SC-200 Respond to security incidents Practice Test 17 — 15 Questions

Question 1

Your organization uses Microsoft Defender for Endpoint. A user reports that their device is running slowly and exhibiting unusual network activity. You run a live response session and find a suspicious process running. Which action should you take first to contain the threat?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Isolate the device from the network.. Isolating the device from the network immediately prevents the threat from spreading to other devices while you investigate further. Option A is wrong because collecting a memory dump does not contain the threat; it is for analysis. Option B is wrong because terminating the process alone does not prevent re-execution or lateral movement. Option D is wrong because adding a firewall rule is too slow and may not block all lateral movement; isolation is more comprehensive.

Answer

Collect a full memory dump for analysis.

Answer

Terminate the suspicious process.

Answer

Add a firewall rule to block outbound traffic from the device.

Question 2

You are investigating an incident in Microsoft Sentinel where a user account was used to sign in from an unfamiliar location and then accessed multiple sensitive files. Which step is most important to perform first?

Accepted Answer

Disable the user account and reset the password.. Confirming account compromise and immediately disabling the user account is the highest priority to stop further malicious activity. Resetting the password prevents the attacker from using the compromised credentials. Option A is incorrect because blocking the IP address alone may be ineffective if the attacker uses proxies, and it does not secure the account. Option B is incorrect because checking firewall logs is a secondary forensic step that does not address the immediate threat. Option C is incorrect because reviewing file permissions should be done after securing the account.

Answer

Block the IP address of the unfamiliar location.

Answer

Check firewall logs for related network traffic.

Answer

Review file permissions on the accessed files.

Question 3

During a security incident, you need to create a custom detection rule in Microsoft Sentinel to alert on multiple failed logins followed by a successful login from the same IP within 10 minutes. Which KQL function should you use to group events by IP address and time window?

Accepted Answer

summarize. `summarize` with `make_list` or `count` is used to aggregate events within a time window. Option A is wrong because `join` combines tables but does not aggregate within a window. Option B is wrong because `extend` adds computed columns but does not group. Option C is wrong because `project` selects columns, not aggregates.

Answer

join

Answer

extend

Answer

project

Question 4

Your organization uses Microsoft Defender for Cloud Apps. An alert indicates that a user is downloading large amounts of data from SharePoint Online. What should you do first to investigate?

Accepted Answer

Review the user's activity log in Defender for Cloud Apps.. The first step in investigating a potential data exfiltration alert is to review the user's activity log in Defender for Cloud Apps. This log provides granular details about the specific files downloaded, the volume of data, the time frame, and the source IP address, allowing you to validate whether the activity is anomalous or legitimate before taking any restrictive action.

Answer

Govern the user by suspending their account.

Answer

Create a new IP address range for the organization.

Answer

Block the SharePoint Online app for all users in Defender for Cloud Apps.

Question 5

You receive a Microsoft Defender for Identity alert for a suspicious Kerberos ticket request. What is the most likely intent of this attack?

Accepted Answer

Credential theft to gain persistent access.. A suspicious Kerberos ticket request in Microsoft Defender for Identity typically indicates a Golden Ticket or Silver Ticket attack, which are forms of credential theft aimed at gaining persistent access. Option A is incorrect because lateral movement often involves other techniques like pass-the-hash, not directly a suspicious ticket request. Option C is incorrect because denial of service on domain controllers is not the primary goal of such ticket attacks. Option D is incorrect because while data exfiltration could be a secondary objective, the immediate intent of the ticket attack is credential theft and persistence.

Answer

Lateral movement using compromised service accounts.

Answer

Denial of service on domain controllers.

Answer

Data exfiltration from SharePoint.

Question 6

Refer to the exhibit. You are investigating a malware outbreak in Microsoft Sentinel. The KQL query returns no results. What is the most likely reason?

Accepted Answer

The alert name in the query does not match the actual alert name.. The alert name must match exactly; 'Malware detected' might not be the correct name. Option A is wrong because if no alerts were generated, the table would be empty but the query would still run. Option C is wrong because the syntax is correct. Option D is wrong because the time filter is not the issue.

Answer

The time range is too restrictive.

Answer

No alerts were generated in the last hour.

Answer

The query syntax is incorrect.

Question 7

Your organization uses Microsoft Defender XDR. You receive an automated investigation that found a malicious file on a device. The investigation recommends 'Block the file'. What does this action do?

Accepted Answer

Adds the file hash to the block list in Microsoft Defender for Endpoint.. Blocking the file adds it to the global indicator of compromise (IOC) list, preventing future execution. Option B is wrong because it does not delete the file from all devices. Option C is wrong because it does not isolate the device. Option D is wrong because it does not scan other devices automatically.

Answer

Isolates the device where the file was found.

Answer

Initiates a full antivirus scan on all devices.

Answer

Deletes the file from all devices in the organization.

Question 8

During an incident response, you need to collect forensic evidence from a compromised Windows device using Microsoft Defender for Endpoint live response. Which command should you use to gather running processes?

Accepted Answer

processes. 'processes' is a built-in command in Microsoft Defender for Endpoint live response to list running processes. Option A is wrong because 'dir' lists files and directories. Option B is wrong because 'reg query' accesses the Windows registry. Option C is wrong because 'netstat' shows network connections and statistics.

