SC-200 Respond to security incidents Practice Test 19 — 15 Questions

Question 1

Your organization uses Microsoft Sentinel. You need to create an incident response playbook that automatically isolates a compromised device when a high-severity incident is created. The playbook should only run during business hours (9 AM - 5 PM local time). How should you configure this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add a condition in the playbook to check the current time. Microsoft Sentinel automation rules cannot evaluate conditions based on the time of day (e.g., creation hour). The appropriate method is to add a condition in the playbook itself (Azure Logic Apps) to check the current time and proceed only during business hours. This approach gives you full control over the playbook's execution schedule without relying on unsupported automation rule conditions.

Answer

Configure the analytics rule to only create incidents during business hours

Answer

Use a workbook to schedule the playbook

Answer

Create an automation rule with a condition on the incident creation time

Question 2

Your organization uses Microsoft Defender XDR. A security administrator reports that a user's device is showing high severity alerts for 'Tampering with Microsoft Defender Antivirus' but the device is not isolated. You need to ensure that when such alerts occur, the device is automatically isolated in Microsoft Defender for Endpoint. What should you do?

Accepted Answer

Create a custom detection rule in Microsoft Defender XDR. Microsoft Defender XDR's custom detection rules allow you to create automated actions based on specific alert triggers, such as 'Tampering with Microsoft Defender Antivirus'. By configuring a custom detection rule with an automated response action (e.g., 'Isolate device'), you can ensure the device is automatically isolated in Microsoft Defender for Endpoint when the alert occurs, without requiring manual intervention.

Answer

Create an automation rule in Microsoft Sentinel

Answer

Create an endpoint detection and response policy in Microsoft Intune

Answer

Configure an attack surface reduction rule

Question 3

Your organization uses Microsoft Sentinel. An incident has been identified as a false positive. What is the recommended action to prevent similar false positives in the future?

Accepted Answer

Modify the analytics rule to reduce false positives. Modifying the analytics rule addresses the root cause of the false positive by adjusting the rule's query logic, thresholds, or entity mappings to reduce noise. In Microsoft Sentinel, analytics rules define the conditions that generate incidents; tuning these rules (e.g., changing frequency, lookback period, or adding exclusion filters) directly prevents similar false positives from recurring. Simply closing or classifying incidents does not prevent future occurrences, and deleting the rule would remove all detection capability.

Answer

Delete the analytics rule

Answer

Close the incident and set the classification to 'False positive'

Answer

Mark the incident as 'False positive' and add a comment

Question 4

Which TWO actions should you take when responding to a confirmed ransomware incident in Microsoft Defender XDR?

Accepted Answer

Run a full antivirus scan. Running a full antivirus scan (Option A) is a critical containment and remediation step in a confirmed ransomware incident because it detects and removes malicious files, including ransomware binaries and associated artifacts, from affected devices. In Microsoft Defender XDR, a full scan leverages the Microsoft Defender Antivirus engine to inspect all files and running processes, ensuring that the ransomware payload is eliminated from the system. This action helps prevent further encryption or lateral movement by the malware.

Answer

Reset the user's password

Answer

Restore files from backup

Answer

Disable the user account

Question 5

Which THREE actions should be taken when a phishing attack is detected in Microsoft Defender XDR?

Accepted Answer

Report the email as phishing in Microsoft Defender for Office 365. Reporting the email as phishing in Microsoft Defender for Office 365 triggers automated investigation and remediation workflows, including tenant-level block actions and threat intelligence updates. This action directly supports the incident response process by enabling the security team to analyze the phishing attempt and prevent further delivery to other users.

Answer

Run a full antivirus scan on the user's device

Answer

Reset the user's password

Question 6

Which TWO are valid incident classification categories in Microsoft Sentinel?

Accepted Answer

True positive. Microsoft Sentinel incidents are closed with one of THREE classification categories, not two: True Positive (reason: Suspicious activity), False Positive (reasons: Inaccurate data or Inaccurate alert logic), and Benign Positive (reason: Suspicious but expected — used when the detected activity is real but was expected/authorized, e.g., an approved penetration test or a known admin script). 'Unknown' and 'Informational' are not valid classification values; they are respectively an alert-severity-adjacent concept and a severity level, not part of the incident-closing classification field. Because 3 of the 5 options (A, C, E) are actually valid, the stem must also be changed from 'Select TWO' to 'Select THREE' when this question is corrected.

Answer

Benign positive

Answer

Unknown

Answer

Informational

Question 7

Your organization uses Microsoft Sentinel. You need to implement a custom incident response process that requires approval before taking action on an incident. What should you use?

Accepted Answer

Playbook with Microsoft Teams connector for approval. A playbook with a Microsoft Teams connector is the correct choice because it enables an interactive approval workflow directly within Teams. When an incident is triggered, the playbook can send an adaptive card to a Teams channel or user, pause execution until an approval decision is made, and then continue with the next steps based on that decision. This satisfies the requirement for a custom approval process before taking action on an incident.

Answer

Automation rules with conditions

Answer

Watchlist for approval status

Answer

Analytics rule with custom details

Question 8

A security analyst receives an alert from Microsoft Defender for Identity about a suspicious Kerberos ticket request. What is the first step the analyst should take?

Accepted Answer

Validate the alert by checking the user's recent activity. When Microsoft Defender for Identity alerts on a suspicious Kerberos ticket request, the first step is to validate the alert by checking the user's recent activity. This ensures the alert is not a false positive caused by legitimate behavior (e.g., scheduled tasks or application service tickets) before taking any disruptive action. Defender for Identity uses network traffic and event logs to detect anomalies like overpass-the-hash or Kerberoasting, but initial validation prevents unnecessary account lockouts or password resets.

