SC-200 Respond to security incidents Practice Test 18 — 15 Questions

Question 1

During an incident investigation, you find that a compromised account was used to log into a virtual machine via RDP from an IP address in a sanctioned country. The VM has Microsoft Defender for Endpoint installed. Which data source in Microsoft Sentinel would you query to see the RDP connection events?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SecurityEvent. The SecurityEvent table in Microsoft Sentinel collects Windows security events from machines with the Log Analytics agent or Azure Monitor Agent, including Event ID 4625 (failed logon) and Event ID 4624 (successful logon). Since the compromised account used RDP to log into a VM with Defender for Endpoint installed, the RDP connection events are captured as Windows security log events and stored in the SecurityEvent table. This is the correct data source for querying local authentication events on the VM itself.

Answer

DeviceLogonEvents (Microsoft Defender XDR)

Answer

CommonSecurityLog

Answer

SigninLogs (Microsoft Entra ID)

Question 2

You have been tasked with creating an automated response in Microsoft Sentinel for incidents involving lateral movement. Which Azure service allows you to run a playbook to automatically isolate a compromised VM?

Accepted Answer

Azure Logic Apps. Azure Logic Apps is the correct answer because it provides the workflow automation engine that powers Microsoft Sentinel playbooks. When a lateral movement incident is detected, a Logic Apps-based playbook can execute automated actions such as isolating a compromised VM via Azure Network Security Groups (NSGs) or Azure Firewall rules, using connectors like the Azure VM or Azure Resource Manager. This enables a no-code or low-code response directly from Sentinel without manual intervention.

Answer

Kusto Query Language (KQL)

Answer

Microsoft Defender XDR advanced hunting

Answer

Azure Event Hubs

Question 3

Which TWO actions should you take when handling a confirmed ransomware incident in an environment protected by Microsoft Defender for Endpoint?

Accepted Answer

Block the ransomware file hash using threat intelligence indicators in Microsoft Defender.. Blocking the ransomware file hash via threat intelligence indicators in Microsoft Defender for Endpoint (MDE) immediately prevents further execution of that known malicious file across all endpoints in the environment, leveraging the built-in TI indicator feature. Option B is correct because initiating device isolation from the MDE console disconnects the affected device from the network while maintaining connectivity to the MDE service, containing the spread of ransomware without losing visibility or control.

Answer

Disable Windows Defender real-time protection.

Answer

Submit the ransomware sample to Microsoft for analysis.

Answer

Reimage all affected servers immediately.

Question 4

Which TWO are legitimate sources of threat intelligence that can be ingested into Microsoft Sentinel?

Accepted Answer

STIX/TAXII threat intelligence feeds. A is correct because STIX/TAXII is an open-source standard for sharing cyber threat intelligence (CTI). Microsoft Sentinel can ingest threat indicators from any TAXII 2.0 or 2.1 server using the built-in Threat Intelligence - TAXII data connector, allowing organizations to consume structured threat feeds (e.g., from MITRE ATT&CK or third-party providers) directly into Sentinel for correlation and alerting.

Answer

Exchange Online Protection

Answer

Microsoft Intune

Answer

Microsoft Purview Compliance Manager

Question 5

Refer to the exhibit. The KQL query is used in a Microsoft Sentinel scheduled alert rule. What scenario does this query detect?

Accepted Answer

Attempts to sign in with disabled user accounts.. The KQL query filters for `ResultType == 50057`, which specifically indicates a sign-in attempt by a disabled user account in Microsoft Entra ID. This result type is unique to disabled accounts and does not cover MFA denials (53003), invalid password attempts (50126), or brute force patterns. Therefore, the query detects attempts to sign in with disabled user accounts.

Answer

Multiple MFA denial events from a single user.

Answer

Brute force attacks against Azure AD accounts using invalid passwords.

Answer

Brute force attacks from a single IP address against multiple accounts.

Question 6

An incident in Microsoft Sentinel has been classified as a true positive. According to the incident response process, what should the analyst do next?

Accepted Answer

Contain the incident to prevent further damage.. After classifying an incident as a true positive in Microsoft Sentinel, the immediate next step in the incident response process is to contain the incident to prevent further damage or lateral movement. This aligns with the NIST SP 800-61 incident response lifecycle, where containment follows identification and classification. In Sentinel, containment actions might involve disabling compromised accounts, blocking IPs via Azure Firewall, or isolating affected resources using Microsoft Defender for Cloud or Azure policies.

Answer

Perform a root cause analysis.

Answer

Create a new analytic rule to detect similar activity.

Answer

Document the incident in a detailed report.

Question 7

During an investigation, you need to check if any user has been assigned privileged roles in Microsoft Entra ID outside of normal business hours. Which data source would provide this information?

Accepted Answer

AuditLogs (Microsoft Entra ID). AuditLogs in Microsoft Entra ID (formerly Azure AD) capture all directory-level changes, including privileged role assignments (e.g., Global Administrator, Privileged Role Administrator) along with the timestamp and user who performed the action. This allows you to filter for role assignments occurring outside normal business hours, making it the correct data source for this investigation.

Answer

OfficeActivity (Office 365)

Answer

SecurityEvent (Windows Event Logs)

Answer

SigninLogs (Microsoft Entra ID)

Question 8

You are investigating an incident where a user reported receiving a suspicious email with a malicious attachment. Microsoft Defender for Office 365 did not block it. The email originated from a known malicious sender domain. What configuration should you check first?

