SC-200 Respond to security incidents Practice Test 2 — 15 Questions

Question 1

Your organization uses Microsoft Purview to manage insider risk. A user is suspected of exfiltrating data via email. The incident response team needs to preserve a copy of the user's mailbox for legal hold. Which action should be taken?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Place the mailbox on litigation hold.. A litigation hold preserves mailbox content indefinitely for legal proceedings by placing the mailbox on In-Place Hold, preventing deletion or modification of items. This is the correct action when the IR team needs to preserve a mailbox copy for legal hold during an insider risk investigation.

Answer

Place the mailbox on an eDiscovery hold.

Answer

Disable the user's multi-factor authentication to prevent access.

Answer

Apply a Microsoft Purview retention policy to the user's mailbox.

Question 2

A security analyst in your organization receives an alert from Microsoft Defender for Cloud Apps indicating that a user has installed a third-party app with high permissions in Microsoft 365. The analyst suspects a consent phishing attack. Which playbook in Microsoft Sentinel should the analyst use to automate the investigation and remediation?

Accepted Answer

Automation rule. The correct playbook to use for automating investigation and remediation of a suspected consent phishing attack is an Automation rule. In Microsoft Sentinel, an Automation rule can be configured to trigger specific actions, such as revoking permissions or isolating accounts, based on alerts like those from Microsoft Defender for Cloud Apps. This allows for automated response without manual intervention.

Answer

Hunting query

Answer

Entity page

Answer

Workbook

Question 3

Which TWO components are required to enable automated investigation and response (AIR) in Microsoft Defender for Office 365?

Accepted Answer

Microsoft Defender for Endpoint integration. Option D (Office 365 Advanced Threat Protection Plan 2) is correct because AIR is a Plan 2-only capability; the automated investigation and response engine, including automated investigation queues and remediation actions, is licensed exclusively through Microsoft Defender for Office 365 Plan 2 (formerly Office 365 ATP Plan 2). Option A (Microsoft Defender for Endpoint integration) is correct because the AIR engine in Defender for Office 365 relies on the Defender for Endpoint signal to investigate and remediate endpoint-based threats, so the integration must be enabled for full automated investigation and response across email and endpoints. Option B (Attack simulation training) is incorrect because it is a separate security awareness and phishing simulation feature, not a prerequisite for AIR. Option C (Microsoft Defender for Cloud Apps) is incorrect because it is a CASB solution for cloud app discovery and governance, not a required component of the Office 365 AIR engine. Option E (Microsoft Entra ID P2 license) is incorrect because Entra ID P2 provides identity protection and conditional access features, not the email/endpoint AIR capability.

Answer

Attack simulation training

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Entra ID P2 license

Question 4

Refer to the exhibit. This is a snippet from an automation rule in Microsoft Sentinel. What is the purpose of the 'RunQuery' action?

Accepted Answer

To retrieve sign-in logs for the user involved in the incident.. The 'RunQuery' action in Microsoft Sentinel automation rules executes a Kusto Query Language (KQL) query against the Log Analytics workspace. In this context, it retrieves sign-in logs for the user involved in the incident, enabling automated enrichment of incident data with relevant authentication details. This is a common pattern for gathering additional evidence without manual investigation.

Answer

To automatically update the incident status to 'Active'.

Answer

To run a PowerShell script on the affected endpoint.

Answer

To trigger a playbook that isolates the user's device.

Question 5

Your organization uses Microsoft Sentinel. A security analyst reports that an incident was automatically closed by a playbook before the investigation was complete. What should you do to prevent automatic closure in the future?

Accepted Answer

Modify the analytics rule to not automatically close incidents. The analytics rule that generates the incident includes a setting to automatically close incidents when an alert is triggered again. Modifying this setting prevents the incident from being closed prematurely, regardless of any playbook or automation rule. This ensures that incidents remain open for investigation until manually resolved.

Answer

Disable the playbook

Answer

Remove the playbook from the automation rule

Answer

Disable the automation rule that triggers the playbook

Question 6

Refer to the exhibit. You are reviewing an automation rule in Microsoft Sentinel that triggers a playbook. The rule is not triggering. What is the most likely cause?

Accepted Answer

The condition 'Status equals Active' is incorrect; incidents are created with status 'New'. In Microsoft Sentinel, automation rules trigger playbooks based on incident creation or update. The condition 'Status equals Active' is incorrect because when an incident is created, its status is 'New', not 'Active'. Therefore, the rule will not trigger. The correct condition should check for 'New' status or use the appropriate trigger.

Answer

The Logic App resource ID is incorrect

Answer

The subscription ID is missing

Answer

The trigger type should be 'IncidentUpdated' instead of 'IncidentCreated'

Question 7

Refer to the exhibit. You are investigating why the query returns only two rows (High and Medium) even though there are Low severity alerts. What is the problem?

