SC-200 Respond to security incidents Practice Test 18 — 15 Questions

Question 1

Your organization uses Microsoft Defender for Endpoint. A user reports that their device is running slowly and exhibiting unusual network activity. You run a live response session and find a suspicious process running. Which action should you take first to contain the threat?

Accepted Answer

Isolate the device from the network.. Option A is correct because isolating the device immediately prevents the threat from spreading to other devices while you investigate further. Option B is wrong because terminating the process alone does not prevent re-execution. Option C is wrong because collecting a memory dump does not contain the threat. Option D is wrong because adding a firewall rule is too slow and may not block all lateral movement.

Answer

Collect a full memory dump for analysis.

Answer

Terminate the suspicious process.

Answer

Add a firewall rule to block outbound traffic from the device.

Question 2

You are investigating an incident in Microsoft Sentinel where a user account was used to sign in from an unfamiliar location and then accessed multiple sensitive files. Which step is most important to perform first?

Accepted Answer

Disable the user account and reset the password.. Option A is correct because confirming account compromise is the highest priority to stop further malicious activity. Option B is wrong because checking firewall logs is less immediate. Option C is wrong because blocking IP addresses may not be effective if the attacker uses proxies. Option D is wrong because reviewing permissions is a secondary step.

Answer

Block the IP address of the unfamiliar location.

Answer

Check firewall logs for related network traffic.

Answer

Review file permissions on the accessed files.

Question 3

During a security incident, you need to create a custom detection rule in Microsoft Sentinel to alert on multiple failed logins followed by a successful login from the same IP within 10 minutes. Which KQL function should you use to group events by IP address and time window?

Accepted Answer

summarize. Option C is correct because `summarize` with `make_list` or `count` is used to aggregate events within a time window. Option A is wrong because `project` selects columns, not aggregates. Option B is wrong because `extend` adds computed columns but does not group. Option D is wrong because `join` combines tables but does not aggregate within a window.

Answer

join

Answer

extend

Answer

project

Question 4

Your organization uses Microsoft Defender for Cloud Apps. An alert indicates that a user is downloading large amounts of data from SharePoint Online. What should you do first to investigate?

Accepted Answer

Review the user's activity log in Defender for Cloud Apps.. Option B is correct because the user's activity log provides detailed information about the downloads and can help identify if it's malicious. Option A is wrong because blocking the app is too broad. Option C is wrong because creating an IP range is proactive but not investigative. Option D is wrong because it's a reactive step that might be premature.

Answer

Govern the user by suspending their account.

Answer

Create a new IP address range for the organization.

Answer

Block the SharePoint Online app for all users in Defender for Cloud Apps.

Question 5

You receive a Microsoft Defender for Identity alert for a suspicious Kerberos ticket request. What is the most likely intent of this attack?

Accepted Answer

Credential theft to gain persistent access.. Option D is correct because a suspicious Kerberos ticket request often indicates a Golden Ticket attack or similar credential theft. Option A is wrong because it targets authentication mechanisms, not data exfiltration directly. Option B is wrong because it is not directly related to service account compromise. Option C is wrong because it is more about persistence than denial of service.

Answer

Lateral movement using compromised service accounts.

Answer

Denial of service on domain controllers.

Answer

Data exfiltration from SharePoint.

Question 6

Refer to the exhibit. You are investigating a malware outbreak in Microsoft Sentinel. The KQL query returns no results. What is the most likely reason?

Accepted Answer

The alert name in the query does not match the actual alert name.. Option B is correct because the alert name must match exactly; 'Malware detected' might not be the correct name. Option A is wrong because if no alerts were generated, the table would be empty but the query would still run. Option C is wrong because the syntax is correct. Option D is wrong because the time filter is not the issue.

Answer

The time range is too restrictive.

Answer

No alerts were generated in the last hour.

Answer

The query syntax is incorrect.

Question 7

Your organization uses Microsoft Defender XDR. You receive an automated investigation that found a malicious file on a device. The investigation recommends 'Block the file'. What does this action do?

Accepted Answer

Adds the file hash to the block list in Microsoft Defender for Endpoint.. Option A is correct because blocking the file adds it to the global indicator of compromise (IOC) list, preventing future execution. Option B is wrong because it does not delete the file from all devices. Option C is wrong because it does not isolate the device. Option D is wrong because it does not scan other devices automatically.

Answer

Isolates the device where the file was found.

Answer

Initiates a full antivirus scan on all devices.

