SC-200 Respond to security incidents Practice Test 16 — 15 Questions

Question 1

Your organization uses Microsoft Defender for Cloud Apps and Microsoft Sentinel. An alert indicates that an external IP address is downloading large amounts of data from a SharePoint site containing confidential documents. The activity is coming from a valid user account that appears to be compromised. What should you do first to stop the data exfiltration?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Suspend the user account in Microsoft Entra ID. The first priority is to immediately stop the ongoing data exfiltration by suspending the compromised user account in Microsoft Entra ID. This disables the attacker's access via that account, halting the download. Blocking the external IP address (Option C) is less effective because the attacker could switch IPs. Changing SharePoint permissions (Option D) or deleting documents (Option A) would not stop the current download session as quickly as suspending the account.

Answer

Delete the confidential documents from SharePoint

Answer

Block the external IP address in Microsoft Defender for Cloud Apps

Answer

Change the SharePoint site permissions to deny access

Question 2

Your organization has Microsoft Sentinel and Microsoft Defender for Identity deployed. An incident is created for a user whose account was used to access a sensitive database from an unusual workstation. The user is a member of the 'Database Admins' group. The security team needs to prevent further unauthorized access and preserve evidence. What should you do first?

Accepted Answer

Disable the user's account in Active Directory. Disabling the user's account in Active Directory immediately prevents further access from the unusual workstation while preserving the account and group memberships for investigation. This stops the attacker from authenticating to the sensitive database and other resources. Resetting the password (B) may not terminate existing authenticated sessions, forcing a logoff (C) may not prevent re-authentication if the attacker has credentials, and removing from the group (D) may not stop access if cached credentials or tokens are already present.

Answer

Reset the user's password

Answer

Force the user to log off all sessions

Answer

Remove the user from the Database Admins group

Question 3

A security analyst receives a Microsoft Defender for Cloud Apps alert about a suspicious sign-in from an IP address in a sanctioned app. The analyst needs to immediately prevent further access from that IP. What should the analyst do?

Accepted Answer

Create an IP address-based access policy in Microsoft Defender for Cloud Apps.. Microsoft Defender for Cloud Apps provides native IP address-based access policies that can immediately block traffic from a specific IP address for a sanctioned app. This action is taken directly within Defender for Cloud Apps, without needing to modify Entra ID Conditional Access policies, and it applies in real time to the app session. The analyst can create a policy that blocks access from the suspicious IP, preventing further sign-ins from that address.

Answer

Create a mailbox rule to delete emails from that IP.

Answer

Create a Conditional Access policy in Microsoft Entra ID to block the IP.

Answer

Reset the user's password and require MFA re-registration.

Question 4

During an incident response, a SOC analyst identifies that a malicious PowerShell script was executed on multiple endpoints. The analyst needs to collect relevant files from all affected endpoints for further analysis. What should the analyst use?

Accepted Answer

Microsoft Defender for Endpoint Live Response.. Microsoft Defender for Endpoint Live Response allows analysts to remotely connect to endpoints and collect files, run scripts, and perform forensic actions in real time. This is the correct tool for gathering malicious PowerShell scripts from multiple affected endpoints during incident response.

Answer

Microsoft Defender for Cloud Apps file investigation.

Answer

Microsoft Purview eDiscovery.

Answer

Microsoft Sentinel incident investigation graph.

Question 5

Your organization uses Microsoft Sentinel. A new incident is created from a fusion alert that combines multiple low-severity alerts. The analyst needs to determine the entities involved. What should the analyst review?

Accepted Answer

The incident's entities tab.. The incident's entities tab in Microsoft Sentinel provides a consolidated view of all entities (such as users, hosts, IP addresses, and processes) that were identified by the fusion alert. Since fusion alerts combine multiple low-severity alerts, the entities tab is the direct place to see the aggregated entities involved in the incident, enabling the analyst to understand the scope and pivot for investigation.

Answer

The Sentinel Overview workbook.

Answer

The analytics rule that generated the incident.

