SC-200 Respond to security incidents Practice Test 2 — 15 Questions

Question 1

A security analyst receives a high-severity alert for a suspicious login from an unusual location. The alert was generated by Microsoft Sentinel from Microsoft Entra ID sign-in logs. The analyst needs to determine if the login was successful and if any data exfiltration occurred. What is the MOST efficient first step?

Accepted Answer

Run a KQL query in Microsoft Sentinel to review the SigninLogs table for the user within the alert time range.. Option B is correct because examining Microsoft Entra ID sign-in logs in Sentinel provides immediate details about login success/failure. Option A is wrong because Defender for Cloud Apps alerts may not include sign-in details. Option C is wrong because reviewing all firewalls is too broad and inefficient. Option D is wrong because checking Microsoft Defender XDR does not directly show sign-in details.

Answer

Use Microsoft Defender XDR to check the user's device timeline for suspicious activity.

Answer

Run a KQL query in Microsoft Sentinel to check Microsoft Defender for Cloud Apps alerts for the user.

Answer

Check the firewall logs in Azure Firewall for outbound connections from the user's IP.

Question 2

Your organization uses Microsoft Defender for Office 365. A user reports receiving a phishing email that bypassed the default policy. You need to create a custom anti-phishing policy to block similar emails in the future. What should you configure?

Accepted Answer

Enable spoof intelligence and add the sender domain to the blocked senders list.. Option D is correct because spoof intelligence identifies and blocks spoofed senders. Option A is wrong because impersonation protection addresses CEO fraud, not general phishing. Option B is wrong because mail flow rules are transport rules, not anti-phishing. Option C is wrong because Safe Attachments handles attachments, not phishing content.

Answer

Enable Safe Attachments for the organization.

Answer

Configure impersonation protection for the user's domain.

Answer

Create a mail flow rule to block the sender's domain.

Question 3

A security team is investigating a ransomware incident that encrypted files on several Windows servers. Microsoft Defender for Endpoint detected the ransomware but the initial infection vector is unknown. Which KQL query in Microsoft Sentinel would BEST identify the initial process that executed the ransomware?

Accepted Answer

DeviceProcessEvents | where FileName contains 'ransomware.exe' | project DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, Timestamp. Option B is correct because DeviceProcessEvents tracks process creation events and can trace parent-child relationships. Option A is wrong because DeviceFileEvents tracks file changes, not process creation. Option C is wrong because DeviceNetworkEvents tracks network connections, not processes. Option D is wrong because DeviceEvents includes various events but not as directly for process ancestry.

Answer

DeviceNetworkEvents | where RemoteUrl contains 'malicious' | project DeviceName, RemoteIP, Timestamp

Answer

DeviceFileEvents | where FileName contains 'ransomware.exe' | project DeviceName, ActionType, Timestamp

Answer

DeviceEvents | where ActionType == 'RansomwareDetection' | project DeviceName, Timestamp

Question 4

You have a Microsoft Sentinel analytical rule with the above configuration. During a security incident, multiple high-severity alerts are generated within a 5-minute window. How does the rule handle these alerts?

Accepted Answer

Alerts with the same entities are grouped into a single incident.. Option C is correct because grouping is enabled with a 5-minute lookback and 'All' entities matching method, meaning alerts with identical entities are grouped into one incident. Option A is wrong because grouping is enabled, not disabled. Option B is wrong because alerts are grouped, not created separately. Option D is wrong because alerts are not suppressed; suppression is disabled.

Answer

Only the first alert creates an incident; subsequent alerts are ignored.

Answer

Each alert creates a separate incident.

Answer

Alerts are suppressed for 5 minutes after the first alert.

Question 5

You are deploying Microsoft Sentinel using the above ARM template parameters. After deployment, you notice that Microsoft Defender for Cloud alerts are not being ingested. What is the MOST likely reason?

