SC-200 Respond to security incidents Practice Test 17 — 15 Questions

Question 1

A security analyst receives a Microsoft Defender for Cloud Apps alert about a suspicious sign-in from an IP address in a sanctioned app. The analyst needs to immediately prevent further access from that IP. What should the analyst do?

Accepted Answer

Create an IP address-based access policy in Microsoft Defender for Cloud Apps.. Option C is correct because creating an IP-based access policy in Defender for Cloud Apps allows blocking the specific IP. Option A is wrong because Conditional Access policies are managed in Microsoft Entra ID, not directly from the alert. Option B is wrong because resetting the user's password does not block the IP. Option D is wrong because a mailbox rule cannot block IP access.

Answer

Create a mailbox rule to delete emails from that IP.

Answer

Create a Conditional Access policy in Microsoft Entra ID to block the IP.

Answer

Reset the user's password and require MFA re-registration.

Question 2

During an incident response, a SOC analyst identifies that a malicious PowerShell script was executed on multiple endpoints. The analyst needs to collect relevant files from all affected endpoints for further analysis. What should the analyst use?

Accepted Answer

Microsoft Defender for Endpoint Live Response.. Option D is correct because Microsoft Defender for Endpoint's Live Response allows collecting files from endpoints. Option A is wrong because Microsoft Defender for Cloud Apps does not collect files from endpoints. Option B is wrong because Microsoft Sentinel is for SIEM, not live file collection. Option C is wrong because Microsoft Purview is for compliance.

Answer

Microsoft Defender for Cloud Apps file investigation.

Answer

Microsoft Purview eDiscovery.

Answer

Microsoft Sentinel incident investigation graph.

Question 3

An analyst is investigating a phishing campaign that targeted multiple users. The analyst needs to identify if any users clicked a malicious link in the email. Which Microsoft Defender for Office 365 feature should be used?

Accepted Answer

Threat Explorer. Option A is correct because the Threat Explorer in Defender for Office 365 shows click activity on URLs. Option B is wrong because Safe Attachments checks attachments, not links. Option C is wrong because Safe Links protects in real-time but does not provide historical click data. Option D is wrong because the Attack Simulator is for testing, not investigation.

Answer

Safe Attachments

Answer

Attack Simulator

Answer

Safe Links

Question 4

Your organization uses Microsoft Sentinel. A new incident is created from a fusion alert that combines multiple low-severity alerts. The analyst needs to determine the entities involved. What should the analyst review?

Accepted Answer

The incident's entities tab.. Option C is correct because the incident entities tab lists all entities (users, IPs, hosts) related to the incident. Option A is wrong because the analytics rule is the source, not entities. Option B is wrong because the workbook may not show entities for a specific incident. Option D is wrong because the incident timeline shows events, not entities.

Answer

The Sentinel Overview workbook.

Answer

The analytics rule that generated the incident.

Answer

The incident's timeline.

Question 5

A SOC team uses Microsoft Sentinel with Microsoft Defender XDR integration. An incident is created from a Defender for Endpoint alert. The analyst wants to run a KQL query across all affected devices without creating a new analytics rule. How can the analyst achieve this?

Accepted Answer

Use the incident's Logs blade to run a KQL query.. Option B is correct because the incident's Logs blade allows running ad-hoc KQL queries. Option A is wrong because the analytics rule is for scheduled queries. Option C is wrong because the workbook is for visualizations. Option D is wrong because the hunting blade is for proactive hunting, not incident-specific.

Answer

Modify the analytics rule that created the incident.

Answer

Use the Microsoft Sentinel Hunting blade.

Answer

Create a new workbook.

Question 6

During an incident, an analyst finds that a user's account was compromised and used to send spam. The analyst needs to revoke all active sessions for that user. What should the analyst do?

Accepted Answer

Revoke the user's sessions in Microsoft Entra ID.. Option C is correct because revoking sessions in Microsoft Entra ID invalidates all tokens. Option A is wrong because resetting password does not revoke existing sessions. Option B is wrong because disabling the user stops new sign-ins but may not revoke current sessions. Option D is wrong because Conditional Access policies do not revoke sessions.

Answer

Reset the user's password.

Answer

Create a Conditional Access policy to block the user.

Answer

Disable the user account in Microsoft Entra ID.

Question 7

A security analyst receives a Microsoft Defender for Identity alert about a suspicious Kerberos attack. The analyst needs to contain the compromised account immediately. What should the analyst do?

Accepted Answer

Disable the user account in Microsoft Entra ID.. Option A is correct because disabling the account in Microsoft Entra ID stops authentication. Option B is wrong because resetting password without disabling may allow ongoing attacks. Option C is wrong because removing from groups does not prevent authentication. Option D is wrong because the user's own password reset may not be effective.

Answer

Remove the user from all privileged groups.

Answer

Require the user to change their password at next sign-in.

Answer

Reset the user's password and notify the user.

Question 8

Your organization uses Microsoft Defender for Cloud to protect Azure resources. A security alert indicates that a virtual machine (VM) is communicating with a known malicious IP. The analyst needs to isolate the VM from the network to prevent further data exfiltration. What should the analyst do?