Answer

The incident's timeline.

Question 6

A SOC team uses Microsoft Sentinel with Microsoft Defender XDR integration. An incident is created from a Defender for Endpoint alert. The analyst wants to run a KQL query across all affected devices without creating a new analytics rule. How can the analyst achieve this?

Accepted Answer

Use the incident's Logs blade to run a KQL query.. The incident's Logs blade in Microsoft Sentinel allows analysts to run KQL queries directly against the data ingested into the workspace, scoped to the incident's context. This enables ad-hoc investigation across all affected devices without modifying or creating any analytics rules, which would require rule authoring and deployment.

Answer

Modify the analytics rule that created the incident.

Answer

Use the Microsoft Sentinel Hunting blade.

Answer

Create a new workbook.

Question 7

During an incident, an analyst finds that a user's account was compromised and used to send spam. The analyst needs to revoke all active sessions for that user. What should the analyst do?

Accepted Answer

Revoke the user's sessions in Microsoft Entra ID.. Revoking the user's sessions in Microsoft Entra ID invalidates all active tokens and sessions, effectively ending any ongoing unauthorized access. Option A is incorrect because resetting the user's password does not revoke already-issued tokens or active sessions. Option C is incorrect because creating a Conditional Access policy can block future sign-ins but does not affect currently active sessions. Option D is incorrect because disabling the user account prevents new sign-ins but does not immediately invalidate existing sessions.

Answer

Reset the user's password.

Answer

Create a Conditional Access policy to block the user.

Answer

Disable the user account in Microsoft Entra ID.

Question 8

A security analyst receives a Microsoft Defender for Identity alert about a suspicious Kerberos attack. The analyst needs to contain the compromised account immediately. What should the analyst do?

Accepted Answer

Disable the user account in Microsoft Entra ID.. Disabling the account in Microsoft Entra ID immediately revokes the account's ability to authenticate, containing the attack. Option B is incorrect because removing the user from privileged groups does not prevent the account from authenticating or performing non-privileged actions; the compromised account could still be used for lateral movement. Option C is incorrect because requiring a password change at next sign-in does not stop current active sessions or ongoing attacks. Option D is incorrect because resetting the password might not invalidate existing Kerberos tickets or active sessions, and notifying the user does not provide immediate containment.

Answer

Remove the user from all privileged groups.

Answer

Require the user to change their password at next sign-in.

Answer

Reset the user's password and notify the user.

Question 9

Your organization uses Microsoft Defender for Cloud Apps and Microsoft Sentinel. An alert indicates that an external IP address is downloading large amounts of data from a SharePoint site containing confidential documents. The activity is coming from a valid user account that appears to be compromised. What should you do first to stop the data exfiltration?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Apply a Just-in-time VM access policy in Microsoft Defender for Cloud to deny all inbound and outbound traffic.. Applying a Just-in-time VM access policy in Microsoft Defender for Cloud denies all inbound and outbound traffic, effectively isolating the VM. Option A is incorrect because Azure Bastion provides RDP/SSH access, not isolation. Option B is incorrect because Azure Monitor creates alerts but does not directly isolate VMs. Option C is incorrect because an Azure Firewall rule blocks traffic for the entire network, not just the single VM.

Answer

Use Azure Bastion to connect to the VM and shut it down.

Answer

Use Azure Monitor to create an alert and then manually stop the VM.

Answer

Create an Azure Firewall rule to block traffic to the malicious IP.

Question 10

A SOC analyst is responding to a ransomware incident. The analyst identifies that the ransomware encrypted files on a file share and left a ransom note. The analyst needs to prevent the ransomware from spreading to other shares. Which action should the analyst take first?

Accepted Answer

Isolate the server from the network using Microsoft Defender for Endpoint's device isolation.. The immediate priority in a ransomware incident is containment to prevent lateral movement and further encryption. Microsoft Defender for Endpoint's device isolation feature disconnects the compromised server from the network while allowing communication with the Defender for Cloud backend, stopping the ransomware from spreading to other shares. This aligns with the NIST incident response framework's containment phase, which must occur before eradication or recovery actions.

