SC-200 Respond to security incidents Practice Test 20 — 15 Questions

Question 1

You are investigating a potential ransomware incident in Microsoft Defender XDR. The incident has a high severity alert indicating that a user installed a suspicious application. Which initial response action should you take to contain the threat while preserving evidence?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Isolate the device using Microsoft Defender for Endpoint.. Isolating the device using Microsoft Defender for Endpoint immediately stops lateral movement and data exfiltration while preserving forensic data. Option B is wrong because resetting the password and enforcing MFA does not contain the threat on the device itself. Option C is wrong because uninstalling the suspicious application may remove evidence needed for investigation. Option D is wrong because disabling the user account does not stop malware already running on the device.

Answer

Reset the user's password and enforce MFA.

Answer

Uninstall the suspicious application via Intune.

Answer

Disable the user account in Microsoft Entra ID.

Question 2

During a security incident, you need to collect email messages associated with a phishing campaign from multiple mailboxes in Microsoft 365. Which tool should you use to search and export these emails?

Accepted Answer

Content Search in the Microsoft Purview compliance portal.. Content Search in the Microsoft Purview compliance portal is the correct tool for searching and exporting email messages from multiple mailboxes during a phishing incident. It allows granular search queries and bulk export of results. Option A is wrong because Advanced Hunting in Microsoft Defender XDR is for threat hunting queries on security data, not for exporting email messages. Option B is wrong because Incident investigation in the Microsoft 365 Defender portal provides incident management and automated investigation but does not support bulk email export. Option C is wrong because Mail Flow in the Exchange admin center is used for configuring mail routing rules, not for content search and export.

Answer

Advanced Hunting in Microsoft Defender XDR.

Answer

Incident investigation in the Microsoft 365 Defender portal.

Answer

Mail Flow in the Exchange admin center.

Question 3

Your organization uses Microsoft Sentinel with the Microsoft Defender XDR connector. During an incident, you receive a critical alert for a user who is reported as compromised. You need to verify if the compromise is real and respond quickly. Which feature should you use to automatically trigger a playbook that contains the account?

Accepted Answer

An automation rule that triggers a playbook when the alert is created.. Automation rules in Microsoft Sentinel can be configured to trigger a playbook when an alert is created, enabling an immediate automated response such as containing a compromised account. Option B is incorrect because analytics rules generate alerts but do not directly trigger playbooks; they rely on automation rules for that. Option C is incorrect because workbooks are visualization tools and do not automate responses. Option D is incorrect because watchlists are used for data enrichment and correlation, not for triggering automated actions.

Answer

An analytics rule configured to run a playbook when the alert is generated.

Answer

A workbook that displays the user's activity for manual investigation.

Answer

A watchlist that includes the user's name to block the account.

Question 4

You are responding to a data exfiltration incident involving a user who copied sensitive files to a personal cloud storage service. The files were accessed from the user's managed device. Which Microsoft  Defender for Cloud Apps activity policy should you create to detect similar future incidents?

Accepted Answer

An activity policy that detects uploads to personal cloud storage services.. The incident involves a user copying sensitive files to a personal cloud storage service from a managed device. An activity policy in Microsoft Defender for Cloud Apps can be configured to detect specific activities, such as uploads to personal cloud storage services (e.g., Dropbox, Google Drive), by monitoring the 'Upload' event for recognized cloud apps. This directly addresses the detection of similar future incidents by alerting on the exact action (upload) to the specific service category (personal storage).

Answer

An anomaly detection policy that flags impossible travel.

Answer

A file policy that detects files shared with external users.

Answer

An app discovery policy that identifies new cloud apps used in the organization.

Question 5

During an incident investigation, you find that a user's credentials were used to sign in from an unfamiliar location. You want to force a password reset and revoke all sessions immediately. Which action should you take in the Microsoft 365 Defender portal?

Accepted Answer

Use the 'Require password reset' action from the user investigation page.. The 'Require password reset' action in the user investigation page of Microsoft 365 Defender forces the user to change their password and immediately revokes all active sessions, addressing both requirements. Option A is incorrect because disabling the user account blocks access but does not reset the password. Option B is incorrect because blocking sign-in via Conditional Access does not revoke existing sessions or force a password reset. Option D is incorrect because removing MFA registration does not reset the password or revoke sessions.

Answer

Disable the user account in Microsoft Entra ID.

Answer

Block the user's sign-in from the unfamiliar location via Conditional Access.

Answer

Remove the user's MFA registration to force re-registration.