Answer

dir

Answer

reg query

Answer

netstat

Question 9

Your Microsoft Sentinel workspace receives logs from multiple sources. You need to ensure that an incident response playbook is triggered automatically when a specific alert is generated. What should you create?

Accepted Answer

An automation rule.. An automation rule in Microsoft Sentinel is specifically designed to trigger incident response playbooks automatically when an alert is generated. It allows you to define conditions based on alert properties and then invoke a Logic App playbook without manual intervention. This is the correct mechanism for automating incident response actions in Sentinel.

Answer

A data connector.

Answer

An analytics rule.

Answer

A new Logic App.

Question 10

Which TWO actions can you perform in Microsoft Defender XDR's automated investigation and response (AIR) to contain a threat? (Select TWO.)

Accepted Answer

Isolate a device from the network.. Microsoft Defender XDR's automated investigation and response (AIR) can isolate devices from the network to contain threats. Option E is correct because AIR can automatically soft-delete email messages that are identified as malicious. Option B is incorrect because manually adding a firewall rule is not an automated AIR action. Option C is incorrect because disabling a user account is not performed by AIR; it requires manual intervention. Option D is incorrect because resetting a password is not an AIR capability.

Answer

Add a firewall rule to block an IP.

Answer

Disable a user account.

Answer

Reset a user's password.

Question 11

Which THREE are valid investigation actions in Microsoft Sentinel? (Select THREE.)

Accepted Answer

View related entities such as IP addresses.. Viewing related entities such as IP addresses is a fundamental investigation action in Microsoft Sentinel. Option C is correct because viewing related incidents helps in correlating events. Option E is correct because viewing related alerts provides context. Option B is incorrect because running a playbook is a remediation action, not an investigation action. Option D is incorrect because modifying an analytics rule is a configuration task outside the investigation scope.

Answer

Run a playbook.

Answer

Modify an analytics rule.

Question 12

Which TWO are valid methods to submit a file for analysis in Microsoft Defender for Endpoint? (Select TWO.)

Accepted Answer

Submit a file using the Microsoft 365 Defender API.. The correct answers are B and E. Option B is correct because the Microsoft 365 Defender API provides a method to submit files for analysis programmatically. Option E is correct because the Microsoft 365 Defender portal allows manual file submission through the 'Submit a file for analysis' feature. Option A is incorrect because live response is used for collecting files from devices, not submitting for analysis. Option C is incorrect because Microsoft Sentinel is a SIEM and not designed for file submissions to Defender for Endpoint. Option D is incorrect because Microsoft Intune focuses on device management and cannot submit files for analysis.

Answer

Submit a file via live response.

Answer

Submit a file through Microsoft Sentinel.

Answer

Submit a file via Microsoft Intune.

Question 13

Refer to the exhibit. You are creating an automation rule in Microsoft Sentinel to trigger a playbook when an alert is created. However, the playbook does not run. What is the most likely cause?

Accepted Answer

The playbook's resource ID is incorrect.. The automation rule may fail to trigger the playbook if the `logicAppResourceId` (or playbook resource ID) is incorrect, missing, or if the playbook is not accessible. Option A is incorrect because if the JSON syntax were invalid, the rule would likely fail to save or create. Option C is incorrect because while permissions are required, the most common cause is an incorrect resource ID, not a lack of permissions. Option D is incorrect because the `displayName` does not need to be unique for the rule to function.

Answer

The JSON syntax is invalid.

Answer

The automation rule lacks permissions to the playbook.

Answer

The displayName is not unique.

Question 14

Refer to the exhibit. You run this KQL query in Microsoft Defender XDR to detect suspicious PowerShell activity. Why might this query generate many false positives?

Accepted Answer

Legitimate administrators often use encoded PowerShell commands.. Legitimate administrators often use encoded PowerShell commands, which would match this query and generate false positives. Option A is wrong because the time range shown in the exhibit (e.g., 7 days) is not excessively broad for hunting. Option B is wrong because the query is specific to encoded commands, but it does not miss attacks; it targets a specific technique. Option D is wrong because, while filtering by user could reduce noise, the main reason for false positives is that encoded commands are used legitimately, not because of the absence of user filtering.

Answer

The time range is too broad.

Answer

The query is too specific and misses many attacks.

Answer

The query does not filter by user.

Question 15

After containing a security incident, what is the most important next step in the incident response process?

Accepted Answer

Conduct a post-incident review.. After containing a security incident, the next critical step is to conduct a post-incident review (also known as lessons learned). This phase helps the organization understand what went wrong, improve incident response processes, and prevent future incidents. Option A (monitor for signs of recurrence) is an ongoing activity but not the immediate next step after containment. Option B (recover systems to normal operation) should occur after eradication, not immediately after containment. Option C (eradicate the threat) is actually the step that comes directly after containment, but the question asks for the most important next step, emphasizing the value of reviewing and improving response procedures.

Answer

Monitor for signs of recurrence.

Answer

Recover systems to normal operation.

Answer

Eradicate the threat from all systems.