Accepted Answer

Anti-phishing policy in Microsoft Defender for Office 365. The anti-phishing policy in Microsoft Defender for Office 365 is the primary configuration that evaluates sender reputation, impersonation attempts, and spoof intelligence. Since the email originated from a known malicious sender domain and was not blocked, the anti-phishing policy's spoof settings or impersonation protection may be misconfigured or not applied to the affected user. This policy directly controls how Defender handles emails from malicious domains, making it the first place to check.

Answer

User-reported message settings

Answer

SPF record for the sender domain

Answer

Safe Attachments policy

Question 9

You receive an incident in Microsoft Sentinel that is a low-confidence alert from Microsoft Defender for Identity. What should be your first step?

Accepted Answer

Investigate the alert by reviewing related entities and logs.. A low-confidence alert from Microsoft Defender for Identity indicates a potential but uncertain threat. The first step should always be to investigate the alert by reviewing related entities and logs to gather context and determine if the alert is a true positive or false positive. Prematurely closing, escalating, or isolating without investigation risks missing a real threat or causing unnecessary disruption.

Answer

Close the incident as a false positive.

Answer

Escalate to senior management.

Answer

Isolate the affected account immediately.

Question 10

After a security incident, you need to collect forensic evidence from a Windows 10 machine. Which Microsoft tool should you use to create a memory dump?

Accepted Answer

Microsoft Defender for Endpoint Live Response. Microsoft Defender for Endpoint Live Response provides a `dump` command that can capture a full memory dump from a live Windows 10 system without causing a crash. This preserves volatile forensic evidence such as running processes, network connections, and encryption keys. In contrast, the Microsoft Crash Dump Tool (NotMyFault or Sysinternals) is designed to trigger a system crash (BSOD) for debugging purposes, which is destructive and not appropriate for forensic collection. Therefore, for a security incident requiring a memory dump without system disruption, Live Response is the correct tool.

Answer

Remote Desktop Protocol (RDP)

Answer

Microsoft Crash Dump Tool (e.g., NotMyFault or Sysinternals tools)

Answer

Microsoft Defender for Cloud Apps

Question 11

Refer to the exhibit. This JSON snippet is from an Azure Web Application Firewall (WAF) policy. What does this rule do?

Accepted Answer

Blocks traffic originating from IP address 10.0.0.1.. The JSON snippet defines a WAF rule with a match condition that checks if the client IP address equals 10.0.0.1. The action is set to 'Block', meaning any request from that specific IP address will be denied. Option B correctly identifies this behavior.

Answer

Blocks traffic from the entire 10.0.0.0/24 subnet.

Answer

Logs traffic from IP address 10.0.0.1 without blocking.

Answer

Allows traffic from IP address 10.0.0.1.

Question 12

You are responding to an incident where a user's credentials were stolen via a phishing email. The attacker used the credentials to access Microsoft Entra ID and then tried to perform privileged role escalation. Which Microsoft Sentinel solution should you use to detect this type of attack?

Accepted Answer

UEBA (User and Entity Behavior Analytics). UEBA (User and Entity Behavior Analytics) is the correct solution because it uses machine learning to establish baseline behavioral patterns for users and entities, then detects anomalies such as a user logging in from an unusual location and immediately attempting privileged role escalation. This directly identifies the credential theft and privilege escalation chain described in the incident, whereas other options focus on network traffic, generic syslog ingestion, or threat intelligence matching, which would not catch the behavioral anomaly of a stolen credential being used for role escalation.

Answer

Network Security Group flow logs

Answer

Syslog data connector

Answer

Threat intelligence connectors

Question 13

During an incident response, you need to collect a forensic image of a Windows 10 device managed by Microsoft Intune. Which Microsoft Defender XDR feature should you use?

Accepted Answer

Microsoft Defender for Endpoint Live Response. Microsoft Defender for Endpoint Live Response (Option C) is the correct feature because it provides a remote shell connection to a Windows 10 device, allowing an incident responder to collect a forensic image by running commands such as `getfile` or `putfile` to acquire disk or memory artifacts. This capability is specifically designed for live incident response on Intune-managed endpoints, enabling acquisition of forensic data without requiring physical access or pre-staged imaging tools.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Purview eDiscovery

Answer

Microsoft Sentinel

Question 14

Your organization uses Microsoft Sentinel. An incident is created from a fusion detection that combines multiple signals. You need to ensure that when the incident is resolved, all related alerts are also resolved automatically. What should you do?

Accepted Answer

Create an automation rule triggered when an incident is closed, with the action 'Close alert'. An automation rule triggered when an incident is closed can include the action 'Close alert', which automatically closes all alerts linked to that incident. This ensures that when the incident is resolved, all related alerts are also resolved without manual intervention.

Answer

Create a playbook triggered on incident creation that closes alerts

Answer

Create an automation rule triggered when an alert is created

Answer

Configure the analytics rule to close alerts when the incident is resolved

Question 15

A security analyst in your SOC receives an alert from Microsoft Defender for Cloud Apps indicating that a user downloaded a large number of files from SharePoint in a short time. What is the most likely classification of this activity?

Accepted Answer

Data exfiltration. A sudden, large-volume download of files from SharePoint within a short time window is a classic indicator of data exfiltration. Microsoft Defender for Cloud Apps uses anomaly detection policies to flag such activity based on user baseline behavior, download velocity, and the total number of files accessed, which aligns with the exfiltration phase of the cyber kill chain.

Answer

Ransomware

Answer

Lateral movement

Answer

Privilege escalation