SC-200 Respond to security incidents Practice Test 19 — 15 Questions

Question 1

Your security team is investigating a suspicious sign-in from an unfamiliar IP address. The user has Microsoft Entra ID P2 licenses and is assigned a Conditional Access policy that requires MFA for all cloud apps. During the incident response, you find that the sign-in succeeded despite the user not completing MFA. Which action should you take first to investigate the discrepancy?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Review the Microsoft Entra sign-in logs for the specific sign-in event. The sign-in logs in Microsoft Entra ID contain detailed authentication details, including whether MFA was satisfied, the Conditional Access policies applied, and any bypass or session details. This will show why MFA was not required. Option A is wrong because user risk detection is for risk-based policies, not for verifying MFA enforcement. Option B is wrong because audit logs show administrative changes to policies, not authentication details. Option C is wrong because the Conditional Access What If tool is used to test policy conditions before sign-in, not to investigate a specific sign-in event.

Answer

Review the user risk detection in Microsoft Entra ID Protection

Answer

Check the Microsoft Entra audit logs for policy changes

Answer

Use the Conditional Access What If tool

Question 2

During a ransomware incident, a security analyst needs to isolate an affected Windows 10 device managed by Microsoft Intune. The device is currently online and connected to the corporate network. Which remediation action should be taken from Microsoft Defender XDR to achieve this?

Accepted Answer

Initiate device isolation from the Microsoft Defender for Endpoint console. Device isolation in Microsoft Defender for Endpoint disconnects the device from the network while allowing communication with the Defender service, effectively containing the ransomware. Option A is incorrect because blocking the device in Intune revokes access to corporate resources but does not isolate the device from the network entirely. Option C is incorrect because disabling the Windows Firewall would increase exposure and not achieve isolation. Option D is incorrect because running a full antivirus scan does not isolate the device and may not stop the ransomware from spreading.

Answer

Block the device in Microsoft Intune

Answer

Disable the Windows Firewall via Intune

Answer

Run a full antivirus scan from Microsoft Defender for Endpoint

Question 3

Your organization uses Microsoft Sentinel. You receive a high-severity incident indicating a potential data exfiltration from an Azure Storage account. The incident contains entities such as IP addresses and user accounts. Which step should you perform first to contain the threat?

Accepted Answer

Investigate the incident to confirm the activity is malicious. The first step in incident response is to investigate and confirm the alert is a true positive before taking any containment actions. Option A is wrong because contacting the user may tip off a malicious insider or cause unnecessary alarm if the alert is a false positive. Option B is wrong because blocking the IP address in the Azure Firewall could be premature and might disrupt legitimate traffic if the alert is not confirmed. Option D is wrong because disabling the storage account could impact legitimate business operations and should only be done after investigation confirms malicious activity.

Answer

Contact the user associated with the storage account

Answer

Block the suspicious IP address in the Azure Firewall

Answer

Disable the storage account

Question 4

Your security operations center (SOC) uses Microsoft Sentinel with a custom analytics rule that generates an incident when more than 10 failed logons occur within 5 minutes. During a review, you notice that a single user triggered the rule by forgetting their password multiple times. The incident was automatically closed by a playbook. What is the most effective way to reduce false positives for this rule?

Accepted Answer

Increase the threshold to 20 failed logons. Increasing the threshold to 20 failed logons reduces false positives from users forgetting passwords while still capturing brute-force attacks. Option D is wrong because grouping by user does not reduce the number of incidents; it still generates one per user per time window. Option B is wrong because a playbook that closes incidents does not prevent their generation. Option C is wrong because disabling the rule removes detection entirely.

Answer

Create a playbook to automatically close the incident

Answer

Disable the analytics rule

Answer

Change the rule to group events by user

Question 5

A security analyst is investigating an incident involving a suspicious process that was detected on multiple devices. The analyst wants to check if the same file hash was observed on other devices in the past 30 days. Which Microsoft 365 Defender table should be queried in KQL?

Accepted Answer

DeviceFileEvents. DeviceFileEvents, option A, is the correct table because it captures file creation, modification, and deletion events, including the file hash. This allows querying for the same file hash across devices in the specified time range. DeviceProcessEvents (B) tracks process creation events but does not include file hash information. DeviceNetworkEvents (C) logs network connections and does not contain file hashes. DeviceEvents (D) is a catch-all for various event types but lacks the structured file hash data needed for this investigation.

