan using Microsoft Defender Antivirus.. Option B is correct because running a full scan or using Microsoft Defender for Endpoint's 'Run antivirus scan' action can remove the malware. Option A is wrong because the endpoint is already isolated. Option C is wrong because reimaging is a last resort. Option D is wrong because deleting the user account is not necessary.

Answer

Delete the user account that was logged in when the malware was detected.

Answer

Disconnect the endpoint from the network manually.

Answer

Reimage the endpoint to ensure complete removal.

Question 2

Your organization uses Microsoft Sentinel with the Microsoft Defender for Cloud connector enabled. You receive an incident that alerts on 'Suspicious resource deployment' from a user who has been compromised. The incident involves the deployment of a virtual machine in a subscription that is normally not used by that user. The incident severity is High. You need to contain the threat immediately. The deployment is still in progress. What should you do first?

Accepted Answer

Apply a resource lock to the subscription to block all deployments.. Option C is correct because locking the subscription prevents any further resource creation, containing the threat immediately. Option A is wrong because investigating logs takes time. Option B is wrong because deleting the VM may not stop other deployments. Option D is wrong because disabling the user account does not stop the deployment session.

Answer

Investigate the Azure Activity logs to see what other resources were deployed.

Answer

Disable the user account in Microsoft Entra ID.

Answer

Delete the virtual machine that is being deployed.

Question 3

Your organization uses Microsoft 365 Defender. An incident is created for a user who received a phishing email that contained a link to a malicious website. The user clicked the link but did not enter any credentials. The incident includes the alert 'Phishing delivered' from Microsoft Defender for Office 365. You need to remediate the incident and prevent future occurrences. The user is in the Finance department and frequently receives emails from external vendors. What is the best course of action?

Accepted Answer

Use Threat Explorer to delete the email from the user's mailbox and create a Safe Links policy to block the malicious URL.. Option B is correct because using Threat Explorer to delete the email from the user's mailbox removes the threat, and creating a Safe Links policy blocks future similar links. Option A is wrong because reporting to Microsoft does not clean the mailbox. Option C is wrong because training alone does not remove the current email. Option D is wrong because allowing the domain would increase risk.

Answer

Report the email to Microsoft for analysis and block the sender domain.

Answer

Provide security awareness training to the user and mark the incident as resolved.

Answer

Add the sender's domain to the Tenant Allow/Block List as allowed to avoid future false positives.

Question 4

Your organization uses Microsoft Sentinel with the Microsoft 365 Defender connector. You receive an incident indicating that a user's account was used to sign in from an unusual location (Russia) while the user is in the United States. The sign-in was successful and no MFA challenge was prompted because the user had a valid session. The incident severity is High. You need to respond immediately. What should you do first?

Accepted Answer

Revoke the user's session in Microsoft Entra ID.. Option A is correct because revoking the user's session invalidates the attacker's access immediately. Option B is wrong because investigating logs takes time and the attacker is still active. Option C is wrong because resetting password does not invalidate the current session. Option D is wrong because blocking the IP may be too broad and not stop session hijacking.

Answer

Block the IP address in the Conditional Access policy.

Answer

Investigate the sign-in logs to determine if there are other compromised accounts.

Answer

Reset the user's password.

Question 5

Your organization uses Microsoft Sentinel and Microsoft Defender for Cloud. You receive an alert from Defender for Cloud that a virtual machine has a high severity vulnerability: 'CVE-2023-XXXX' with a CVSS score of 9.8. The virtual machine is running a critical application for the finance department. You need to remediate the vulnerability as quickly as possible while minimizing downtime. The application vendor has not yet released a patch but has provided a workaround. What should you do?

Accepted Answer

Implement the workaround provided by the vendor and create a custom remediation task in Defender for Cloud to track the issue.. Option C is correct because applying the vendor-provided workaround reduces the risk while waiting for a patch. Option A is wrong because shutting down the VM causes downtime. Option B is wrong because network isolation may not be sufficient. Option D is wrong because ignoring the alert is not acceptable.

Answer

Dismiss the alert as a false positive because no patch is available.

Answer

Shut down the virtual machine until a patch is available.

Answer

Apply a network security group to block all inbound traffic to the VM.

Question 6

A security analyst is investigating a potential ransomware incident in Microsoft Defender XDR. The analyst needs to confirm the scope of the attack and halt further propagation. Which TWO actions should the analyst take first?

Accepted Answer

Initiate automated investigation on the affected devices. Option A is correct because initiating automated investigation in Microsoft Defender XDR can quickly scope the incident. Option D is correct because isolating affected devices from the network stops lateral movement. Option B is wrong because running a full antivirus scan is reactive, not immediate containment. Option C is wrong because resetting user passwords is important but secondary to containment. Option E is wrong because collecting forensic evidence is for later analysis, not immediate response.

Answer

Reset passwords for all users in the organization

Answer

Collect forensic evidence from affected systems

Answer

Run a full antivirus scan on all endpoints

Question 7

During a security incident, a Microsoft Sentinel analytics rule generated an alert for a suspicious sign-in from an unusual location. The incident involves a user whose account has been compromised. The security team needs to take immediate actions to remediate and prevent further damage. Which THREE actions should the security team prioritize?

Accepted Answer

Reset the user's password. Option A is correct because disabling the user account stops further access. Option C is correct because resetting the password ensures the attacker cannot reuse stolen credentials. Option E is correct because revoking session tokens ends active sessions. Option B is wrong because reviewing audit logs is important but not immediate. Option D is wrong because raising the risk level is a classification, not a remediation.