Accepted Answer

The 'MicrosoftThreatProtection' connector only ingests Microsoft Defender XDR signals, not Defender for Cloud alerts.. Option C is correct because 'MicrosoftThreatProtection' in the dataConnectors list refers to Microsoft Defender XDR, not Defender for Cloud. Defender for Cloud requires the 'AzureSecurityCenter' data connector. Option A is wrong because UEBA is enabled but does not affect data ingestion. Option B is wrong because location does not affect connector availability. Option D is wrong because workspace name is valid.

Answer

UEBA is enabled, which conflicts with Defender for Cloud data ingestion.

Answer

The workspace location (eastus) does not support Defender for Cloud connector.

Answer

The workspace name 'sentinel-workspace' is reserved for internal use.

Question 6

Your organization uses Microsoft Defender for Cloud to assess the security posture of Azure subscriptions. You receive an alert that a critical vulnerability exists on a virtual machine. What is the BEST immediate action to validate the alert and contain the threat?

Accepted Answer

Review the alert details in Microsoft Defender for Cloud to identify the vulnerability and follow the remediation steps.. Option A is correct because the alert includes affected resources and remediation steps. Option B is wrong because applying a patch without validation may cause downtime. Option C is wrong because isolating the VM from the network is a containment step but not validation. Option D is wrong because contacting support is not immediate action.

Answer

Contact Microsoft support to request a vulnerability assessment.

Answer

Immediately apply the latest security patches to the VM using Azure Update Manager.

Answer

Isolate the VM from the network by applying a network security group rule.

Question 7

A SOC analyst is investigating an incident where a user's credentials were compromised. The analyst uses Microsoft Sentinel to find all activities performed by the user in the last 24 hours. Which data source should the analyst query FIRST to get the most comprehensive view of the user's actions across Microsoft 365?

Accepted Answer

OfficeActivity. Option B is correct because OfficeActivity (Unified Audit Log) captures user actions across Exchange Online, SharePoint, Teams, etc. Option A is wrong because SigninLogs only shows sign-ins, not activities. Option C is wrong because AzureActivity shows Azure resource actions, not Microsoft 365. Option D is wrong because DeviceEvents are for endpoints, not Microsoft 365.

Answer

DeviceEvents

Answer

AzureActivity

Answer

SigninLogs

Question 8

During a security incident, you need to block a malicious IP address at the network level for all Azure resources in a subscription. You have Azure Firewall deployed. What is the MOST efficient method to implement the block?

Accepted Answer

Use Azure Firewall Manager to create a global deny rule for the IP address across all firewalls.. Option D is correct because Azure Firewall Manager allows central management of firewall policies, including application and network rules across subscriptions. Option A is wrong because NSGs are per-subnet and not as efficient. Option B is wrong because Azure Firewall policies are not automatically applied to all VMs. Option C is wrong because each Azure Firewall rule applies to that firewall only.

Answer

Block the IP using Microsoft Defender for Cloud's adaptive network hardening.

Answer

Create a network security group (NSG) rule on each virtual network subnet to deny the IP.

Answer

Add a rule to the Azure Firewall policy to deny outbound traffic to the IP address.

Question 9

Your organization uses Microsoft Defender for Endpoint. An endpoint is detected as infected with a trojan. The analyst needs to isolate the device from the network while preserving forensic data. What action should the analyst take?

Accepted Answer

Initiate the 'Isolate device' action from the Microsoft Defender XDR portal.. Option C is correct because 'Isolate device' in Defender for Endpoint disconnects the device from the network but keeps it connected to Microsoft Defender for analysis. Option A is wrong because disabling the network adapter may lose connection to Defender. Option B is wrong because removing the device from the domain does not isolate it. Option D is wrong because reimaging destroys forensic data.

Answer

Remove the device from the Active Directory domain.

Answer

Disable the network adapter on the device.

Answer

Perform a full reimage of the device.

Question 10

Which TWO actions should an analyst take when triaging a Microsoft Sentinel incident that involves a user who clicked a malicious link in a phishing email? (Choose two.)

Accepted Answer

Run a KQL query on EmailEvents to identify the email and recipient.. Options A and D are correct. A: Running a KQL query on EmailEvents identifies the email and user. D: Checking Microsoft Defender for Office 365 shows the threat status. Option B is wrong because the analyst should not delete the email yet (investigation first). Option C is wrong because resetting password is premature without evidence of compromise.