Answer

DeviceNetworkEvents

Answer

DeviceProcessEvents

Answer

DeviceEvents

Question 6

Refer to the exhibit. You are analyzing a KQL query in Microsoft Sentinel that generates an incident for users with more than 5 failed sign-in attempts (error code 50057 indicates user account is disabled) from a single IP in the last hour. After enabling the rule, you receive too many incidents from a service account that legitimately fails frequently. How should you modify the query to reduce false positives?

Accepted Answer

Add a filter to exclude the service account: and UserPrincipalName !="svc-account@domain.com". Adding a filter to exclude the service account directly addresses the false positives. The service account legitimately fails frequently, so excluding it from the query prevents incidents from that account while maintaining detection for other users. Option A is incorrect because changing the error code to 50126 would alter the detection logic and not target the service account issue. Option C is incorrect because removing IPAddress from the summarize clause would eliminate the 'from a single IP' condition, potentially generating incidents for failed attempts from multiple IPs and not solving the false positives. Option D is incorrect because increasing the threshold to 10 would reduce sensitivity but does not specifically exclude the service account, potentially still generating false positives if the service account fails more than 10 times.

Answer

Change the error code to 50126

Answer

Remove the IPAddress from the summarize clause and group only by UserPrincipalName

Answer

Increase the Threshold to 10

Question 7

An analyst in your SOC receives a Microsoft Defender for Cloud Apps alert indicating a suspicious Power Automate flow that is forwarding emails to an external domain. The analyst needs to disable the flow immediately. Which action should they take?

Accepted Answer

Use the governance action in Microsoft Defender for Cloud Apps to disable the flow. The correct option is D. In Microsoft Defender for Cloud Apps, the analyst can apply a governance action directly on the suspicious Power Automate flow to disable it. Option A is incorrect because blocking the external domain in Exchange Online mail flow rules does not stop the flow itself; it only blocks emails sent to that domain after the flow has already forwarded them. Option B is incorrect because you cannot manage Power Automate flows from the Microsoft 365 admin center. Option C is incorrect because disabling the user account may be too disruptive and may not stop the flow if it was created with a service principal or another identity.

Answer

Block the external domain in Exchange Online mail flow rules

Answer

Remove the flow from the Microsoft 365 admin center

Answer

Disable the user account in Microsoft Entra ID

Question 8

During an incident response, you need to collect forensic evidence from a compromised Azure virtual machine that is currently offline. What is the most efficient method to acquire a disk snapshot for analysis while preserving the integrity of the evidence?

Accepted Answer

Create a snapshot of the OS disk from the Azure portal. Creating a snapshot from the Azure portal creates a point-in-time copy without affecting the original disk. Option A is wrong because starting the VM changes the state. Option C is wrong because attaching a new disk is for adding storage, not forensic acquisition. Option D is wrong because exporting the disk to a storage account is a valid method but snapshot is faster and more efficient for preservation.

Answer

Attach a new data disk and copy the contents manually

Answer

Start the VM and use Azure Backup to take a backup

Answer

Export the disk to a storage account using AzCopy

Question 9

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You have a custom analytics rule that triggers on a Defender for Endpoint alert. When the rule triggers, a playbook is executed that creates an incident in Microsoft Sentinel and sends a message to a Teams channel. The playbook fails to execute. Which permission should you verify first?

Accepted Answer

The automation rule has the correct managed identity or connection permissions. The playbook executes as part of an automation rule triggered by a custom analytics rule. For the playbook to run successfully, the automation rule must have the correct permissions to invoke the playbook. This is typically configured via a managed identity (recommended) or a connection resource. Without this, the automation rule cannot trigger the playbook, regardless of other permissions.

Answer

The Teams channel has the appropriate permissions for incoming webhooks

Answer

The analyst has Microsoft Sentinel Reader role

Answer

The user has Microsoft Entra ID Global Administrator role

Question 10

Which TWO actions can be taken directly from within a Microsoft Sentinel incident to aid in investigation? (Choose two.)

Accepted Answer

Create a bookmark to preserve a specific event. Options A and B are correct because Microsoft Sentinel incidents allow creating bookmarks to preserve evidence and running playbooks directly from the incident page. Option C is incorrect because user risk level is reviewed in Microsoft Entra ID Protection, not directly from the incident. Option D is incorrect because assigning severity is done during incident creation or editing, but it is not considered a primary investigation action taken directly from the incident page. Option E is incorrect because resetting a user's password is not an action available from the Sentinel incident page.

