SC-200 Respond to security incidents Practice Test 20 — 15 Questions

Question 1

You are investigating a lateral movement incident in Microsoft Defender for Endpoint. The timeline shows that a user's credentials were used from a compromised workstation to access a sensitive server. Which action should you take to contain the incident?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Reset the compromised user's password and revoke all active sessions.. The incident involves lateral movement using stolen credentials. Resetting the compromised user's password and revoking all active sessions immediately invalidates the credentials the attacker used, preventing further unauthorized access to any resource, including the sensitive server. This directly addresses the root cause (credential theft) rather than just blocking network paths or isolating a single device.

Answer

Disable the sensitive server's network account.

Answer

Isolate the compromised workstation only.

Answer

Block all network traffic from the compromised workstation to the server.

Question 2

An incident is opened in Microsoft Sentinel for multiple sign-in failures from a single IP address targeting a privileged user account. Which action is most effective in automatically responding to this incident?

Accepted Answer

Create a playbook to block the IP address in the firewall.. The most effective automated response is to block the IP address in the firewall via a playbook, as it directly stops the attack source. Disabling the user account is too broad and may affect legitimate access. Enabling MFA does not stop the current attack. Reporting the IP is not immediate.

Answer

Enable conditional access policy to require MFA for the user.

Answer

Create a playbook to automatically disable the user account.

Answer

Report the IP address to Microsoft for threat intelligence.

Question 3

Which TWO actions are appropriate when responding to a confirmed malware outbreak on multiple workstations identified by Microsoft Defender for Endpoint?

Accepted Answer

Collect investigation packages from the affected devices for analysis.. Collecting investigation packages and isolating affected devices are appropriate response actions. Running a full scan is reactive and not immediate. Resetting passwords may be needed later but not first. Blocking indicators is proactive but doesn't contain already infected devices.

Answer

Add the malware hash to the custom threat indicator list.

Answer

Run a full antivirus scan on all workstations.

Answer

Reset passwords of all users who logged into the affected devices.

Question 4

Which TWO actions should be taken to respond to a potential data exfiltration incident detected by Microsoft Defender for Cloud Apps?

Accepted Answer

Suspend the user account in Microsoft Entra ID.. Suspending the user account in Microsoft Entra ID immediately revokes the user's ability to authenticate, preventing further access to cloud resources and stopping potential data exfiltration. This is a direct containment action that aligns with incident response best practices for compromised accounts.

Answer

Block the IP address of the user's device at the firewall.

Answer

Report the user to Microsoft for investigation.

Answer

Run a full antivirus scan on the user's device.

Question 5

Which THREE steps are part of the incident response process when using Microsoft Sentinel?

Accepted Answer

Investigate the incident using hunting queries and entity timelines.. Investigating an incident using hunting queries and entity timelines is a core step in the Microsoft Sentinel incident response process. After an incident is created, analysts use KQL-based hunting queries to proactively search for related threats and leverage entity timelines to visualize the sequence of events and entity interactions, which is essential for understanding the scope and impact of the incident.

Answer

Identify the incident by creating an analytics rule.

Answer

Report the incident to the security team via email.

Question 6

The KQL query above is used in a Microsoft Sentinel analytics rule. What is the purpose of this rule?

Accepted Answer

Detect brute force attempts against disabled user accounts.. The KQL query filters for sign-in events where the user account is disabled (e.g., StatusCode = 50057 or UserAccountControl flags indicate disabled) and then groups by source IP and user to count failed attempts over a short window. When the count exceeds a threshold, it signals a brute force attack targeting disabled accounts, which is a common post-exploitation or reconnaissance technique. Option C is correct because the rule specifically detects repeated authentication failures against disabled accounts, not just any sign-in attempt or inactivity.

Answer

Detect when a disabled user account attempts to sign in.

Answer

Identify users who have been disabled due to inactivity.

Answer

Monitor sign-in attempts from suspicious IP addresses.

Question 7

The exhibit shows a partial playbook trigger configuration in Microsoft Sentinel. When will this playbook be triggered?

Accepted Answer

When an incident of severity High is created.. The playbook trigger configuration shown in the exhibit specifies that the playbook runs when an incident is created, and it includes a condition that filters for incidents with a severity of High. In Microsoft Sentinel, playbook triggers can be set on incident creation or alert creation, and conditions like severity are evaluated at the time of the trigger event. Here, the trigger is explicitly set to 'When an incident is created' with a severity condition of 'High', so the playbook only fires when a new incident with High severity is created.

Answer

When an incident is updated with severity High.

Answer

When an alert is generated with severity High.

Answer

When any incident is created.

Question 8

The exhibit shows the output of a Microsoft Defender for Endpoint API call to get machine information. What does the isolationStatus value indicate?

Accepted Answer

The device has been isolated from the network.. The isolationStatus value in Microsoft Defender for Endpoint indicates whether a device has been isolated from the network. When the value is 'Isolated', it means the device is blocked from communicating with other devices or the internet, typically as a response to a security incident. Option D is correct because this status directly reflects that the device is isolated from the network.

Answer

The device is healthy and has no issues.

Answer

The device is currently being scanned for malware.

Answer

The device is not isolated and is fully connected.

Question 9

Your organization is using Microsoft Defender for Office 365. A user reports receiving a suspicious email that appears to be from the CEO requesting an urgent wire transfer. You need to investigate the email and take immediate action. What should you do first?

