SC-200 Respond to security incidents Practice Test 19 — 15 Questions

Question 1

Your organization uses Microsoft Defender for Cloud Apps. A security analyst receives an alert about suspicious activity from a user account indicating a potential ransomware attack. The analyst needs to quickly isolate the user's device and revoke the user's access to all cloud apps. What is the most efficient way to achieve this?

Accepted Answer

Create a Microsoft 365 Defender incident response playbook that triggers on the alert and runs automated actions.. Option C is correct because Microsoft 365 Defender integrates alerts and supports automated response actions like device isolation and user account restriction across Microsoft Defender for Cloud Apps and Defender for Endpoint. Option A is wrong because incident-based response is less efficient for a single alert. Option B is wrong because manually disabling the user in Entra ID does not isolate the device. Option D is wrong because disabling the app connector doesn't revoke access for that user only.

Answer

Use Microsoft Defender for Cloud Apps Governance log to apply a user quarantine policy.

Answer

Disable the Microsoft Defender for Cloud Apps app connector for the affected cloud app.

Answer

Manually disable the user account in Microsoft Entra ID.

Question 2

During a security incident, your team needs to preserve evidence from a Microsoft Defender for Endpoint onboarded device for forensic analysis. The device is still running and connected to the network. Which action should be taken to collect a forensic image while minimizing disruption?

Accepted Answer

Use the Microsoft Defender for Endpoint Live Response capability to acquire a disk image.. Option B is correct because live response allows collection of a forensic image (via disk acquisition) without shutting down the device, preserving volatile data. Option A is wrong because collecting from Microsoft Sentinel is not a forensic imaging method. Option C is wrong because isolating the device stops communication but does not collect an image. Option D is wrong because it is not a built-in feature of Microsoft Purview.

Answer

Enable Microsoft Purview eDiscovery to preserve the device content.

Answer

Isolate the device from the network using Microsoft Defender for Endpoint.

Answer

Initiate a Microsoft Sentinel data collection rule to export the device logs.

Question 3

Your organization uses Microsoft Sentinel. A security incident is created, and the assigned analyst needs to perform initial triage. What is the first step the analyst should take according to Microsoft best practices for incident response?

Accepted Answer

Review the incident details and verify the alert is a true positive.. Option C is correct because the first step in the Microsoft incident response process is to verify the alert and determine its validity. Option A is wrong because containment should follow after verification. Option B is wrong because escalating before verification bypasses triage. Option D is wrong because detailed investigation comes after initial triage.

Answer

Contain the affected resources immediately to prevent further damage.

Answer

Run a full investigation using Microsoft 365 Defender hunting queries.

Answer

Escalate the incident to the senior security team.

Question 4

Your Microsoft Sentinel workspace ingests logs from multiple sources. During an incident, you need to quickly identify all user accounts that have been compromised based on a known malicious IP address. Which KQL operator is most efficient for this?

Accepted Answer

lookup. Option B is correct because the lookup operator is optimized for joining large tables with a small reference set (the malicious IP). Option A is wrong because join is less efficient for this pattern. Option C is wrong because where clause would require filtering each row individually. Option D is wrong because summarize is for aggregation, not matching.

Answer

summarize

Answer

where

Answer

join kind=inner

Question 5

Your organization uses Microsoft Purview Data Loss Prevention (DLP) and Microsoft Defender for Cloud Apps. During an incident, you discover that a user is exfiltrating sensitive data via a sanctioned cloud app. You need to block the user's ability to share files in that app immediately. What should you do?

Accepted Answer

Create a session policy in Microsoft Defender for Cloud Apps to block the user's file sharing activity.. Option A is correct because Microsoft Defender for Cloud Apps can apply a session policy to block file sharing for a specific user. Option B is wrong because a DLP policy would be reactive and not immediate. Option C is wrong because it would block all users. Option D is wrong because app connector control is not real-time for sharing.

Answer

Disable the app connector for that cloud app in Microsoft Defender for Cloud Apps.

Answer

Remove the user from the Microsoft Entra ID group that allows access to the cloud app.

Answer

Create a Microsoft Purview DLP policy to block sharing of sensitive content.

Question 6

Your team uses Microsoft Sentinel to manage incidents. You want to automatically assign incidents with a severity of 'High' to the Tier 2 security team. Which feature should you configure?

Accepted Answer

Automation rule. Option B is correct because automation rules in Microsoft Sentinel can automatically assign incidents based on conditions like severity. Option A is wrong because analytics rules generate alerts, not assign incidents. Option C is wrong because playbooks are for response actions, not assignment. Option D is wrong because workbooks are for visualization.

Answer

Playbook

Answer

Analytics rule

Answer

Workbook

Question 7

During an incident response, you need to collect email messages from a user's mailbox in Microsoft 365 for evidence. The user is suspected of phishing. Which Microsoft Purview solution should you use?

Accepted Answer

eDiscovery (Standard). Option C is correct because eDiscovery (Standard) allows authorized users to search and export mailbox content, including email messages, for legal and investigative purposes. Option A is wrong because DLP is for data loss prevention, not collection. Option B is wrong because Records Management is for retention labels. Option D is wrong because Audit logs track activities, not content collection.

Answer

Data Loss Prevention

Answer

Records Management

Answer

Audit (Standard)

Question 8

Refer to the exhibit. You are configuring an automation rule in Microsoft Sentinel. The rule triggers when an incident is created, changes its status to 'Active', assigns it to 'tier2', and runs a playbook. However, you notice that the playbook is not executing for incidents with severity 'Low'. What is the most likely reason?

