SC-200 Respond to security incidents Practice Test 21 — 15 Questions

Question 1

Your security team receives an alert from Microsoft Defender for Endpoint indicating a suspicious PowerShell command was executed on a device. The command attempted to download a payload from a known malicious IP. After confirming the alert is a true positive, what should be your first containment step?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Isolate the device from the network using Microsoft Defender for Endpoint. Immediately isolating the affected device from the network prevents lateral movement and further compromise. Option A is wrong because searching for similar commands is part of investigation, not immediate containment. Option B is wrong because disabling the user account may not stop the malicious process already running on the device. Option D is wrong because resetting the password does not address the existing compromise on the device.

Answer

Search for similar commands across all devices using advanced hunting

Answer

Disable the user account in Microsoft Entra ID

Answer

Reset the user's password

Question 2

During a ransomware incident, Microsoft Sentinel generated an incident with high severity. The incident includes alerts from Microsoft Defender for Endpoint, Microsoft Defender for Office 365, and Microsoft Entra ID. Your team needs to automate the containment process. What is the best approach to automatically isolate affected devices and disable compromised accounts?

Accepted Answer

Create an automation rule in Microsoft Sentinel that runs a playbook to isolate devices and disable accounts. Automation rules in Microsoft Sentinel can trigger playbooks that perform cross-product actions like device isolation and account disablement. Option A is wrong because advanced hunting is a manual query tool, not an automated response mechanism. Option C is wrong because custom detection rules only create incidents/alerts, not automated responses. Option D is wrong because automated investigation and response in Microsoft Defender for Endpoint focuses on endpoint containment and does not handle account disablement or cross-product orchestration.

Answer

Use advanced hunting to find all affected devices and accounts

Answer

Create a custom detection rule in Microsoft Sentinel to trigger an incident

Answer

Configure automated investigation and response in Microsoft Defender for Endpoint

Question 3

You are investigating a phishing incident in Microsoft Defender XDR. The alert indicates that a user clicked a malicious link in an email. After confirming the email was delivered to the user's inbox, what should be your first action?

Accepted Answer

Use Microsoft Defender for Office 365 to soft-delete the email from the user's mailbox and other recipients. The first action should be to use Microsoft Defender for Office 365 to soft-delete the email from the user's mailbox and other recipients. This immediately removes the malicious email from inboxes, preventing further access to the link. Option A is not the first action because blocking the URL does not remove the already delivered email; the email still resides in the inbox. Option B is incorrect because resetting the password is only necessary if credentials were compromised, and the priority is removal of the threat. Option C is incorrect because training is a long-term prevention measure, not an immediate response.

Answer

Add the URL to the tenant block list in Microsoft Defender for Office 365

Answer

Send a training notification to the user

Answer

Reset the user's password immediately

Question 4

Your organization uses Microsoft Sentinel with a workspace in the East US region. You need to respond to an incident involving data exfiltration from a virtual machine in West Europe. The incident was created from a custom analytics rule that queries the AzureActivity table. What should you do to ensure the incident contains all relevant evidence from the West Europe region?

Accepted Answer

Ensure that Azure activity logs from West Europe are streamed to the same Sentinel workspace in East US. To have the analytics rule in the East US workspace evaluate AzureActivity logs from West Europe, those logs must be collected into the same workspace. Streaming activity logs from West Europe to the East US workspace ensures all relevant data is available for the rule to query. Option A is incorrect because creating a separate workspace in West Europe would isolate the data, and the incident is in the East US workspace; cross-workspace queries would be required. Option C is incorrect because the analytics rule runs only in the workspace where it is defined; to query data from another workspace, you would need a cross-workspace query, but the rule is already defined in East US and cannot directly query the West Europe workspace without additional configuration. Option D is incorrect because incident merge is used to combine duplicate incidents within the same workspace, not across different workspaces.

Answer

Create the analytics rule in a separate workspace in West Europe

Answer

Configure the analytics rule to query the West Europe workspace

Answer

Use the incident merge feature to combine incidents from multiple workspaces

Question 5

Refer to the exhibit. You have created an automation rule in Microsoft Sentinel with the above configuration. The playbook isolates the device and disables the user account. After enabling the rule, you notice that a low-severity incident containing an alert titled 'Ransomware Behavior' did NOT trigger the automation. What is the most likely reason?

Accepted Answer

The incident severity is Low, but the rule only triggers on High severity. The automation rule's trigger condition includes a requirement that incident severity equals High. Since the incident had Low severity, it did not meet the condition and therefore did not trigger the playbook. Option A is incorrect because the 'ContainsAny' operator can match a single value; it is not limited to multiple values. Option B is incorrect because the automation rule uses the playbook's permissions, and there is no separate permission requirement for the rule itself beyond the playbook's configured permissions. Option C is incorrect because there is no indication that the playbook ID is invalid; the rule would still attempt to run even if the ID were invalid, but the issue is the severity condition.

Answer

The 'ContainsAny' operator does not match single values

Answer

The automation rule does not have permission to run the playbook

Answer

The playbook ID is invalid

Question 6

Your Microsoft Defender XDR environment generates an incident indicating that a user's account was used to sign in from an anonymous IP address and then accessed sensitive data in SharePoint Online. After confirming the account is compromised, what should be your first containment step?

Accepted Answer

Revoke the user's session and require reauthentication using Microsoft Entra ID Protection. Revoking the user's session and requiring reauthentication using Microsoft Entra ID Protection immediately stops the ongoing access from the anonymous IP and ensures the compromised session is terminated. This is the first containment step. Option A is wrong because disabling the account prevents future logins but does not terminate active sessions, allowing the attacker to continue accessing data. Option B is wrong because blocking the anonymous IP address may not be effective if the attacker uses a different IP and could also block legitimate users. Option C is wrong because reviewing audit logs is an investigation activity, not a containment action; containment should be taken first to stop the attack.

