SC-200 Respond to security incidents Practice Test 16 — 15 Questions

Question 1

Which TWO actions can you perform in Microsoft Defender XDR as part of incident response?

Accepted Answer

Collect an investigation package from a device. Option D is correct because Microsoft Defender XDR's device response actions include collecting an investigation package, which gathers forensic artifacts (such as running processes, network connections, and event logs) from an endpoint for offline analysis. Option E is correct because isolating a device from the network is a core Defender XDR live response action that cuts off an endpoint's network connectivity (while optionally allowing Defender communications) to contain a compromised host during incident response. The other options fall outside Defender XDR's native incident response capabilities: Microsoft Sentinel workbooks (A) are authored in Microsoft Sentinel, modifying an Entra ID conditional access policy (B) is done in the Microsoft Entra admin center, and running a KQL query in Azure Data Explorer (C) is an Azure Data Explorer operation, not a Defender XDR response action.

Answer

Create a Microsoft Sentinel workbook

Answer

Modify a Microsoft Entra ID conditional access policy

Answer

Run a KQL query in Azure Data Explorer

Question 2

Which THREE actions can you take in Microsoft Sentinel to respond to an incident?

Accepted Answer

Assign the incident to a user. Assigning an incident to a user is a core incident response action in Microsoft Sentinel. It establishes ownership, ensuring a specific analyst is responsible for investigation and remediation. This action is performed directly from the incident details pane and is a fundamental step in managing the incident lifecycle.

Answer

Modify a KQL query in an analytics rule

Answer

Export logs to Azure Storage

Question 3

Which TWO actions are valid containment steps for a compromised user account in Microsoft Defender XDR?

Accepted Answer

Disable the user account in Microsoft Entra ID. Disabling the user account in Microsoft Entra ID is a valid containment step because it immediately revokes the user's access to all cloud resources, including Microsoft 365, Azure, and any applications relying on Entra ID authentication. This prevents the compromised account from being used for further malicious activities while preserving the account for investigation. It is a core incident response action in Microsoft Defender XDR for containing identity-based threats.

Answer

Create a new email rule to forward emails

Answer

Add the user to a privileged role

Answer

Run a full antivirus scan on the user's device

Question 4

A security analyst receives an alert in Microsoft Defender XDR indicating a possible credential theft attempt from an external IP. The analyst wants to isolate the affected device immediately while preserving forensic data. What should the analyst do?

Accepted Answer

Initiate a live response session on the device and run the 'isolate device' command.. Initiating a live response session and running the 'isolate device' command in Microsoft Defender for Endpoint immediately disconnects the device from the network (both internal and external) while preserving forensic data on the endpoint. This action stops the ongoing credential theft attempt without destroying volatile evidence, which is critical for subsequent investigation.

Answer

Use Microsoft Defender for Endpoint to 'contain device' from the device inventory.

Answer

Disable the user account in Microsoft Entra ID.

Answer

Reset the user's password and enforce sign-out.

Question 5

During an incident response, a SOC analyst needs to automatically collect relevant evidence from multiple Microsoft 365 services. Which Microsoft Sentinel playbook trigger should the analyst configure?

Accepted Answer

Microsoft Sentinel Incident trigger with action 'Collect evidence'.. The Microsoft Sentinel Incident trigger with the 'Collect evidence' action is specifically designed to automate evidence collection across Microsoft 365 services during incident response. This trigger fires when an incident is created or updated, allowing the playbook to gather relevant data from sources like Microsoft Defender for Endpoint, Microsoft 365 Defender, and Microsoft Entra ID without manual intervention.

Answer

Microsoft Sentinel Playbook trigger 'When a response action is executed'.

Answer

Microsoft Sentinel Scheduled Analytics rule trigger.

Answer

Microsoft Sentinel Alert trigger.

Question 6

Your organization uses Microsoft Sentinel and Microsoft Defender for Cloud. A critical server in Azure was compromised by ransomware. The incident response team needs to ensure that no other resources in the same resource group are affected. What is the most immediate containment action?

Accepted Answer

Disable the public IP address and apply an NSG rule to block all inbound/outbound traffic to the server's subnet.. The most immediate containment action is to isolate the compromised server's subnet by disabling its public IP and applying an NSG rule that blocks all inbound and outbound traffic. This prevents lateral movement of ransomware to other resources in the same resource group while preserving the VM for forensic analysis. In Microsoft Defender for Cloud and Sentinel, network isolation at the subnet level is the fastest way to contain a breach without destroying evidence.

Answer

Delete the virtual machine immediately to stop the ransomware.

Answer

Change the local administrator password on the VM.

Answer

Move the VM to a different virtual network and subnet.

Question 7

Refer to the exhibit. You are reviewing a Microsoft Sentinel scheduled analytics rule configured as above. An incident was created for multiple alerts triggering within a 5-hour window. The SOC team needs to investigate each alert separately because they involve different user accounts. What should the analyst do to ensure each alert generates a separate incident?

Accepted Answer

Set 'enabled' to false under groupingConfiguration.. Setting 'enabled' to false under groupingConfiguration disables alert grouping entirely. When grouping is disabled, each individual alert that triggers the scheduled rule will generate its own separate incident, allowing the SOC team to investigate alerts involving different user accounts independently.

Answer

Change the matchingMethod to 'AnyAlert'.

Answer

Set 'reopenClosedIncident' to true.

Answer

Change the lookbackDuration to PT0H.

Question 8

A SOC analyst is investigating a phishing campaign that targets Microsoft 365 users. The analyst needs to collect email message headers from multiple users' mailboxes. Which Microsoft 365 Defender action should the analyst use?