Accepted Answer

The severityFilter excludes incidents with severity 'Low'.. Option A is correct because the severityFilter is set to 'High,Medium', so incidents with severity 'Low' are not processed by this automation rule. Option B is wrong because the triggers array is not empty. Option C is wrong because there is no condition blocking Low severity. Option D is wrong because the rule is enabled (not shown disabled).

Answer

The triggers array is empty, so no incidents trigger the rule.

Answer

The rule has a condition that filters out Low severity incidents.

Answer

The playbook is disabled in Microsoft Sentinel.

Question 9

Refer to the exhibit. A security analyst runs this KQL query in Microsoft Sentinel during an investigation. The analyst expects to see alerts related to malware from IP 10.0.0.5 but receives no results. The SecurityAlert table contains data from the last 24 hours. What is the most likely reason for no results?

Accepted Answer

The ExtendedProperties column does not contain a key named 'IPAddress' for these alerts.. Option D is correct because the ExtendedProperties column may not contain the exact property name 'IPAddress' as a key; the analyst may need to check the actual schema. Option A is wrong because the query uses a 1-day time range. Option B is wrong because the contains operator is case-insensitive unless specified. Option C is wrong because the query projects the parsed IPAddress correctly.

Answer

The 'contains' operator is case-sensitive.

Answer

The time filter 'ago(1d)' is too restrictive; should use 'ago(7d)'.

Answer

The 'project' statement drops the necessary columns.

Question 10

Your organization is responding to a ransomware incident. Which TWO actions should be taken first to contain the incident while preserving forensic evidence?

Accepted Answer

Isolate affected devices using Microsoft Defender for Endpoint.. Option A (isolate affected devices) and Option B (disable compromised accounts) are correct first steps to contain the incident, as they stop lateral movement and further damage while preserving evidence. Option C is wrong because wiping devices destroys evidence. Option D is wrong because resetting passwords of all users is broad and not a containment step. Option E is wrong because shutting down network ports may be necessary but is not a standard first step.

Answer

Reset passwords for all users in the organization.

Answer

Perform a factory reset on all affected devices.

Answer

Shut down network switches to isolate the network segment.

Question 11

A security analyst is investigating a potential data exfiltration incident in Microsoft Sentinel. The analyst needs to identify which users may have been compromised. Which THREE data sources should be queried to gather the most relevant evidence?

Accepted Answer

SigninLogs and AuditLogs from Microsoft Entra ID.. Options A, C, and D are correct because SigninLogs and AuditLogs (Entra ID) provide authentication and activity logs; OfficeActivity provides Exchange and SharePoint logs; and CloudAppEvents (Defender for Cloud Apps) provides shadow IT and app activity. Option B (AzureActivity) is for Azure resource logs, not user activity. Option E (WindowsEvent) is for device-level events, less relevant for cloud exfiltration.

Answer

WindowsEvent from Microsoft Defender for Endpoint.

Answer

AzureActivity from Azure Monitor.

Question 12

Your organization uses Microsoft 365 Defender. During an incident, which TWO actions can be taken directly from the Microsoft 365 Defender portal to remediate a compromised email account?

Accepted Answer

Soft delete malicious emails from the user's mailbox.. Options A and D are correct because the Microsoft 365 Defender portal allows soft-deleting emails and resetting passwords for compromised accounts. Option B is wrong because sender reputation is not directly manageable. Option C is wrong because mailbox delegation is not a remediation action. Option E is wrong because email isolation is not a feature for individual accounts.

Answer

Remove mailbox delegation permissions.

Answer

Block the sender's email address in the tenant's allow/block list.

Answer

Isolate the user's mailbox from receiving emails.

Question 13

Your team uses Microsoft Defender for Endpoint. An incident involving a device is identified as a high-severity malware infection. Which THREE remediation actions can be performed directly from the incident in Microsoft 365 Defender?

Accepted Answer

Collect an investigation package from the device.. Options A, C, and E are correct because Microsoft 365 Defender incident response actions include isolating the device, running antivirus scan, and collecting investigation package. Option B is wrong because device wipe is not a standard Defender for Endpoint action (it's Intune). Option D is wrong because resetting password is for user accounts, not devices.

Answer

Wipe the device remotely.

Answer

Reset the device's local administrator password.

Question 14

Your organization uses Microsoft Sentinel and Microsoft Defender for Cloud. During a security incident involving a compromised Azure VM, which THREE actions are appropriate to contain and investigate the incident?

Accepted Answer

Use Microsoft Defender for Cloud's Just-in-Time VM access to isolate the VM.. Options A, C, and E are correct because enabling network security group flow logs helps trace lateral movement, isolating the VM in Defender for Cloud stops communication, and creating an automation rule can trigger a playbook for response. Option B is wrong because deleting the VM destroys evidence. Option D is wrong because updating the VM does not contain the incident.

Answer

Delete the compromised VM to prevent further damage.

Answer

Update the VM's operating system to the latest patch.

Question 15

Refer to the exhibit. You are reviewing a Microsoft Sentinel automation rule definition. The rule is intended to automatically change the severity to High, assign to tier2, and set status to Active for incidents triggered by alerts containing 'malware'. However, incidents are not being updated. What is the most likely cause?

Accepted Answer

The trigger type should be 'IncidentCreated', not 'AlertRule'.. Option B is correct because the trigger type is 'Microsoft.SecurityInsights/AlertRule', which triggers on alert creation, not incident creation. Automation rules in Sentinel trigger on incident creation, not alert creation. Option A is wrong because the condition is valid. Option C is wrong because the actions are correctly structured. Option D is wrong because there is no such requirement.

Answer

The action configuration is missing the 'incident' property.

Answer

The condition operator 'Contains' is incorrect; should be 'Equals'.

Answer

The playbook requires a managed identity to run.