SC-200 Respond to security incidents Practice Test 18 — 15 Questions

Question 1

Your organization uses Microsoft Defender for Cloud Apps. A security analyst receives an alert about suspicious activity from a user account indicating a potential ransomware attack. The analyst needs to quickly isolate the user's device and revoke the user's access to all cloud apps. What is the most efficient way to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a Microsoft 365 Defender incident response playbook that triggers on the alert and runs automated actions.. Microsoft 365 Defender incident response playbooks can automatically trigger both device isolation (via Defender for Endpoint) and user access revocation (via Defender for Cloud Apps) in response to a single alert, making it the most efficient and comprehensive approach. Option B (Governance log quarantine) focuses only on user access in Defender for Cloud Apps but does not isolate the device, leaving the endpoint potentially compromised. Option C (disabling the app connector) revokes access for all users of that cloud app, not just the affected user, and does not address device isolation. Option D (manually disabling the user account in Entra ID) revokes access to cloud apps but does not isolate the device, and manual steps are less efficient than automated playbooks.

Answer

Use Microsoft Defender for Cloud Apps Governance log to apply a user quarantine policy.

Answer

Disable the Microsoft Defender for Cloud Apps app connector for the affected cloud app.

Answer

Manually disable the user account in Microsoft Entra ID.

Question 2

During a security incident, your team needs to preserve evidence from a Microsoft Defender for Endpoint onboarded device for forensic analysis. The device is still running and connected to the network. Which action should be taken to collect a forensic image while minimizing disruption?

Accepted Answer

Use the Microsoft Defender for Endpoint Live Response capability to acquire a disk image.. Live response allows collection of a forensic image (via disk acquisition) without shutting down the device, preserving volatile data. Option A is wrong because collecting from Microsoft Sentinel is not a forensic imaging method. Option C is wrong because isolating the device stops communication but does not collect an image. Option D is wrong because it is not a built-in feature of Microsoft Purview.

Answer

Enable Microsoft Purview eDiscovery to preserve the device content.

Answer

Isolate the device from the network using Microsoft Defender for Endpoint.

Answer

Initiate a Microsoft Sentinel data collection rule to export the device logs.

Question 3

Your organization uses Microsoft Sentinel. A security incident is created, and the assigned analyst needs to perform initial triage. What is the first step the analyst should take according to Microsoft best practices for incident response?

Accepted Answer

Review the incident details and verify the alert is a true positive.. The first step in the Microsoft incident response process is to verify the alert and determine its validity. Option A is wrong because containment should follow after verification. Option B is wrong because escalating before verification bypasses triage. Option D is wrong because detailed investigation comes after initial triage.

Answer

Contain the affected resources immediately to prevent further damage.

Answer

Run a full investigation using Microsoft 365 Defender hunting queries.

Answer

Escalate the incident to the senior security team.

Question 4

Your Microsoft Sentinel workspace ingests logs from multiple sources. During an incident, you need to quickly identify all user accounts that have been compromised based on a known malicious IP address. Which KQL operator is most efficient for this?

Accepted Answer

lookup. The `lookup` operator is the most efficient for this scenario because it performs a hash-based join that only returns rows from the left table that match the right table, without requiring the full shuffle and sort operations of a traditional join. This makes it ideal for quickly filtering a large set of user accounts against a known malicious IP address, as it minimizes resource usage and latency.

Answer

summarize

Answer

where

Answer

join kind=inner

Question 5

Your organization uses Microsoft Purview Data Loss Prevention (DLP) and Microsoft Defender for Cloud Apps. During an incident, you discover that a user is exfiltrating sensitive data via a sanctioned cloud app. You need to block the user's ability to share files in that app immediately. What should you do?

Accepted Answer

Create a session policy in Microsoft Defender for Cloud Apps to block the user's file sharing activity.. Microsoft Defender for Cloud Apps can apply a session policy to block file sharing for a specific user. Option B is wrong because a DLP policy would be reactive and not immediate. Option C is wrong because it would block all users. Option D is wrong because app connector control is not real-time for sharing.

Answer

Disable the app connector for that cloud app in Microsoft Defender for Cloud Apps.

Answer

Remove the user from the Microsoft Entra ID group that allows access to the cloud app.

Answer

Create a Microsoft Purview DLP policy to block sharing of sensitive content.