Answer

Reset the user's password immediately.

Answer

Block the sender's domain in the tenant's block list.

Answer

Delete the email from the user's mailbox immediately.

Question 11

Which THREE are valid data connectors in Microsoft Sentinel for ingesting security events from Microsoft 365 services? (Choose three.)

Accepted Answer

Microsoft 365 Defender. Options A, C, and D are valid connectors. A: Microsoft Entra ID (formerly Azure AD) connector ingests sign-in logs and audit logs. C: Microsoft 365 Defender connector ingests alerts from Defender for Endpoint, Office 365, etc. D: Office 365 connector ingests Exchange, SharePoint, Teams logs. Option B is wrong because Microsoft Purview is a compliance portal, not a data connector. Option E is wrong because Microsoft Intune is a device management service, but its logs are ingested via other connectors (e.g., Azure AD).

Answer

Microsoft Purview

Answer

Microsoft Intune

Question 12

Which TWO are valid incident management actions in Microsoft Sentinel? (Choose two.)

Accepted Answer

Change the incident status to 'Closed'. Options B and D are correct. B: Changing the status to 'Closed' is a valid action. D: Assigning the incident to another analyst is a valid action. Option A is wrong because deleting incidents is not supported; they can be closed or archived. Option C is wrong because merging incidents is not a direct action; incidents can be linked via groups. Option E is wrong because exporting incidents to a CSV is not a built-in action.

Answer

Merge two incidents into one

Answer

Export the incident to a CSV file

Answer

Delete an incident

Question 13

You deploy the above ARM template to create a scheduled analytics rule in Microsoft Sentinel. After deployment, the rule runs but never generates incidents. What is the MOST likely cause?

Accepted Answer

The saved search resource type is incorrectly used; it should not be included in the template.. Option D is correct because the saved search (savedSearches) resource type is not a valid alert rule in Sentinel; the alert rule resource type should be 'Microsoft.SecurityInsights/alertRules' with the correct schema. The template includes a saved search and an alert rule, but the alert rule's query uses SigninLogs which is valid. However, the issue is that the saved search is incorrectly defined as a resource. Option A is wrong because the query is valid. Option B is wrong because severity is valid. Option C is wrong because the rule is enabled.

Answer

The severity level 'Medium' is not supported.

Answer

The rule is disabled because 'enabled' is set to true but there is a typo.

Answer

The query 'SigninLogs | where ResultType == 50057' is invalid.

Question 14

A SOC analyst needs to investigate a potential data exfiltration incident involving a user uploading files to an external cloud storage service. Which Microsoft Sentinel data source would provide the MOST relevant information?

Accepted Answer

OfficeActivity. Option B is correct because OfficeActivity includes SharePoint and OneDrive audit logs, which track file uploads. Option A is wrong because SigninLogs only shows sign-ins. Option C is wrong because AzureActivity tracks Azure resource actions, not file uploads. Option D is wrong because CommonSecurityLog is for firewall logs, not file uploads.

Answer

SigninLogs

Answer

CommonSecurityLog

Answer

AzureActivity

Question 15

Your organization uses Microsoft Defender for Cloud to monitor hybrid workloads. You receive an alert that a fileless malware attack was detected on an on-premises server connected via Azure Arc. The server is running Windows Server 2019. What is the BEST action to contain the threat?

Accepted Answer

Run a script via Azure Arc to disable the network interfaces on the server.. Option D is correct because Azure Arc allows executing scripts on the server, and running a script to disable network interfaces is a quick containment method. Option A is wrong because uninstalling the agent would lose visibility. Option B is wrong because Azure Update Manager does not contain fileless attacks. Option C is wrong because Azure Automation runbooks can be used but require setup; direct script execution is faster.

Answer

Apply a security update using Azure Update Manager.

Answer

Use Azure Automation runbook to restart the server.

Answer

Uninstall the Azure Arc agent from the server to isolate it.