Accepted Answer

Use Threat Explorer in the Microsoft 365 Defender portal to find and delete the email.. Threat Explorer in the Microsoft 365 Defender portal provides the fastest and most direct way to investigate and remediate a specific suspicious email across all mailboxes. It allows you to search for the email by sender, subject, or recipient, and then take immediate action such as soft-delete or hard-delete to remove it from user inboxes. This is the correct first step for an urgent incident response scenario involving a targeted phishing attack.

Answer

Use the Exchange admin center to run a message trace.

Answer

Use the Security & Compliance Center to create a mail flow rule.

Answer

Submit the email to Microsoft for analysis using the Submissions page.

Question 10

Your organization uses Microsoft Sentinel. A security analyst reports that an incident was automatically created for a sign-in from an unfamiliar location, but after investigation, it was determined to be a false positive. You need to reduce similar false positives in the future without affecting legitimate detections. What should you do?

Accepted Answer

Modify the analytics rule query to exclude sign-ins from the specific location.. Modifying the analytics rule query to exclude sign-ins from the specific location directly addresses the false positive at the detection logic level. This ensures that only sign-ins from that location are ignored, while all other unfamiliar location detections remain active, preserving legitimate detections.

Answer

Disable the analytics rule that created the incident.

Answer

Add the location to a watchlist and reference it in the analytics rule.

Answer

Create an automation rule to close similar incidents automatically.

Question 11

Your organization is using Microsoft Defender for Cloud to protect Azure workloads. A critical vulnerability was discovered in a virtual machine that is part of a production application. The vulnerability has a high severity score and is actively being exploited in the wild. You need to respond quickly to mitigate the risk. What is the most effective immediate action?

Accepted Answer

Enable just-in-time (JIT) VM access in Microsoft Defender for Cloud to lock down inbound traffic.. Enabling just-in-time (JIT) VM access in Microsoft Defender for Cloud immediately reduces the attack surface by locking down inbound traffic to the VM, except for approved connections from specific IP addresses and ports. This is the most effective immediate action when a critical, actively exploited vulnerability exists, as it buys time to apply a patch without exposing the VM to further exploitation. Unlike patching, which may require a reboot or cause downtime, JIT access can be enabled in minutes and does not disrupt production traffic for authorized users.

Answer

Apply the vendor patch immediately during business hours.

Answer

Modify the network security group (NSG) to block all inbound traffic to the VM.

Answer

Use the 'Remediate' option in Defender for Cloud to automatically apply the patch.

Question 12

Your organization uses Microsoft Defender XDR. A user reports that their device is behaving erratically, with unexpected pop-ups and high CPU usage. You suspect malware infection. You need to collect forensic data from the device for analysis. What should you do?

Accepted Answer

Initiate a live response session on the device from the Microsoft 365 Defender portal.. Initiating a live response session from the Microsoft 365 Defender portal allows you to remotely connect to the device and perform real-time forensic data collection, such as running scripts, capturing memory dumps, and collecting files, without disrupting the device's state. This is the appropriate method for gathering forensic evidence when malware is suspected, as it provides deep, interactive access for analysis.

Answer

Create a custom detection rule in Microsoft Defender for Endpoint to capture the behavior.

Answer

Offboard the device and re-onboard it to trigger a fresh investigation.

Answer

Run a full antivirus scan using Microsoft Defender Antivirus.

Question 13

Your organization uses Microsoft Sentinel. You have been asked to configure automated responses to security incidents. Which TWO of the following can be used to automate responses in Microsoft Sentinel?

Accepted Answer

Playbooks (Azure Logic Apps). Playbooks in Microsoft Sentinel are built on Azure Logic Apps, allowing you to automate complex, multi-step response workflows triggered by security incidents. They can execute actions like blocking IPs, resetting passwords, or enriching alerts with threat intelligence, making them a core automation tool for incident response.

Answer

Workbooks

Answer

Power Automate flows

Answer

Custom connectors

Question 14

Your organization uses Microsoft Defender XDR. A security incident involving a compromised user account has been identified. Which THREE actions should you take to contain and remediate the incident?

Accepted Answer

Disable the user account in Microsoft Entra ID.. Disabling the user account in Microsoft Entra ID is a critical containment step because it immediately prevents the compromised account from authenticating to any Microsoft cloud services, including Exchange Online, SharePoint, and Teams. This action blocks further unauthorized access at the identity level, which is the foundation of the attack vector in a user account compromise. It is a direct and effective way to stop the attacker from using the account for lateral movement or data exfiltration.

Answer

Block all IP addresses that the user has connected from.

Answer

Restore the user's mailbox from a backup.

Question 15

Your organization uses Microsoft Sentinel. You are investigating an incident and need to gather additional context about a suspicious IP address. Which TWO Microsoft Sentinel features can you use to enrich the investigation?

Accepted Answer

Threat intelligence. Threat intelligence is correct because it allows you to cross-reference the suspicious IP address against known threat intelligence feeds (e.g., Tor exit nodes, known C2 servers) directly within Microsoft Sentinel. This enriches the investigation by providing context such as reputation scores, associated malware families, and geographic origin, helping you assess the IP's maliciousness.

Answer

Watchlist

Answer

Hunting

Answer

User and Entity Behavior Analytics (UEBA)