Answer

Revoke the user's access to the file share.

Answer

Run a full antivirus scan on the server.

Answer

Restore the encrypted files from backup.

Question 11

Which TWO actions should an analyst take when a user reports receiving a suspicious email with an attachment? (Select TWO.)

Accepted Answer

Submit the email to Microsoft for analysis using the Submissions page in Microsoft 365 Defender.. When a user reports a suspicious email with an attachment, the analyst should submit the email to Microsoft for analysis using the Submissions page in Microsoft 365 Defender (Option A) to improve detection, and delete the email from the user's mailbox using Microsoft 365 Defender (Option C) to remove the threat. Opening the attachment (Option D) is unsafe and could compromise the system. Running a PowerShell script (Option B) is not a recommended security practice. Blocking the sender in Outlook (Option E) only affects that specific user and does not address the broader threat.

Answer

Run a PowerShell script to automatically forward the email to IT.

Answer

Open the attachment to verify if it is malicious.

Answer

Block the sender in the user's Outlook settings.

Question 12

Which THREE are valid incident classification categories in Microsoft Sentinel? (Select THREE.)

Accepted Answer

False Positive. In Microsoft Sentinel, incident classification categories include False Positive (A), True Positive (D), and Benign Positive (E). False Positive indicates an alert that was triggered incorrectly. True Positive indicates a verified security threat. Benign Positive indicates a confirmed alert that is not malicious, such as a legitimate penetration test. Malicious (B) and Informational (C) are not standard classification categories in Sentinel.

Answer

Malicious

Answer

Informational

Question 13

Refer to the exhibit. An analyst runs the query to identify the top 10 entities with the most malware alerts. However, the query returns no results. What is the most likely reason?

Accepted Answer

The AlertName field does not contain the substring 'Malware' (case-sensitive issue).. The query uses 'has' which is case-insensitive, but 'Malware' may not be the exact substring in the AlertName field. Option A is wrong because the query uses SecurityAlert table, which is correct. Option C is wrong because 'has' works on strings, not just exact matches. Option D is wrong because 'take 10' limits results, but would not cause zero results.

Answer

The SecurityAlert table does not contain the AlertName field.

Answer

The 'has' operator requires an exact match.

Answer

The 'take 10' operator returns no results because there are fewer than 10 alerts.

Question 14

Refer to the exhibit. An analyst runs Get-MpThreat on a device. Based on the output, what is the status of the threat?

Accepted Answer

The threat was blocked and did not execute.. The output of Get-MpThreat shows the threat's state as 'Blocked' and its execution status as 'Not Executed'. This indicates that Microsoft Defender Antivirus successfully prevented the threat from running on the device. Therefore, the threat was blocked and did not execute, making D the correct answer.

Answer

The threat executed and is now inactive.

Answer

The threat was quarantined and is still active.

Answer

The threat is currently active on the device.

Question 15

Refer to the exhibit. An analyst runs the command to install the Azure Monitor Agent on a VM. What is the primary purpose of installing this agent in the context of security incident response?

Accepted Answer

To collect security events and performance data for analysis in Microsoft Sentinel.. The Azure Monitor Agent collects logs and performance data from the VM, which can be ingested into Microsoft Sentinel for security analysis and incident response. Option B is incorrect because while the agent can be used with Microsoft Defender for Cloud, its primary purpose is data collection, not integration. Option C is incorrect because vulnerability scanning is performed by other services, such as Microsoft Defender for Cloud or third-party tools, not by the Azure Monitor Agent. Option D is incorrect because real-time malware protection is provided by endpoint protection solutions like Microsoft Defender Antivirus, not by the Azure Monitor Agent, which focuses on data collection.

Answer

To integrate the VM with Microsoft Defender for Cloud.

Answer

To scan the VM for vulnerabilities.

Answer

To enable real-time malware protection on the VM.