Accepted Answer

The case statement does not handle integer severity values. The CASE statement in the query maps integer severity values (3 → 'High', 2 → 'Medium') but does not handle the value 1 (Low). Without an ELSE clause, severity values not explicitly matched (like 1) return NULL, and those rows are filtered out from the results. This explains why only 'High' and 'Medium' rows appear. Option D's statement about a missing default refers to the lack of an ELSE clause, but the root cause is the absence of a WHEN clause for severity 1. The explanation is updated to avoid any contradiction: the CASE statement has no WHEN for 1 and no ELSE, so unmatched values become NULL.

Answer

The order by clause sorts numerically, causing incorrect grouping

Answer

The query does not filter on a specific time range

Answer

The case statement is missing a default value

Question 8

Refer to the exhibit. You are configuring an analytics rule in Microsoft Sentinel. What is the effect of this configuration?

Accepted Answer

Alerts that share all the same entities are grouped into one incident within 5 hours. The configuration groups alerts into a single incident only when they share all the same entities (e.g., same IP, same host, same account) and are generated within a 5-hour window. This is controlled by the 'Group alerts into incidents' settings, specifically the 'Group alerts into a single incident if all entities match' option combined with the 5-hour re-open period. Option C correctly describes this behavior.

Answer

All alerts that share any entity are grouped into one incident

Answer

Each alert creates a separate incident

Answer

Alerts are grouped by alert type

Question 9

Your organization uses Microsoft Defender for Cloud Apps. You discover that a user has been accessing sensitive data from an anonymous IP address. The user's account appears to be compromised. You need to prevent further data exfiltration. What should you do?

Accepted Answer

Suspend the user in Microsoft Defender for Cloud Apps.. Suspending the user in Microsoft Defender for Cloud Apps is the correct immediate action because it temporarily blocks the user from accessing cloud apps and resources without deleting or disabling the account, preserving forensic evidence while stopping exfiltration. This is a built-in remediation action in Defender for Cloud Apps designed for compromised accounts. It is faster and more targeted than disabling the account in Entra ID, which would also block legitimate access and may not be reversible as cleanly.

Answer

Disable the user account in Microsoft Entra ID.

Answer

Create an IP range policy in Defender for Cloud Apps to block the anonymous IP.

Answer

Change the user's password and revoke sessions.

Question 10

The exhibit shows a KQL query used during incident investigation. The analyst wants to identify devices with an unusually high number of outbound connections to public IPs. The query returns no results, though the analyst suspects there should be some. What is the most likely reason?

Accepted Answer

The 'summarize' operator is misused.. The 'summarize' operator in KQL must be followed by an aggregation function (e.g., count(), dcount(), sum(), etc.) to produce a result. In the query, if 'summarize' is used without an aggregation function, it would not output any rows. This is a common mistake. The field 'RemoteIPType' does exist in DeviceNetworkEvents, so option C is incorrect. The timeframe (option A) and data retention (option B) are unlikely to cause zero results in this context.

Answer

The timeframe is too short.

Answer

Data retention for DeviceNetworkEvents is less than 1 day.

Answer

The field 'RemoteIPType' does not exist in DeviceNetworkEvents.

Question 11

A SOC analyst needs to automate response to a phishing email reported by a user. The playbook should automatically block the sender in Exchange Online and delete the email from all recipients. Which Microsoft Sentinel automation action should the analyst use?

Accepted Answer

Use the Microsoft Teams connector to post an adaptive card for approval, then use the Exchange Online PowerShell connector to run a script to block sender and delete email.. The correct approach uses the Microsoft Teams connector to post an adaptive card for analyst approval, then the Exchange Online PowerShell connector to execute the block-sender and delete-email actions. This satisfies the requirement to automate the response while including a human-in-the-loop approval step, and it uses the connector that can actually perform both Exchange Online actions.

Answer

Use the Azure Automation connector to run a runbook that deletes the email only.

Answer

Use the Microsoft 365 Defender connector with an action to run an advanced hunting query.

Answer

Use the ServiceNow connector to create an incident ticket.

Question 12

Your organization uses Microsoft Sentinel as its SIEM and Microsoft Defender XDR for endpoint protection. You have a custom analytics rule that triggers on suspicious PowerShell activity. The rule uses the following KQL query:

```kql
DeviceProcessEvents
| where Timestamp > ago(1h)
| where FileName == "powershell.exe"
| where ProcessCommandLine contains "-EncodedCommand"
| where InitiatingProcessFileName != "explorer.exe"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine
```

The rule generates incidents that are assigned to the SOC team for investigation. However, analysts report that they are spending too much time manually collecting additional process details for each alert. You need to automate the enrichment of these incidents with additional context, such as parent process details, network connections, and file creation events from the same device within the last hour. The enrichment should be triggered automatically when an incident is created, and the results should be added as a comment to the incident. You have access to Azure Logic Apps and Azure Automation. Which approach should you use?