Answer

Deletes the file from all devices in the organization.

Question 8

During an incident response, you need to collect forensic evidence from a compromised Windows device using Microsoft Defender for Endpoint live response. Which command should you use to gather running processes?

Accepted Answer

processes. Option B is correct because 'processes' is a built-in command in live response to list running processes. Option A is wrong because 'netstat' shows network connections. Option C is wrong because 'reg query' accesses the registry. Option D is wrong because 'dir' lists files.

Answer

dir

Answer

reg query

Answer

netstat

Question 9

Your Microsoft Sentinel workspace receives logs from multiple sources. You need to ensure that an incident response playbook is triggered automatically when a specific alert is generated. What should you create?

Accepted Answer

An automation rule.. Option C is correct because an automation rule in Microsoft Sentinel can trigger a playbook when an alert is created. Option A is wrong because a logic app is the playbook itself, not the trigger. Option B is wrong because a data connector ingests data, not triggers actions. Option D is wrong because an analytics rule generates alerts, but the playbook trigger is an automation rule.

Answer

A data connector.

Answer

An analytics rule.

Answer

A new Logic App.

Question 10

Which TWO actions can you perform in Microsoft Defender XDR's automated investigation and response (AIR) to contain a threat? (Select TWO.)

Accepted Answer

Isolate a device from the network.. Option A is correct because AIR can isolate devices. Option D is correct because AIR can soft-delete an email message. Option B is wrong because disabling a user account is not an AIR action; it's manual. Option C is wrong because resetting a password is not part of AIR. Option E is wrong because adding a firewall rule is not an AIR capability.

Answer

Add a firewall rule to block an IP.

Answer

Disable a user account.

Answer

Reset a user's password.

Question 11

Which THREE are valid investigation actions in Microsoft Sentinel? (Select THREE.)

Accepted Answer

View related entities such as IP addresses.. Option A is correct because investigation can show related alerts. Option B is correct because investigation can show entities like IPs. Option E is correct because investigation can show related incidents. Option C is wrong because running a playbook is a remediation action, not an investigation action. Option D is wrong because investigation does not modify analytics rules.

Answer

Run a playbook.

Answer

Modify an analytics rule.

Question 12

Which TWO are valid methods to submit a file for analysis in Microsoft Defender for Endpoint? (Select TWO.)

Accepted Answer

Submit a file using the Microsoft 365 Defender API.. Option A is correct because you can submit via the security portal. Option E is correct because the Microsoft 365 Defender API allows submissions. Option B is wrong because live response is for collecting files, not submitting for analysis. Option C is wrong because Microsoft Sentinel is not a submission interface. Option D is wrong because Intune manages devices, not file submissions.

Answer

Submit a file via live response.

Answer

Submit a file through Microsoft Sentinel.

Answer

Submit a file via Microsoft Intune.

Question 13

Refer to the exhibit. You are creating an automation rule in Microsoft Sentinel to trigger a playbook when an alert is created. However, the playbook does not run. What is the most likely cause?

Accepted Answer

The playbook's resource ID is incorrect.. Option A is correct because the `logicAppResourceId` might be incorrect or the playbook might not be accessible. Option B is wrong because the rule name is irrelevant. Option C is wrong because there is no permission issue indicated. Option D is wrong because the JSON is valid.

Answer

The JSON syntax is invalid.

Answer

The automation rule lacks permissions to the playbook.

Answer

The displayName is not unique.

Question 14

Refer to the exhibit. You run this KQL query in Microsoft Defender XDR to detect suspicious PowerShell activity. Why might this query generate many false positives?

Accepted Answer

Legitimate administrators often use encoded PowerShell commands.. Option D is correct because legitimate administrative scripts often use encoded commands. Option A is wrong because the query is specific. Option B is wrong because the time range is narrow. Option C is wrong because the query does not filter by user.

Answer

The time range is too broad.

Answer

The query is too specific and misses many attacks.

Answer

The query does not filter by user.

Question 15

After containing a security incident, what is the most important next step in the incident response process?

Accepted Answer

Conduct a post-incident review.. Option C is correct because the 'Lessons Learned' phase helps improve future response. Option A is wrong because eradication should have been done before containment. Option B is wrong because recovery is after eradication. Option D is wrong because monitoring is ongoing but not the immediate next step.

Answer

Monitor for signs of recurrence.

Answer

Recover systems to normal operation.

Answer

Eradicate the threat from all systems.