Answer

Review the user risk level in Microsoft Entra ID

Answer

Assign a severity to the incident

Answer

Reset the user's password

Question 11

Which THREE of the following are valid incident types in Microsoft 365 Defender? (Choose three.)

Accepted Answer

Phishing. Options B, D, and E are correct because Microsoft 365 Defender incidents include categories like 'Phishing', 'Data exfiltration', and 'Malware'. Option A is incorrect because 'Insider risk' is managed in Microsoft Purview, not as a primary incident type in Defender. Option C is incorrect because 'Misconfiguration' is a finding, not an incident type.

Answer

Insider risk

Answer

Misconfiguration

Question 12

Which TWO response actions are available in Microsoft Defender for Endpoint for a compromised device? (Choose two.)

Accepted Answer

Run a full antivirus scan. Options B and D are correct because Microsoft Defender for Endpoint includes predefined response actions such as running a full antivirus scan and isolating a device from the network. Option A is incorrect because disabling the user account is an identity mitigation action in Azure AD, not a device response in Defender for Endpoint. Option C is incorrect because changing Windows Firewall rules is not a standard response action in Defender for Endpoint. Option E is incorrect because resetting a device to factory defaults is not a supported response action.

Answer

Disable the user account

Answer

Change the Windows Firewall rules

Answer

Reset the device to factory defaults

Question 13

Refer to the exhibit. You are configuring an automation rule in Microsoft Sentinel to block IP addresses from high-severity incidents. The rule triggers on incident creation but fails to block the IP. What is the most likely cause?

Accepted Answer

The entity path 'incident.entities.IP' is incorrect; it needs to iterate over entities. The entity path 'incident.entities.IP' in automation rules is insufficient; you need to iterate over the entities array to access the IP property. The correct syntax would involve something like 'incident.entities | where type == 'ip' | project address'. Option A is incorrect because 'alertTrigger' is not a valid trigger type for automation rules; 'incidentTrigger' is the correct trigger. Option C is incorrect because 'blockIP' is a supported action type in Sentinel automation rules. Option D is incorrect because using 'Equals' for severity filter works fine; 'GreaterThan' is not required.

Answer

The trigger type should be 'alertTrigger' instead of 'incidentTrigger'

Answer

The action type 'blockIP' is not supported in automation rules

Answer

The severity condition should be 'GreaterThan' instead of 'Equals'

Question 14

Refer to the exhibit. A security analyst runs the KQL query in Microsoft Defender XDR to find devices running encoded PowerShell commands in the last hour. The query returns results showing a device named 'DESKTOP-123' with account 'jdoe'. The analyst suspects malicious activity. Which immediate next step should the analyst take?

Accepted Answer

Click on the result to open the full device timeline and analyze the process tree. The immediate next step should be to investigate the device further by opening the full device timeline and analyzing the process tree (option C). This allows the analyst to understand the context of the encoded PowerShell command and determine if it is malicious. Option A is incorrect because the query is valid and has already run; deleting it is unnecessary. Option B is incorrect because increasing the time range would not help with this specific incident; the analyst already has a result within the last hour. Option D is incorrect because isolating the device without investigation may be premature; the analyst needs to confirm malicious activity first.

Answer

Delete the query because it returned results

Answer

Modify the query to increase the time range to 24 hours

Answer

Isolate the device 'DESKTOP-123' from the network

Question 15

Refer to the exhibit. An Azure administrator deploys this ARM template to create a Microsoft Sentinel automation rule. After deployment, the automation rule does not trigger when a high-severity incident is created. What is the most likely reason?

Accepted Answer

The automation rule is missing the 'triggers' property. The ARM template snippet does not include the required 'triggers' property. Microsoft Sentinel automation rules need a 'triggers' structure (e.g., incidentTrigger or alertTrigger) to define when the rule should activate; without it, the rule will never trigger. Option A is incorrect because 'LogicApp' is a valid action type for these automation rules. Option B is incorrect because the API version is not the root cause; the resource type in option D is actually correct.

Answer

The apiVersion is outdated

Answer

The action type 'LogicApp' is misspelled

Answer

The resource type should be 'Microsoft.OperationalInsights/workspaces/providers/automations'