SC-200 Respond to security incidents Practice Test 20 — 15 Questions

Question 1

Your security team is investigating a suspicious sign-in from an unfamiliar IP address. The user has Microsoft Entra ID P2 licenses and is assigned a Conditional Access policy that requires MFA for all cloud apps. During the incident response, you find that the sign-in succeeded despite the user not completing MFA. Which action should you take first to investigate the discrepancy?

Accepted Answer

Review the Microsoft Entra sign-in logs for the specific sign-in event. Option B is correct because the sign-in logs provide detailed authentication details, including whether MFA was satisfied or bypassed. Option A is wrong because the user risk policy triggers on detected risk, but the issue is about MFA enforcement. Option C is wrong because the audit logs show administrative actions, not authentication details. Option D is wrong because the sign-in logs show the policy applied, not the policy configuration itself.

Answer

Review the user risk detection in Microsoft Entra ID Protection

Answer

Check the Microsoft Entra audit logs for policy changes

Answer

Use the Conditional Access What If tool

Question 2

During a ransomware incident, a security analyst needs to isolate an affected Windows 10 device managed by Microsoft Intune. The device is currently online and connected to the corporate network. Which remediation action should be taken from Microsoft Defender XDR to achieve this?

Accepted Answer

Initiate device isolation from the Microsoft Defender for Endpoint console. Option A is correct because device isolation in Microsoft Defender for Endpoint disconnects the device from the network while allowing communication with the Defender service. Option B is wrong because running a full antivirus scan does not isolate the device. Option C is wrong because turning off Windows Firewall would increase exposure. Option D is wrong because blocking the device in Intune revokes access to resources but does not isolate the device from the network.

Answer

Block the device in Microsoft Intune

Answer

Disable the Windows Firewall via Intune

Answer

Run a full antivirus scan from Microsoft Defender for Endpoint

Question 3

Your organization uses Microsoft Sentinel. You receive a high-severity incident indicating a potential data exfiltration from an Azure Storage account. The incident contains entities such as IP addresses and user accounts. Which step should you perform first to contain the threat?

Accepted Answer

Investigate the incident to confirm the activity is malicious. Option C is correct because the first step in incident response is to verify the alert is a true positive before taking containment actions. Option A is wrong because blocking the IP may be premature if the alert is false. Option B is wrong because disabling the storage account could impact legitimate operations. Option D is wrong because contacting the user may tip off a malicious insider.

Answer

Contact the user associated with the storage account

Answer

Block the suspicious IP address in the Azure Firewall

Answer

Disable the storage account

Question 4

Your security operations center (SOC) uses Microsoft Sentinel with a custom analytics rule that generates an incident when more than 10 failed logons occur within 5 minutes. During a review, you notice that a single user triggered the rule by forgetting their password multiple times. The incident was automatically closed by a playbook. What is the most effective way to reduce false positives for this rule?

Accepted Answer

Increase the threshold to 20 failed logons. Option D is correct because adjusting the threshold (e.g., to 20 failures) reduces false positives while still capturing brute-force attacks. Option A is wrong because disabling the rule removes detection entirely. Option B is wrong because grouping by user still generates an incident per user. Option C is wrong because a playbook to close incidents does not prevent generation.

Answer

Create a playbook to automatically close the incident

Answer

Disable the analytics rule

Answer

Change the rule to group events by user

Question 5

A security analyst is investigating an incident involving a suspicious process that was detected on multiple devices. The analyst wants to check if the same file hash was observed on other devices in the past 30 days. Which Microsoft 365 Defender table should be queried in KQL?

Accepted Answer

DeviceFileEvents. Option B is correct because DeviceFileEvents contains file hash information and can be queried for file occurrences across devices. Option A is wrong because DeviceProcessEvents does not include file hash. Option C is wrong because DeviceNetworkEvents deals with network connections. Option D is wrong because DeviceEvents includes various events but not file hash.

Answer

DeviceNetworkEvents

Answer

DeviceProcessEvents

Answer

DeviceEvents

Question 6

Refer to the exhibit. You are analyzing a KQL query in Microsoft Sentinel that generates an incident for users with more than 5 failed sign-in attempts (error code 50057 indicates user account is disabled) from a single IP in the last hour. After enabling the rule, you receive too many incidents from a service account that legitimately fails frequently. How should you modify the query to reduce false positives?

Accepted Answer

Add a filter to exclude the service account: and UserPrincipalName !="svc-account@domain.com". Option C is correct because excluding the service account from the query prevents incidents from that account. Option A is wrong because increasing the threshold may miss real attacks. Option B is wrong because error code 50057 specifically indicates disabled accounts; changing it would alter detection logic. Option D is wrong because grouping by user alone does not exclude the service account.

Answer

Change the error code to 50126

Answer

Remove the IPAddress from the summarize clause and group only by UserPrincipalName

Answer

Increase the Threshold to 10

Question 7

An analyst in your SOC receives a Microsoft Defender for Cloud Apps alert indicating a suspicious Power Automate flow that is forwarding emails to an external domain. The analyst needs to disable the flow immediately. Which action should they take?

Accepted Answer

Use the governance action in Microsoft Defender for Cloud Apps to disable the flow. Option A is correct because from the Defender for Cloud Apps portal, the analyst can govern the app by disabling the suspicious flow. Option B is wrong because disabling the user account is more disruptive and may not stop the flow if it uses service principal. Option C is wrong because Power Automate flows are not managed via the Microsoft 365 admin center. Option D is wrong because blocking the external domain in Exchange Online does not stop the flow.