Question 6

Your incident response team uses Microsoft Sentinel with automation rules and playbooks. During an incident, you need to automatically collect a memory dump from an affected Windows server and upload it to an Azure storage account for analysis. Which type of playbook should you use?

Accepted Answer

A playbook triggered by an automation rule when the incident is created.. Automation rules in Microsoft Sentinel can be configured to trigger a playbook when an incident is created or updated. This allows automatic collection of a memory dump and upload to Azure storage. Option A is incorrect because installing a script on the server is not a playbook type; playbooks are automation workflows that can use various connectors, but the question asks about the trigger mechanism. Option B is incorrect because analytics rules generate alerts, but playbooks cannot be triggered directly from analytics rules; they must be triggered by automation rules or run manually. Option C is incorrect because the requirement is automation, not manual execution.

Answer

A playbook that installs a script on the server to collect the dump.

Answer

A playbook triggered directly from the analytics rule that generates the alert.

Answer

A playbook that must be run manually from the incident page.

Question 7

You are investigating a suspicious sign-in reported in Microsoft Defender for Cloud Apps. The activity shows that a user accessed a sensitive SharePoint site from an anonymous IP address. What is the most effective immediate response to prevent further access?

Accepted Answer

Suspend the user account in Microsoft 365 Defender.. Suspending the user account immediately blocks access to all cloud apps, including SharePoint, regardless of the device or IP address. Option B is incorrect because changing permissions on the SharePoint site only restricts that specific site, but the compromised user account can still access other resources. Option C is incorrect because disabling the device does not prevent the attacker from using another device to access cloud services as the compromised user. Option D is incorrect because blocking the anonymous IP address may not be effective if the attacker rotates IPs or uses a different anonymous IP, and it does not address the underlying compromise of the user account.

Answer

Change the SharePoint site permissions to remove the user's access.

Answer

Disable the user's device in Microsoft Intune.

Answer

Add the anonymous IP address to the blocked IP address list in Conditional Access.

Question 8

Your organization uses Microsoft Sentinel with the Microsoft Defender XDR connector. You have a critical incident that involves multiple alerts across different services. The incident is being updated with new alerts. You need to ensure that a specific playbook runs only when the incident severity is updated to High. How should you configure the automation rule?

Accepted Answer

Set the trigger to 'When incident is updated' and add a condition on severity equals High.. Automation rules can trigger on incident update and filter by severity. Option A is wrong because condition 'when incident is created' would not trigger on update. Option C is wrong because the trigger condition should be on incident update, not alert creation. Option D is wrong because automation rules are not configured inside playbooks.

Answer

Set the trigger to 'When an alert is created' and filter for alerts with High severity.

Answer

Set the trigger to 'When incident is created' and add a condition on severity equals High.

Answer

Configure the condition inside the playbook to check severity and exit if not High.

Question 9

During an incident response, you need to collect forensic data from a compromised Linux server that is not managed by Microsoft Defender for Endpoint. You plan to use a manual collection script. Which tool should you use to securely upload the collected data to Azure for analysis?

Accepted Answer

AzCopy to upload the data to Azure Blob Storage.. AzCopy, is the correct tool because it is designed for efficient, secure data transfer to Azure Blob Storage, supports Linux, and does not require a managed agent. Option A is incorrect because Azure CLI is a management tool, not optimized for large file uploads. Option C is incorrect because PowerShell is not natively installed on Linux typically, and Log Analytics works with structured log data, not arbitrary forensic files. Option D is incorrect because the Log Analytics agent forwards structured log data, not raw files.

Answer

Azure CLI to upload the data to an Azure Files share.

Answer

PowerShell to send the data to Log Analytics workspace.

Answer

The Log Analytics agent to forward the data.

Question 10

You are responding to a ransomware incident where multiple devices are encrypted. The incident is captured in Microsoft Sentinel. Which TWO actions should you take first to contain the incident?

Accepted Answer

Disable user accounts associated with the affected devices in Microsoft Entra ID.. Options A and B are correct because disabling user accounts and isolating affected devices are immediate containment actions to prevent further spread of the ransomware. Option C is wrong because resetting passwords does not stop active encryption. Option D is wrong because malware analysis is investigative, not containment. Option E is wrong because restoring from backup is a recovery step, not a first containment action.

Answer

Reset passwords for all affected users.

Answer

Run a malware analysis on a sample of the ransomware.

Answer

Restore encrypted files from backups.

Question 11

Which THREE of the following are valid incident response actions in Microsoft Defender XDR?