Accepted Answer

Apply a Just-in-time VM access policy in Microsoft Defender for Cloud to deny all inbound and outbound traffic.. Option B is correct because Defender for Cloud's Just-in-time VM access can create a network security group (NSG) rule to deny all traffic, effectively isolating the VM. Option A is wrong because Azure Bastion provides RDP/SSH access, not isolation. Option C is wrong because Azure Firewall rules apply to the entire network, not a single VM. Option D is wrong because Azure Monitor does not isolate VMs.

Answer

Use Azure Bastion to connect to the VM and shut it down.

Answer

Use Azure Monitor to create an alert and then manually stop the VM.

Answer

Create an Azure Firewall rule to block traffic to the malicious IP.

Question 9

A SOC analyst is responding to a ransomware incident. The analyst identifies that the ransomware encrypted files on a file share and left a ransom note. The analyst needs to prevent the ransomware from spreading to other shares. Which action should the analyst take first?

Accepted Answer

Isolate the server from the network using Microsoft Defender for Endpoint's device isolation.. Option D is correct because isolating the affected server from the network stops the spread. Option A is wrong because restoring files does not prevent spread. Option B is wrong because antivirus may not detect unknown ransomware. Option C is wrong because revoking user access does not stop the ransomware process.

Answer

Revoke the user's access to the file share.

Answer

Run a full antivirus scan on the server.

Answer

Restore the encrypted files from backup.

Question 10

Which TWO actions should an analyst take when a user reports receiving a suspicious email with an attachment? (Select TWO.)

Accepted Answer

Submit the email to Microsoft for analysis using the Submissions page in Microsoft 365 Defender.. Option A is correct because submitting the email to Microsoft for analysis helps improve detection. Option D is correct because deleting the email from the mailbox removes it from the user's environment. Option B is wrong because opening the attachment would be unsafe. Option C is wrong because blocking the sender in Outlook only affects that user. Option E is wrong because running a script is not recommended.

Answer

Run a PowerShell script to automatically forward the email to IT.

Answer

Open the attachment to verify if it is malicious.

Answer

Block the sender in the user's Outlook settings.

Question 11

Which THREE steps are part of the containment phase of incident response in Microsoft Sentinel? (Select THREE.)

Accepted Answer

Disable compromised user accounts in Microsoft Entra ID.. Option A is correct because isolating affected resources prevents further damage. Option C is correct because blocking indicators helps stop attacks. Option E is correct because disabling compromised accounts stops unauthorized access. Option B is wrong because collecting forensic data is part of investigation, not containment. Option D is wrong because restoring from backup is part of recovery.

Answer

Collect forensic data from affected endpoints.

Answer

Restore encrypted files from backup.

Question 12

Which TWO are valid incident classification categories in Microsoft Sentinel? (Select TWO.)

Accepted Answer

True Positive. Option B is correct because True Positive is a valid classification. Option E is correct because Benign Positive is also a valid classification. Option A is wrong because False Positive is a classification, but not listed as a category in the question context? Actually, False Positive is also valid, but we need exactly two correct. According to Microsoft Sentinel incident classification, True Positive, False Positive, Benign Positive are common. But the question asks for TWO, and the correct ones here are True Positive and Benign Positive. Option C is wrong because Malicious is not a standard classification. Option D is wrong because Informational is not a classification.

Answer

False Positive

Answer

Malicious

Answer

Informational

Question 13

Refer to the exhibit. An analyst runs the query to identify the top 10 entities with the most malware alerts. However, the query returns no results. What is the most likely reason?

Accepted Answer

The AlertName field does not contain the substring 'Malware' (case-sensitive issue).. Option B is correct because the query uses 'has' which is case-insensitive, but 'Malware' may not be the exact substring in the AlertName field. Option A is wrong because the query uses SecurityAlert table, which is correct. Option C is wrong because 'has' works on strings, not just exact matches. Option D is wrong because 'take 10' limits results, but would not cause zero results.

Answer

The SecurityAlert table does not contain the AlertName field.

Answer

The 'has' operator requires an exact match.

Answer

The 'take 10' operator returns no results because there are fewer than 10 alerts.

Question 14

Refer to the exhibit. An analyst runs Get-MpThreat on a device. Based on the output, what is the status of the threat?

Accepted Answer

The threat was blocked and did not execute.. Option C is correct because DidThreatExecute is False and IsActive is False, meaning the threat was blocked before execution. Option A is wrong because Action:6 (Quarantine) indicates it was handled. Option B is wrong because IsActive is False. Option D is wrong because IsActive is False.

Answer

The threat executed and is now inactive.

Answer

The threat was quarantined and is still active.

Answer

The threat is currently active on the device.

Question 15

Refer to the exhibit. An analyst runs the command to install the Azure Monitor Agent on a VM. What is the primary purpose of installing this agent in the context of security incident response?

Accepted Answer

To collect security events and performance data for analysis in Microsoft Sentinel.. Option A is correct because the Azure Monitor Agent collects logs and performance data, which can be used for security analysis. Option B is wrong because the agent does not block threats. Option C is wrong because Defender for Cloud is a separate service. Option D is wrong because the agent is for data collection, not vulnerability scanning.

Answer

To integrate the VM with Microsoft Defender for Cloud.

Answer

To scan the VM for vulnerabilities.

Answer

To enable real-time malware protection on the VM.