Accepted Answer

Use Microsoft 365 Defender > Email & collaboration > Explorer to query email headers.. Microsoft 365 Defender's Email & collaboration > Explorer (also known as Threat Explorer) is the dedicated tool for querying email message headers across multiple user mailboxes. It allows analysts to search for specific email messages by sender, recipient, subject, or other attributes, and then view the full internet message headers (RFC 5322) for forensic analysis. This is the standard workflow for investigating phishing campaigns in Microsoft 365 Defender.

Answer

Use Microsoft 365 Defender > Actions & submissions to view email headers.

Answer

Use Microsoft 365 Defender > Threat hunters to search for email headers.

Answer

Use Microsoft 365 Defender > Attack simulation training to collect headers.

Question 9

During an incident involving a compromised Azure VM, the security team wants to capture a memory dump for forensic analysis. The VM is running Windows Server 2022. What is the recommended approach?

Accepted Answer

Initiate a live response session on the VM and run the 'dump memory' command.. Microsoft Defender for Endpoint's live response capability provides a built-in 'dump memory' command that captures a full memory dump of the compromised Azure VM for forensic analysis. This is the recommended approach as it allows memory acquisition without requiring additional tools or direct RDP/PSRemoting access, preserving the forensic integrity of the volatile data.

Answer

Use Azure Backup to create a VM snapshot.

Answer

Establish a PowerShell remote session and run 'Get-Process | Export-CliXML'.

Answer

Use Azure Disk Encryption to export the disk.

Question 10

Your organization uses Microsoft Sentinel and Microsoft Defender for Identity. An alert fires for a potential DCSync attack. The incident response team needs to immediately block the source account from performing directory replication. Which action should be taken?

Accepted Answer

Disable the account in Microsoft Entra ID (if synced) or Active Directory.. Immediately disabling the account in Microsoft Entra ID (if synced) or Active Directory is the fastest way to stop the compromised account from performing any directory replication, including DCSync attacks. DCSync abuses the domain controller's replication protocol (MS-DRSR) to request password hashes, and disabling the account blocks all Kerberos and NTLM authentication, effectively halting the attack at the source.

Answer

Use Microsoft Defender for Identity to disable the account.

Answer

Reset the account password and enforce a sign-out.

Answer

Remove the account from the Domain Admins group.

Question 11

A SOC analyst is triaging an incident in Microsoft Sentinel and needs to assign it to a senior analyst for further investigation. What is the correct action?

Accepted Answer

Open the incident and change the Owner field to the senior analyst.. In Microsoft Sentinel, the correct way to assign an incident to a specific analyst is to open the incident and change the Owner field to that analyst. This action formally transfers ownership and responsibility for the incident within the SIEM, ensuring proper tracking and accountability. Other methods, such as adding comments or sending emails, do not update the incident's ownership metadata.

Answer

Create a new incident and manually add the senior analyst as a comment.

Answer

Close the incident and reopen it under the senior analyst's name.

Answer

Run a playbook that sends an email to the senior analyst.

Question 12

Refer to the exhibit. A Microsoft Sentinel scheduled rule is configured as shown. The rule generates an alert, but the incident created contains only the first alert, and subsequent alerts do not update the incident. What is the most likely cause?

Accepted Answer

The rule does not have incident grouping enabled.. The exhibit shows the rule is configured to create a single incident from alerts grouped by entities, but the 'Grouping' settings are not enabled. Without incident grouping enabled, each alert generates a separate incident, and subsequent alerts do not update the existing incident. Enabling incident grouping allows alerts matching the same grouping criteria to be merged into the same incident, ensuring updates occur.

Answer

The triggerOperator and triggerThreshold are misconfigured.

Answer

The KQL query is missing a join to include more data.

Answer

The severity is set to High, which prevents incident updates.

Question 13

Which TWO are valid sources of evidence in a Microsoft Sentinel incident? (Choose two.)

Accepted Answer

Alerts. Alerts are a core evidence type in Microsoft Sentinel incidents because they represent the raw security findings that trigger an incident. When an alert is generated from a detection rule (e.g., analytics rule, fusion, or scheduled query), it is automatically linked to the incident as evidence, providing the initial context and supporting data for investigation.

Answer

Playbooks

Answer

Watchlists

Answer

Hunting queries

Question 14

A security analyst is investigating a Microsoft Defender for Cloud Apps alert about a suspicious OAuth app that has high permissions. The analyst needs to disable the app immediately. What is the correct action?

Accepted Answer

From the Microsoft Defender for Cloud Apps alert, select 'Disable app'.. Microsoft Defender for Cloud Apps provides a built-in 'Disable app' action directly from the alert, which immediately revokes the OAuth app's permissions and prevents further access without deleting the app registration. This is the fastest way to mitigate the threat while preserving the app for potential forensic analysis.

Answer

Revoke all tokens for the app in Microsoft Entra ID.

Answer

Generate a new client secret for the app.

Answer

Go to Microsoft Entra ID admin center and delete the app registration.

Question 15

A SOC analyst is using Microsoft Sentinel to respond to an incident involving multiple compromised user accounts. The analyst needs to quickly see the timeline of all related events. Which feature should the analyst use?

Accepted Answer

Incident timeline.. The Incident timeline (option D) is the correct feature because it provides a chronological view of all events, alerts, and actions associated with a specific incident in Microsoft Sentinel. This allows the SOC analyst to quickly see the sequence of events related to the compromised user accounts without navigating away from the incident investigation page.

Answer

Entity behavior page.

Answer

Analytics rule page.

Answer

Workbook.