Accepted Answer

Isolate a device.. Options A, D, and E are valid incident response actions in Microsoft Defender XDR. Isolating a device (A) prevents further compromise. Deleting an email message (D) removes malicious content from user mailboxes. Disabling a user account (E) stops access for compromised accounts. Option B is invalid because resetting a user password is typically done in Microsoft Entra ID, not directly as an incident action in Defender XDR. Option C is invalid because blocking a malicious URL is a threat protection action in Defender for Office 365 or Defender for Cloud Apps, not a direct incident response action in the Defender XDR portal.

Answer

Reset user password.

Answer

Block a malicious URL.

Question 12

You are investigating a data exfiltration incident in Microsoft Defender for Cloud Apps. The investigation reveals that a user downloaded sensitive files from SharePoint and uploaded them to a third-party cloud storage app. Which THREE actions should you take to contain the incident?

Accepted Answer

Apply a session policy to block uploads to unauthorized apps.. Options A, B, and C are correct. Applying a session policy to block uploads to unauthorized apps (A) prevents further data exfiltration. Suspending the user account in Microsoft 365 Defender (B) immediately stops the user's access to organizational resources. Adding the third-party app to the blocked apps list in Defender for Cloud Apps (C) prevents future uploads to that app. Option D is incorrect because deleting files from the third-party app is a recovery action, not containment. Option E is incorrect because applying sensitivity labels is a classification action and does not immediately contain the incident.

Answer

Delete the files from the third-party cloud app.

Answer

Apply a sensitivity label to the files to prevent sharing.

Question 13

You deploy this ARM template to a Microsoft Sentinel workspace. After deployment, you notice that the saved search does not appear as an analytics rule. What is the most likely reason?

Accepted Answer

The resource type is 'savedSearches', not 'scheduledQueryRules' or 'alertRules'.. Saved searches in Microsoft Sentinel are created under the 'Microsoft.OperationalInsights/workspaces/savedSearches' resource type, not as analytics rules. Analytics rules require a different resource type such as 'Microsoft.SecurityInsights/alertRules'. Therefore, deploying a saved search template will not create an analytics rule. Option A is incorrect: tags are metadata and do not affect whether the resource appears as an analytics rule. Option C is incorrect: the API version used is valid for saved searches; an invalid API version would cause a deployment error, but the issue is the resource type, not the API version. Option D is incorrect: even if the KQL query syntax is invalid, the saved search would still be deployed as a saved search, but it would not become an analytics rule.

Answer

The tags are incorrectly formatted.

Answer

The API version is incorrect.

Answer

The KQL query syntax is invalid.

Question 14

You are investigating a potential malicious PowerShell execution in Microsoft Defender for Endpoint using this KQL query in Advanced Hunting. The query returns no results. What is the most likely cause?

Accepted Answer

The table name should be 'DeviceProcessEvents' instead of 'DeviceEvents'.. The query uses the table 'DeviceEvents', which is incorrect for hunting process execution events. The correct table for process creation events in Microsoft Defender for Endpoint Advanced Hunting is 'DeviceProcessEvents'. 'DeviceEvents' contains other types of events (e.g., registry, file, network) but not process creation data, so the query returns no results.

Answer

The column names are incorrect; 'InitiatingProcessFileName' should be 'ParentProcessFileName'.

Answer

The 'take 100' operator limits results to only 100, but the query may return results if more data exists.

Answer

The query uses 'ago(7d)' which may be too short for historical data.

Question 15

You have an automation rule in Microsoft Sentinel configured as shown. An incident with severity Medium is created, but the playbook does not run. What is the most likely reason?

Accepted Answer

The automation rule trigger is set to 'When incident is created', but the incident may have been created with a lower severity and later updated to Medium.. The automation rule is set to trigger 'When incident is created'. If the incident was initially created with a lower severity (e.g., Low) and then later updated to Medium, the rule would not trigger because the trigger condition is evaluated at creation time, not on update. Therefore, the playbook does not run despite the incident having Medium severity. Option A is incorrect because the trigger type should be 'Incident' for this rule. Option C is incorrect because permission issues would typically cause the playbook to fail after triggering, not prevent it from starting. Option D is incorrect because an invalid playbookId would produce an error, not silently skip execution.

Answer

The triggerType should be 'Alert' instead of 'Incident'.

Answer

The playbook does not have permissions to run in the Sentinel resource group.

Answer

The playbookId is incorrect or the playbook has been deleted.