Question 6

Your team uses Microsoft Sentinel to manage incidents. You want to automatically assign incidents with a severity of 'High' to the Tier 2 security team. Which feature should you configure?

Accepted Answer

Automation rule. Automation rules in Microsoft Sentinel can automatically assign incidents based on conditions like severity. Option A is wrong because playbooks are for response actions, not assignment. Option B is wrong because analytics rules generate alerts, not assign incidents. Option D is wrong because workbooks are for visualization.

Answer

Playbook

Answer

Analytics rule

Answer

Workbook

Question 7

During an incident response, you need to collect email messages from a user's mailbox in Microsoft 365 for evidence. The user is suspected of phishing. Which Microsoft Purview solution should you use?

Accepted Answer

eDiscovery (Standard). eDiscovery (Standard) is the correct solution because it allows authorized users to search and export content from mailboxes, including email messages, for investigation and evidence collection during incident response. Data Loss Prevention (DLP) is designed to prevent data exfiltration, not to collect evidence. Records Management focuses on retention and disposal of records, not on content retrieval for investigations. Audit (Standard) logs user and admin activities but does not provide direct access to mailbox content.

Answer

Data Loss Prevention

Answer

Records Management

Answer

Audit (Standard)

Question 8

Refer to the exhibit. You are configuring an automation rule in Microsoft Sentinel. The rule triggers when an incident is created, changes its status to 'Active', assigns it to 'tier2', and runs a playbook. However, you notice that the playbook is not executing for incidents with severity 'Low'. What is the most likely reason?

Accepted Answer

The severityFilter excludes incidents with severity 'Low'.. The severityFilter is configured to include only 'High,Medium', so incidents with severity 'Low' are filtered out and do not trigger the automation rule. Option A is incorrect because the triggers array is present (not empty). Option B is incorrect because there is no explicit condition that filters Low; the exclusion is due to the severityFilter property. Option C is incorrect because the playbook is enabled (the rule is not disabled).

Answer

The triggers array is empty, so no incidents trigger the rule.

Answer

The rule has a condition that filters out Low severity incidents.

Answer

The playbook is disabled in Microsoft Sentinel.

Question 9

Refer to the exhibit. A security analyst runs this KQL query in Microsoft Sentinel during an investigation. The analyst expects to see alerts related to malware from IP 10.0.0.5 but receives no results. The SecurityAlert table contains data from the last 24 hours. What is the most likely reason for no results?

Accepted Answer

The ExtendedProperties column does not contain a key named 'IPAddress' for these alerts.. The query assumes that the ExtendedProperties column contains a key named 'IPAddress', but for the malware alerts in question, the actual schema may store the IP address under a different key (e.g., 'IP Address' or 'IpAddress') or not at all. Option B is incorrect because the 'contains' operator is case-insensitive by default. Option C is incorrect because the time filter 'ago(1d)' is appropriate if the alerts occurred within the last 24 hours. Option D is incorrect because the 'project' statement only selects columns and does not affect the filtering logic.

Answer

The 'contains' operator is case-sensitive.

Answer

The time filter 'ago(1d)' is too restrictive; should use 'ago(7d)'.

Answer

The 'project' statement drops the necessary columns.

Question 10

Your organization is responding to a ransomware incident. Which TWO actions should be taken first to contain the incident while preserving forensic evidence?

Accepted Answer

Isolate affected devices using Microsoft Defender for Endpoint.. The correct first steps for containment are isolating affected devices (Option A) and disabling compromised user accounts (Option C). Isolating devices with Microsoft Defender for Endpoint prevents lateral movement while preserving forensic evidence. Disabling compromised accounts in Microsoft Entra ID stops attackers from using those accounts for further access. Option B (resetting all passwords) is too broad and not a containment step; Option D (factory reset) destroys evidence; Option E (shutting down network switches) is disruptive and not a standard first step.

Answer

Reset passwords for all users in the organization.

Answer

Perform a factory reset on all affected devices.

Answer

Shut down network switches to isolate the network segment.

Question 11

A security analyst is investigating a potential data exfiltration incident in Microsoft Sentinel. The analyst needs to identify which users may have been compromised. Which THREE data sources should be queried to gather the most relevant evidence?

