SC-200 Respond to security incidents Practice Test 17 — 15 Questions

Question 1

You are responding to a ransomware incident in Microsoft Defender XDR. You have identified that the malware encrypted files on several devices and then deleted the volume shadow copies. Which of the following actions should you take first to contain the incident?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Isolate affected devices using Microsoft Defender for Endpoint. Isolating affected devices using Microsoft Defender for Endpoint is the correct first action because it immediately cuts off network communication, preventing the ransomware from spreading laterally to other devices and stopping further encryption or deletion of shadow copies. Containment must precede remediation to limit the blast radius, and Defender for Endpoint's device isolation feature achieves this at the network level without requiring physical disconnection.

Answer

Run a remediation action to delete the detected malware

Answer

Restore encrypted files from backup

Answer

Run a full antivirus scan on all devices

Question 2

Your organization uses Microsoft Sentinel and Microsoft Defender for Cloud. You receive an alert from Defender for Cloud indicating that a virtual machine has a high severity vulnerability (CVE-2023-XXXX). You need to create an incident in Microsoft Sentinel and trigger a playbook to remediate the vulnerability. However, the incident is not being created automatically. What is the most likely cause?

Accepted Answer

The Microsoft Defender for Cloud connector in Microsoft Sentinel is not enabled or misconfigured. The Microsoft Defender for Cloud connector in Microsoft Sentinel is the bridge that forwards security alerts from Defender for Cloud to Sentinel. If this connector is not enabled or is misconfigured, Defender for Cloud alerts—including vulnerability alerts for VMs—will never reach Sentinel, so no incident can be created automatically. Without the connector, the data source is disconnected, and Sentinel has no trigger to generate an incident or invoke a playbook.

Answer

An analytics rule with a matching severity threshold has not been created

Answer

The free trial of Microsoft Sentinel has expired

Answer

The playbook does not have the correct permissions on the target VM

Question 3

Your organization uses Microsoft Defender for Identity. You receive an alert about a suspicious Kerberos activity that may indicate a golden ticket attack. Which of the following actions should you take to investigate this alert?

Accepted Answer

Review the alert details in the Microsoft Defender for Identity portal and analyze related events. The first step in investigating a golden ticket attack alert from Microsoft Defender for Identity is to review the alert details and analyze the related events within the Defender for Identity portal. This allows you to understand the scope of the suspicious Kerberos activity, identify the affected accounts, and correlate the alert with other security signals before taking any remediation actions.

Answer

Immediately reset the krbtgt account password twice

Answer

Export the Active Directory event logs to Microsoft Sentinel for analysis

Answer

Disable the user account that triggered the alert

Question 4

Your organization uses Microsoft Sentinel with the UEBA (User and Entity Behavior Analytics) feature enabled. A security analyst notices that a user account has been flagged with an anomaly indicating a possible compromised credential. Which entity type in Microsoft Sentinel's UEBA is most relevant for this alert?

Accepted Answer

User account. The UEBA anomaly alert for a possible compromised credential is specifically tied to the User account entity because UEBA profiles user behavior over time and detects deviations from established baselines, such as unusual logon times, locations, or impossible travel. The alert directly reflects a risk to the user's identity, making the User account the most relevant entity type for this scenario.

Answer

Device

Answer

Application

Answer

IP address

Question 5

Your organization has deployed Microsoft Sentinel and uses the Microsoft 365 connector to ingest audit logs. You receive an alert from Microsoft Defender for Office 365 about a phishing email that was delivered to a user's inbox. You need to create an incident in Sentinel and automatically quarantine the email. What is the most efficient way to achieve this?

Accepted Answer

Create an automation rule in Microsoft Sentinel that is triggered when this specific alert is generated, and associate a playbook that uses the Microsoft 365 Defender connector to quarantine the email. Automation rules in Microsoft Sentinel can be triggered by specific alert generation (e.g., from Microsoft Defender for Office 365) and can execute a playbook. The playbook uses the Microsoft 365 Defender connector, which includes the 'Quarantine email' action, enabling automated quarantine without manual intervention. This is the most efficient method as it combines automatic incident creation with immediate remediation.

Answer

Use Microsoft Defender for Cloud Apps to investigate the alert and manually quarantine the email

Answer

Create a custom analytics rule that triggers when an alert is generated, and configure the rule to run a playbook that quarantines the email

Answer

Manually create an incident in Microsoft Sentinel and then run a playbook to quarantine the email

Question 6

Your organization uses Microsoft Defender for Cloud to protect hybrid cloud workloads. An alert indicates that a container in Azure Kubernetes Service (AKS) is running a privileged container. Which response action should you take first?

Accepted Answer

Investigate the alert details in Microsoft Defender for Cloud. When a Microsoft Defender for Cloud alert indicates a privileged container in AKS, the first response action should be to investigate the alert details within Defender for Cloud. This allows you to assess the scope, impact, and context of the alert—such as which container, namespace, and pod is involved, and whether it is a false positive—before taking any disruptive remediation steps. Prematurely disabling, deleting, or restarting resources could destroy forensic evidence and escalate the incident unnecessarily.

Answer

Disable the container immediately

Answer

Restart the AKS cluster

Answer

Delete the container and its image

Question 7

Your organization has Microsoft Defender for Endpoint deployed. A security analyst receives an alert about a suspicious PowerShell command executed on a device. The analyst needs to investigate the process tree. Which feature should the analyst use?