Answer

Block the external domain in Exchange Online mail flow rules

Answer

Remove the flow from the Microsoft 365 admin center

Answer

Disable the user account in Microsoft Entra ID

Question 8

During an incident response, you need to collect forensic evidence from a compromised Azure virtual machine that is currently offline. What is the most efficient method to acquire a disk snapshot for analysis while preserving the integrity of the evidence?

Accepted Answer

Create a snapshot of the OS disk from the Azure portal. Option B is correct because creating a snapshot from the Azure portal creates a point-in-time copy without affecting the original disk. Option A is wrong because starting the VM changes the state. Option C is wrong because attaching a new disk is for adding storage, not forensic acquisition. Option D is wrong because exporting the disk to a storage account is a valid method but snapshot is faster and more efficient for preservation.

Answer

Attach a new data disk and copy the contents manually

Answer

Start the VM and use Azure Backup to take a backup

Answer

Export the disk to a storage account using AzCopy

Question 9

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You have a custom analytics rule that triggers on a Defender for Endpoint alert. When the rule triggers, a playbook is executed that creates an incident in Microsoft Sentinel and sends a message to a Teams channel. The playbook fails to execute. Which permission should you verify first?

Accepted Answer

The automation rule has the correct managed identity or connection permissions. Option A is correct because playbooks require an automation rule with appropriate permissions to run. Option B is wrong because Teams channel permissions are for posting messages, not for playbook execution. Option C is wrong because Microsoft Sentinel reader role is for viewing incidents, not executing playbooks. Option D is wrong because Microsoft Entra ID admin rights are not required for playbook execution.

Answer

The Teams channel has the appropriate permissions for incoming webhooks

Answer

The analyst has Microsoft Sentinel Reader role

Answer

The user has Microsoft Entra ID Global Administrator role

Question 10

Which TWO actions can be taken directly from within a Microsoft Sentinel incident to aid in investigation? (Choose two.)

Accepted Answer

Create a bookmark to preserve a specific event. Options A and C are correct because Microsoft Sentinel incidents allow creating bookmarks to preserve evidence and running playbooks from the incident page. Option B is wrong because user risk is managed in Microsoft Entra ID Protection. Option D is wrong because resetting passwords is not available from the incident page. Option E is wrong because assigning tags is available but not a primary investigation action.

Answer

Review the user risk level in Microsoft Entra ID

Answer

Assign a severity to the incident

Answer

Reset the user's password

Question 11

Which THREE of the following are valid incident types in Microsoft 365 Defender? (Choose three.)

Accepted Answer

Phishing. Options A, B, and D are correct because Microsoft 365 Defender incidents include categories like 'Malware', 'Phishing', and 'Data exfiltration'. Option C is wrong because 'Misconfiguration' is not an incident type; it is a finding. Option E is wrong because 'Insider risk' is managed in Microsoft Purview, not as a primary incident type in Defender.

Answer

Insider risk

Answer

Misconfiguration

Question 12

Which TWO response actions are available in Microsoft Defender for Endpoint for a compromised device? (Choose two.)

Accepted Answer

Run a full antivirus scan. Options A and D are correct because Defender for Endpoint supports isolating a device and running a full antivirus scan. Option B is wrong because resetting the device to factory defaults is not a standard response action. Option C is wrong because disabling the user account is an identity action, not a device action. Option E is wrong because changing the firewall rules is not a predefined response action in Defender for Endpoint.

Answer

Disable the user account

Answer

Change the Windows Firewall rules

Answer

Reset the device to factory defaults

Question 13

Refer to the exhibit. You are configuring an automation rule in Microsoft Sentinel to block IP addresses from high-severity incidents. The rule triggers on incident creation but fails to block the IP. What is the most likely cause?

Accepted Answer

The entity path 'incident.entities.IP' is incorrect; it needs to iterate over entities. Option C is correct because the JSON uses 'incident.entities.IP' but the actual path likely requires iterating over entities; the syntax is incorrect. Option A is wrong because the severity condition is correct. Option B is wrong because there is no inconsistency; the trigger type is incidentTrigger. Option D is wrong because blockIP is a valid action type in automation rules.

Answer

The trigger type should be 'alertTrigger' instead of 'incidentTrigger'

Answer

The action type 'blockIP' is not supported in automation rules

Answer

The severity condition should be 'GreaterThan' instead of 'Equals'

Question 14

Refer to the exhibit. A security analyst runs the KQL query in Microsoft Defender XDR to find devices running encoded PowerShell commands in the last hour. The query returns results showing a device named 'DESKTOP-123' with account 'jdoe'. The analyst suspects malicious activity. Which immediate next step should the analyst take?

Accepted Answer

Click on the result to open the full device timeline and analyze the process tree. Option B is correct because the analyst should investigate the device further to understand the context of the encoded command. Option A is wrong because isolating without investigation may be premature. Option C is wrong because changing the threshold does not help with this specific incident. Option D is wrong because the query is valid and has already run.

Answer

Delete the query because it returned results

Answer

Modify the query to increase the time range to 24 hours

Answer

Isolate the device 'DESKTOP-123' from the network

Question 15

Refer to the exhibit. An Azure administrator deploys this ARM template to create a Microsoft Sentinel automation rule. After deployment, the automation rule does not trigger when a high-severity incident is created. What is the most likely reason?

Accepted Answer

The automation rule is missing the 'triggers' property. Option B is correct because the ARM template snippet does not include a 'triggers' property; Microsoft Sentinel automation rules require the 'triggers' structure (incidentTrigger or alertTrigger) instead of 'sources'. Option A is wrong because 'LogicApp' is a valid action type. Option C is wrong because API version is not the issue. Option D is wrong because the resource type is correct.

Answer

The apiVersion is outdated

Answer

The action type 'LogicApp' is misspelled

Answer

The resource type should be 'Microsoft.OperationalInsights/workspaces/providers/automations'