Answer

Disable the user account

Answer

Reset the user's password

Answer

Run a full antivirus scan on the user's device

Question 9

You are a security analyst investigating a detected phishing campaign targeting users in your organization. The Microsoft Defender for Office 365 alert indicates that several users clicked on a malicious link. Which action should you take first to prevent further compromise?

Accepted Answer

Add the malicious URL to the Microsoft Defender for Endpoint custom threat indicator list.. Adding the malicious URL to the Microsoft Defender for Endpoint custom threat indicator list is the correct first action because it immediately blocks future access to that URL across all endpoints protected by Defender for Endpoint, preventing further compromise from users clicking the same link. This leverages the threat intelligence feed to enforce a block action at the network level, stopping the attack vector proactively without disrupting user productivity or requiring device isolation.

Answer

Isolate all affected users' devices from the network.

Answer

Report the email to Microsoft for analysis.

Answer

Block the sender email address in the tenant.

Question 10

During a ransomware incident, the security team needs to prevent the encryption of files while allowing the investigation to continue. Which feature in Microsoft Defender for Endpoint should be used to achieve this?

Accepted Answer

Controlled folder access.. Controlled folder access (CFA) blocks unauthorized applications from modifying files in protected folders, which is exactly what ransomware does. ASR rules are broader and may not target file encryption specifically. Device isolation disconnects the device from the network but stops the investigation. Custom detection rules are reactive.

Answer

Device isolation.

Answer

Attack surface reduction (ASR) rules.

Answer

Custom detection rules.

Question 11

Your organization uses Microsoft Sentinel. You need to create an incident response playbook that automatically isolates a compromised device when a high-severity incident is created. The playbook should only run during business hours (9 AM - 5 PM local time). How should you configure this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Playbook.. Playbooks in Microsoft Sentinel are automated workflows based on Azure Logic Apps that can perform response actions, such as blocking an IP address in a firewall. When an incident indicates data exfiltration via an unapproved external IP, a playbook can be triggered automatically or manually to execute the block action via integration with firewall APIs or management tools.

Answer

Data connector.

Answer

Analytics rule.

Answer

Watchlist.

Question 12

You have detected a suspicious PowerShell command running on several workstations. The command appears to be downloading a payload from a known malicious URL. What is the most effective immediate response using Microsoft Defender for Endpoint?

Accepted Answer

Add the URL to the custom threat indicator list in Microsoft Defender for Endpoint.. Adding the URL to the custom threat indicator list in Microsoft Defender for Endpoint is the most effective immediate response because it creates a block indicator that applies to all endpoints in the organization. This action prevents any further downloads from that malicious URL across all workstations, stopping the attack in its tracks without disrupting user productivity or requiring manual intervention on each machine.

Answer

Quarantine the affected workstations.

Answer

Enable attack surface reduction rule to block PowerShell scripts.

Answer

Initiate a Live Response session to investigate each workstation.

Question 13

A security administrator receives an alert from Microsoft Defender for Identity about a suspicious Kerberos ticket request from a domain controller. The alert suggests a possible Golden Ticket attack. Which action should the administrator take to validate the alert?

Accepted Answer

Check the domain controller's Security event log for Event ID 4769 with suspicious attributes.. Event ID 4769 (Kerberos Service Ticket Request) on a domain controller is the authoritative source for validating suspicious ticket requests. In a Golden Ticket attack, the forged ticket often exhibits anomalous attributes such as an unusually long lifetime, a non-existent or disabled user account, or encryption type mismatches (e.g., RC4 when AES is expected). Reviewing this log directly confirms whether the ticket characteristics deviate from normal Kerberos behavior, providing definitive evidence for the alert.

Answer

Review Microsoft Defender for Identity alerts for brute force attempts.

Answer

Reset the krbtgt account password twice.

Answer

Verify if the user account associated with the ticket is disabled.

Question 14

Your organization uses Microsoft Defender for Cloud Apps. You receive an alert that an administrator performed an unusual bulk download from SharePoint. What is the recommended first step to respond?

Accepted Answer

Review the activity log in Defender for Cloud Apps to determine the context.. The recommended first step when investigating an alert in Microsoft Defender for Cloud Apps is to review the activity log to understand the context of the alert. This allows the analyst to determine whether the bulk download is legitimate (e.g., a scheduled backup or migration) or malicious (e.g., data exfiltration). Jumping to containment actions without context can disrupt business operations and potentially alert an attacker.

Answer

Report the activity to Microsoft for further analysis.

Answer

Suspend the administrator's account immediately.

Answer

Block the IP address of the administrator's device.

Question 15

A Microsoft Defender for Endpoint alert indicates that a device has been communicating with a known command-and-control (C2) server. The device is critical for production. What is the most appropriate response?

Accepted Answer

Isolate the device using Microsoft Defender for Endpoint's device isolation feature.. Microsoft Defender for Endpoint's device isolation feature is designed to contain a compromised device while preserving forensic data and minimizing disruption. For a critical production device, full isolation (blocking all network traffic except to the Defender service) stops C2 communication without physically disconnecting the device, allowing the security team to investigate and remediate remotely.

Answer

Disconnect the network cable of the device.

Answer

Run a full antivirus scan on the device.

Answer

Block the C2 server URL in the firewall.