Accepted Answer

SigninLogs and AuditLogs from Microsoft Entra ID.. The correct options are C, D, and E. SigninLogs and AuditLogs from Microsoft Entra ID (C) provide authentication and user activity logs essential for identifying compromised accounts. OfficeActivity from Microsoft 365 (D) captures Exchange Online and SharePoint Online logs, which are common exfiltration vectors. CloudAppEvents from Microsoft Defender for Cloud Apps (E) provides visibility into shadow IT and app-level activities, helping detect anomalous data transfers. Option A (WindowsEvent) is device-focused and less relevant for cloud-based exfiltration. Option B (AzureActivity) logs Azure resource management events, not user activity.

Answer

WindowsEvent from Microsoft Defender for Endpoint.

Answer

AzureActivity from Azure Monitor.

Question 12

Your organization uses Microsoft 365 Defender. During an incident, which TWO actions can be taken directly from the Microsoft 365 Defender portal to remediate a compromised email account?

Accepted Answer

Soft delete malicious emails from the user's mailbox.. Options C and D are correct. From the Microsoft 365 Defender portal, you can soft delete malicious emails from a user's mailbox (C) and reset the user's password and revoke sessions (D) as part of incident remediation. Option A is incorrect because removing mailbox delegation permissions is not a direct action available in the Defender portal; it's typically done in Exchange admin center. Option B is incorrect because blocking the sender's email address in the tenant allow/block list is not a remediation action for a compromised account; it's for spam management. Option E is incorrect because isolating a mailbox from receiving emails is not a feature in Microsoft 365 Defender; you might use litigation hold or disable the account instead.

Answer

Remove mailbox delegation permissions.

Answer

Block the sender's email address in the tenant's allow/block list.

Answer

Isolate the user's mailbox from receiving emails.

Question 13

Your team uses Microsoft Defender for Endpoint. An incident involving a device is identified as a high-severity malware infection. Which THREE remediation actions can be performed directly from the incident in Microsoft 365 Defender?

Accepted Answer

Collect an investigation package from the device.. In Microsoft 365 Defender, the incident response actions available for a device include collecting an investigation package (B), isolating the device from the network (C), and running a full antivirus scan (D). Wiping the device remotely (A) is not a standard Defender for Endpoint action—it is typically performed via Microsoft Intune. Resetting the local administrator password (E) is a user account action, not a device-level remediation in Defender for Endpoint.

Answer

Wipe the device remotely.

Answer

Reset the device's local administrator password.

Question 14

Your organization uses Microsoft Sentinel and Microsoft Defender for Cloud. During a security incident involving a compromised Azure VM, which THREE actions are appropriate to contain and investigate the incident?

Accepted Answer

Use Microsoft Defender for Cloud's Just-in-Time VM access to isolate the VM.. Microsoft Defender for Cloud's Just-in-Time VM access can be used to lock down inbound traffic to the VM, effectively isolating it from the network while preserving the VM for forensic analysis. This action reduces the attack surface and prevents lateral movement without destroying evidence, which is critical during incident response.

Answer

Delete the compromised VM to prevent further damage.

Answer

Update the VM's operating system to the latest patch.

Question 15

Refer to the exhibit. You are reviewing a Microsoft Sentinel automation rule definition. The rule is intended to automatically change the severity to High, assign to tier2, and set status to Active for incidents triggered by alerts containing 'malware'. However, incidents are not being updated. What is the most likely cause?

Accepted Answer

The trigger type should be 'IncidentCreated', not 'AlertRule'.. The rule is set to trigger on 'Microsoft.SecurityInsights/AlertRule', which is not a valid trigger for automation rules. Automation rules in Microsoft Sentinel trigger on incident creation (IncidentCreated), not on alert rule creation. Therefore, the incidents are not being updated because the rule never triggers. Option C correctly identifies that the trigger type should be 'IncidentCreated'. Option A is incorrect because the action configuration does not require an 'incident' property; actions like changing severity and status are applied directly. Option B is incorrect because the 'Contains' operator is valid for condition evaluation on alert fields. Option D is incorrect because managed identities are not required for automation rules; they use system-assigned managed identities if needed for playbooks, but the issue here is the trigger type.

Answer

The action configuration is missing the 'incident' property.

Answer

The condition operator 'Contains' is incorrect; should be 'Equals'.

Answer

The playbook requires a managed identity to run.