Answer

Review audit logs for all users

Answer

Raise the user's risk level in Identity Protection

Question 8

Your organization uses Microsoft Defender for Cloud Apps and Microsoft Sentinel. You receive an alert indicating that a user from the finance department accessed a sensitive SharePoint file from an IP address associated with a known malicious Tor exit node. The file contains payment information. The user's account has not been disabled. What should you do first to contain the incident?

Accepted Answer

Suspend the user's account in Microsoft Entra ID. Option C is correct because the first step is to suspend the user's access to the compromised account to prevent further data exfiltration. Option A is wrong because blocking the IP is less effective as the attacker can change IPs. Option B is wrong because deleting the file may destroy evidence. Option D is wrong because notifying the user could alert the attacker.

Answer

Delete the SharePoint file from the site

Answer

Notify the user of the suspicious activity

Answer

Block the IP address in Microsoft Defender for Cloud Apps

Question 9

Your organization has deployed Microsoft Sentinel with the Microsoft Defender XDR connector. A high-severity incident is created for a user who received a phishing email that contained a malicious link. The user clicked the link, and the attacker gained access to the user's mailbox. The security team needs to remove the attacker's access and prevent future occurrences. What should you do first?

Accepted Answer

Remove any mailbox forwarding rules and delegated access. Option A is correct because the immediate priority is to revoke the attacker's access to the mailbox by removing the delegated access or forwarding rule. Option B is wrong while password reset is important, it may not remove the attacker's existing session. Option C is wrong because running antivirus is not applicable for mailbox compromise. Option D is wrong because reporting the incident is secondary.

Answer

Run a full antivirus scan on the user's device

Answer

Reset the user's password immediately

Answer

Report the incident to Microsoft for further investigation

Question 10

You are investigating a security incident in Microsoft Sentinel involving a series of failed logon attempts followed by a successful logon from a different geographic location. The user's account is a privileged administrator. The incident is assigned a medium severity. What should you do first to contain the potential breach?

Accepted Answer

Disable the user's account immediately. Option B is correct because disabling the privileged account prevents any further malicious activity. Option A is wrong because resetting the password alone may not terminate existing sessions. Option C is wrong because reviewing logs is analysis, not containment. Option D is wrong because creating a rule is preventative, not immediate containment.

Answer

Reset the user's password

Answer

Review the audit logs for the user's activity

Answer

Create a new analytics rule to detect similar attempts

Question 11

You are a security analyst for a company using Microsoft Defender XDR. An incident is detected involving a device that has been communicating with a known command-and-control (C2) server. The device is currently online and the user is active. What should you do first to contain the threat?

Accepted Answer

Isolate the device from the network using Microsoft Defender for Endpoint. Option A is correct because isolating the device from the network immediately stops communication with the C2 server. Option B is wrong because killing processes may not stop network communication. Option C is wrong because scanning is reactive. Option D is wrong because contacting the user could tip off the attacker.

Answer

Run a full antivirus scan on the device

Answer

Notify the user to disconnect the device

Answer

Kill the suspicious processes on the device

Question 12

Your organization uses Microsoft Sentinel and Microsoft Defender for Identity. An incident is created for a user whose credentials were used from an unusual location to access sensitive HR data. The user's account is a domain admin. The security team needs to ensure the attacker cannot use the account again. What should you do first?

Accepted Answer

Reset the user's password and revoke the Kerberos TGT. Option C is correct because resetting the password and revoking the Kerberos TGT ensures the attacker cannot reuse cached credentials. Option A is wrong because disabling the account may disrupt operations but password reset is more precise. Option B is wrong because logging out alone does not invalidate the TGT. Option D is wrong because removing group membership is secondary.

Answer

Remove the user from the Domain Admins group

Answer

Force the user to log out of all sessions

Answer

Disable the user's account in Active Directory

Question 13

You are investigating a low-severity incident in Microsoft Sentinel where a user reported receiving a phishing email. The email was not blocked by the email security solution. The user did not click any links. What should you do first?

Accepted Answer

Report the email for analysis using the Microsoft 365 Defender portal. Option B is correct because reporting the email for analysis helps improve email security and determine if it was a false negative. Option A is wrong because deleting the email destroys evidence. Option C is wrong because resetting password is unnecessary as no credentials were compromised. Option D is wrong because no device isolation is needed.

Answer

Delete the phishing email from the user's inbox

Answer

Reset the user's password as a precaution

Answer

Isolate the user's device from the network

Question 14

Your organization uses Microsoft Defender for Cloud Apps and Microsoft Sentinel. An alert indicates that an external IP address is downloading large amounts of data from a SharePoint site containing confidential documents. The activity is coming from a valid user account that appears to be compromised. What should you do first to stop the data exfiltration?

Accepted Answer

Suspend the user account in Microsoft Entra ID. Option A is correct because suspending the user account immediately stops the download. Option B is wrong because blocking the IP may not be effective if the attacker uses multiple IPs. Option C is wrong because changing permissions is slower. Option D is wrong because deleting files destroys evidence.

Answer

Delete the confidential documents from SharePoint

Answer

Block the external IP address in Microsoft Defender for Cloud Apps

Answer

Change the SharePoint site permissions to deny access

Question 15

Your organization has Microsoft Sentinel and Microsoft Defender for Identity deployed. An incident is created for a user whose account was used to access a sensitive database from an unusual workstation. The user is a member of the 'Database Admins' group. The security team needs to prevent further unauthorized access and preserve evidence. What should you do first?

Accepted Answer

Disable the user's account in Active Directory. Option D is correct because disabling the account immediately prevents further access while preserving the group membership for investigation. Option A is wrong because removing from the group may not stop access if the attacker has cached credentials. Option B is wrong because resetting password alone may not invalidate existing sessions. Option C is wrong because logging off may not be possible or effective.

Answer

Reset the user's password

Answer

Force the user to log off all sessions

Answer

Remove the user from the Database Admins group