Accepted Answer

Create an automation rule in Microsoft Sentinel that triggers a Logic App playbook when an incident is created. The playbook uses the Microsoft 365 Defender connector to run advanced hunting queries for parent process, network connections, and file creation events from the same device in the last hour, then adds the results as a comment to the incident.. To automate enrichment of incidents with additional context from Defender XDR, you should create an automation rule in Microsoft Sentinel that triggers a Logic App playbook when an incident is created. The playbook uses the Microsoft 365 Defender connector to run advanced hunting queries for parent process details, network connections, and file creation events from the same device within the last hour, then adds the results as a comment to the incident. This approach efficiently automates the manual task. Option A is incorrect because watchlists are intended for static reference data, not for dynamic query results, and creating a second analytics rule is unnecessary. Option C is incorrect because Power Automate is not directly integrated with Sentinel for this purpose; Logic Apps provide deeper integration. Option D is incorrect because modifying the analytics rule query to join additional tables would increase alert latency and query complexity, and it would not add comments to the incident—enrichment should be handled by a playbook.

Answer

Create a second analytics rule that triggers on the same events and sends the additional context to a watchlist, then use a playbook to read the watchlist and add comments.

Answer

Use Microsoft Power Automate to create a flow that is triggered when a new incident appears in Sentinel, then use the flow to query Defender XDR and update the incident.

Answer

Modify the analytics rule query to join with additional tables to include parent process details, network connections, and file creation events directly in the alert.

Question 13

You are a security analyst at Contoso. A user reports that they received a suspicious email with an attachment named "Invoice.pdf.exe". The user did not open the attachment. You need to investigate this potential threat using Microsoft Defender XDR. You want to determine if any other users received the same email, and whether the attachment was detonated in a sandbox. You also want to block the sender domain and the attachment hash across the organization if it is malicious. You have the email message ID from the user. You have appropriate permissions to use advanced hunting and take action. Which set of actions should you take in Microsoft 365 Defender?

Accepted Answer

Use Advanced hunting to query EmailEvents for the message ID to find other recipients, then query EmailAttachmentInfo to get the attachment hash. Use the sandbox data in EmailUrlInfo to check detonation. Then create an indicator block rule for the sender domain and file hash in the Settings > Indicators.. Use Advanced hunting to query EmailEvents for the message ID to find other recipients, then query EmailAttachmentInfo to get the attachment's SHA256 hash. Check the ThreatTypes/DetectionMethods fields in EmailEvents (or the email's entity page in Threat Explorer) to see the malware/sandbox verdict for the attachment. Then create a Tenant Allow/Block List or indicator block entry for the sender domain and the file hash under Settings so the malicious sender and attachment are blocked organization-wide.

Answer

Use the Exchange admin center to run a message trace for the email, then use the Malware section to block the attachment hash.

Answer

Use the Email & collaboration > Explorer to find the email, then use the Quarantine section to block the sender domain.

Answer

Use the Threat Explorer to find the email, then manually block the sender domain in the Exchange Online PowerShell.

Question 14

Your organization uses Microsoft 365 Defender. A security analyst detects a malware infection on a single endpoint named 'SalesPC01'. The malware is identified as 'Trojan:Win32/Emotet'. The endpoint is currently isolated from the network by the automatic response. You need to remediate the infection. The malware has been detected and the endpoint is isolated. What should you do next?

Accepted Answer

Reimage the endpoint to ensure complete removal.. After the endpoint is isolated, the next step is to initiate a full antivirus scan using Microsoft Defender Antivirus to detect and remove the malware. Option A is incorrect because deleting the user account does not remove the malware and is an excessive step. Option B is incorrect because the endpoint is already isolated by automatic response, so manually disconnecting is redundant. Option C is incorrect because reimaging is a more drastic measure that should be taken only if other remediation steps fail.

Answer

Delete the user account that was logged in when the malware was detected.

Answer

Disconnect the endpoint from the network manually.

Answer

Initiate a full antivirus scan using Microsoft Defender Antivirus.

Question 15

Your organization uses Microsoft Sentinel with the Microsoft Defender for Cloud connector enabled. You receive an incident that alerts on 'Suspicious resource deployment' from a user who has been compromised. The incident involves the deployment of a virtual machine in a subscription that is normally not used by that user. The incident severity is High. You need to contain the threat immediately. The deployment is still in progress. What should you do first?

Accepted Answer

Apply a resource lock to the subscription to block all deployments.. Applying a resource lock to the subscription is the most immediate containment action because it prevents any new resource deployments from completing, effectively stopping the attacker from deploying additional resources while the incident is still in progress. Resource locks (CanNotDelete or ReadOnly) are enforced by Azure Resource Manager and take effect immediately, blocking write operations at the scope where they are applied. This directly addresses the ongoing threat without waiting for further investigation or risking incomplete deletion of a resource that is still being provisioned.

Answer

Investigate the Azure Activity logs to see what other resources were deployed.

Answer

Disable the user account in Microsoft Entra ID.

Answer

Delete the virtual machine that is being deployed.