Accepted Answer

Timeline (process timeline). The Timeline (process timeline) feature in Microsoft Defender for Endpoint allows analysts to view the full process tree, including parent-child relationships, command lines, and timestamps for events like PowerShell execution. This is the correct tool for investigating how a suspicious command was launched and what processes preceded it.

Answer

Device isolation

Answer

Live response

Answer

Advanced hunting

Question 8

Your organization uses Microsoft Sentinel and has enabled the Microsoft 365 Defender connector. You want to automatically assign incidents to a specific analyst team based on the incident severity and type. Which component should you configure?

Accepted Answer

Automation rule in Microsoft Sentinel. Automation rules in Microsoft Sentinel allow you to automatically assign incidents to specific teams based on conditions like severity and type. This is the correct component because it provides a no-code, rule-based engine for incident management tasks, including assignment, without requiring custom logic or external automation.

Answer

Analytics rule in Microsoft Sentinel

Answer

Workbook in Microsoft Sentinel

Answer

Custom playbook in Microsoft Sentinel

Question 9

Which TWO of the following are valid response actions that can be taken on a device from Microsoft Defender for Endpoint? (Choose two.)

Accepted Answer

Run antivirus scan. Microsoft Defender for Endpoint includes a 'Run antivirus scan' response action that initiates a Microsoft Defender Antivirus scan on the device. This action can be triggered from the Microsoft 365 Defender portal to detect and remediate malware or suspicious files without requiring user interaction.

Answer

Quarantine email

Answer

Disable user account

Answer

Reset user password

Question 10

Which THREE of the following are valid incident management capabilities in Microsoft Sentinel? (Choose three.)

Accepted Answer

Assign incidents to analysts or teams. A is correct because Microsoft Sentinel allows incident owners to be assigned directly to an analyst or a team via the 'Owner' field in the incident details pane. This assignment is used for tracking responsibility, SLA enforcement, and escalation workflows within the Security Operations (SecOps) lifecycle.

Answer

Create playbooks to automate incident response

Answer

Create workbooks to visualize incident trends

Question 11

Which TWO of the following are valid sources for creating incidents in Microsoft Sentinel? (Choose two.)

Accepted Answer

Microsoft 365 Defender alerts. Microsoft 365 Defender alerts are a valid source for creating incidents in Microsoft Sentinel because Sentinel can ingest alerts from Microsoft 365 Defender (which includes Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps) via the Microsoft 365 Defender connector. When these alerts are ingested, Sentinel can automatically create incidents based on them, enabling unified incident management across the Microsoft security ecosystem.

Answer

Hunting query results

Answer

Workbook creation

Answer

Playbook execution

Question 12

Refer to the exhibit. You are investigating incidents related to suspicious process injection. The KQL query above is run in Microsoft Sentinel. What is the purpose of this query?

Accepted Answer

To get a count of 'Suspicious process injection' alerts grouped by compromised entity and severity, sorted by count. The query uses `summarize` with `count()` to aggregate alerts by `CompromisedEntity` and `Severity`, then sorts by the count in descending order. This directly produces a count of 'Suspicious process injection' alerts grouped by compromised entity and severity, sorted by count. The `where` clause filters for the specific alert name, and the time range is implicitly the last 7 days (as shown in the exhibit's query editor).

Answer

To find alerts that occurred within a specific time range

Answer

To list all alerts of type 'Suspicious process injection' in the last 7 days

Answer

To identify the compromised entities with the highest severity alerts

Question 13

Refer to the exhibit. You are configuring an automation rule in Microsoft Sentinel. The JSON snippet defines an automation rule. What is the expected behavior of this rule?

Accepted Answer

It runs a playbook to quarantine an email when a specific alert is generated. The automation rule is triggered when a specific alert is generated (as defined by the trigger condition), and it runs a playbook that contains logic to quarantine an email. In Microsoft Sentinel, automation rules can be configured to trigger on alert creation and execute a playbook, which in this case performs the quarantine action.

Answer

It creates an incident when a phishing email is detected

Answer

It sends an email to the security team when an incident is created

Answer

It modifies the incident severity when a playbook runs

Question 14

Refer to the exhibit. You are reviewing an alert in Microsoft Defender for Endpoint. The alert details are shown. Which of the following actions should you take first?

Accepted Answer

Investigate the device and the alert details. The first step in incident response is to investigate the alert details and the affected device to understand the scope and severity of the threat. Without investigation, you cannot determine whether the alert is a true positive, whether isolation is appropriate, or which remediation steps are needed. Microsoft Defender for Endpoint provides a rich investigation experience, including the alert story, device timeline, and related events, which must be reviewed before taking any containment or remediation actions.

Answer

Mark the alert as a false positive

Answer

Initiate device isolation to contain the threat

Answer

Run a full antivirus scan on the device

Question 15

A SOC analyst receives an alert from Microsoft Defender for Cloud Apps indicating that a user downloaded 500 GB of data from SharePoint to an unmanaged device. The user has no history of such behavior. What is the best first step in the incident response process?

Accepted Answer

Disable the user account in Microsoft Entra ID.. The immediate priority in an incident response process for a potential data exfiltration scenario is to contain the threat. Disabling the user account in Microsoft Entra ID (formerly Azure AD) is the fastest way to revoke access to SharePoint and other cloud resources, preventing further unauthorized data transfer. This aligns with the 'containment' phase of the NIST incident response lifecycle, before any investigation or remediation steps.

Answer

Run a full antivirus scan on the unmanaged device.

Answer

Contact the user to verify if the download was intentional.

Answer

Create a detection rule for similar behavior in Microsoft Sentinel.