Answer

Disable the user account in Microsoft Entra ID

Answer

Block the anonymous IP address in the firewall

Answer

Review audit logs to determine the extent of data access

Question 7

During a security incident, you need to collect forensic evidence from a compromised Linux server running in Azure. The server is not domain-joined and has the Azure Monitor Agent installed. You need to capture volatile data such as running processes and network connections. What is the most efficient method?

Accepted Answer

Use a custom script via Azure Custom Script Extension to collect data and send to Log Analytics. The Azure Custom Script Extension enables you to run a script on the Linux VM to capture volatile data (e.g., running processes, network connections) and forward the output to Log Analytics via the Azure Monitor Agent. This approach is efficient as it utilizes the existing agent and does not require additional tools or licensing. Option A is incorrect because Event Viewer is a Windows-only tool. Option B is incorrect because Microsoft Defender for Endpoint live response requires the Defender for Endpoint deployment and may not be available without proper licensing. Option D is incorrect because a disk snapshot captures persistent disk state, not volatile memory or process information.

Answer

Use Event Viewer to export logs

Answer

Use Microsoft Defender for Endpoint live response to run commands

Answer

Take a snapshot of the OS disk for later analysis

Question 8

Your security team detects a potential data exfiltration incident where an employee emailed sensitive customer data to a personal email address. The email was sent via Exchange Online. What is the immediate action to prevent further data loss?

Accepted Answer

Use Microsoft Purview to perform a content search and purge the email from the recipient's mailbox. Using Microsoft Purview compliance portal, you can perform a content search to locate the email and then purge it from the sender's sent items and any other mailboxes it was delivered to within your organization, preventing further access from those locations. Although the email may have already reached an external personal address, removing it from internal mailboxes limits further internal dissemination. Option A is incorrect because creating a DLP rule is a preventive measure that does not address the already-sent email. Option B is incorrect because reviewing the archive is an investigation step, not an immediate containment action. Option C is incorrect because disabling the user's account prevents further actions but does not remove the already-sent email from the recipient's mailbox.

Answer

Create a data loss prevention rule to block future emails to that domain

Answer

Review the user's email archive for other suspicious emails

Answer

Disable the user's account in Microsoft Entra ID

Question 9

Refer to the exhibit. You run this KQL query in Microsoft Defender for Endpoint advanced hunting as part of an incident investigation. The query returns zero results, but you suspect PowerShell execution with encoded commands occurred. What is the most likely reason for no results?

Accepted Answer

The query only looks at the last hour; the event may have occurred earlier. The query uses a time filter of `ago(1h)`, which means it only looks at events from the last hour. If the PowerShell execution occurred earlier, it would not appear in the results. The query syntax and table/column names are valid for Microsoft Defender for Endpoint advanced hunting. Option A is incorrect because the `contains` operator is case-insensitive in KQL, so case sensitivity is not an issue. Option B is incorrect because `DeviceProcessEvents` is the correct table name for process events. Option C is incorrect because `ProcessCommandLine` is a valid column in that table; the column name does not need to be changed to `CommandLine`.

Answer

The query uses 'contains' which is case-sensitive

Answer

The table name is incorrect; it should be 'ProcessEvents'

Answer

The column 'ProcessCommandLine' should be 'CommandLine'

Question 10

Which THREE are valid response actions when using Microsoft Sentinel automation rules?

Accepted Answer

Assign the incident to a specific analyst. Automation rules in Microsoft Sentinel can assign incidents to analysts (A), tag incidents with custom labels (B), and run playbooks (C). Changing the incident status (D) is also a valid action, but the question asks for three specific actions; the correct set is A, B, and C.

Answer

Change the incident status to 'Active' or 'Closed'

Answer

Disable a compromised user account

Question 11

Which TWO are recommended first steps when responding to a confirmed ransomware incident in Microsoft Defender XDR?

Accepted Answer

Isolate affected devices using Microsoft Defender for Endpoint. The correct answers are D and E. Isolating affected devices using Microsoft Defender for Endpoint (D) and revoking user sessions to require reauthentication (E) are immediate containment steps to prevent further spread. Assessing financial impact (A) is part of investigation, not first response. Disabling all user accounts (B) is too disruptive and not recommended as a first step. Running a full antivirus scan (C) may alert the attacker and is not a containment measure.

Answer

Assess the financial impact of the incident

Answer

Disable all user accounts

Answer

Run a full antivirus scan on all devices

Question 12

Which THREE are valid incident severity levels in Microsoft Sentinel?

Accepted Answer

Low. The correct answers are B, C, and E. Microsoft Sentinel incident severity levels are Low, Medium, and High. Critical and Informational are not valid severity levels for incidents in Sentinel.

Answer

Critical

Answer

Informational

Question 13

Refer to the exhibit. You are configuring a Microsoft Sentinel scheduled analytics rule with the above incident creation settings. What is the effect of setting 'groupingConfiguration.enabled' to false?

Accepted Answer

Each alert will generate a separate incident. Setting 'groupingConfiguration.enabled' to false disables alert grouping, meaning each alert generated by the rule will create its own separate incident. Therefore, option D is correct. Options A and C are incorrect because disabling grouping does not suppress alerts or prevent incident creation—incidents are still created, just not grouped. Option B is incorrect because the rule's run interval is configured separately from grouping settings.

Answer

Alerts will be suppressed for 5 minutes

Answer

The rule will run every 5 minutes

Answer

No incidents will be created

Question 14

You are investigating an incident in Microsoft Defender XDR that involves a user who clicked a link in a phishing email. The email was detected and blocked by Microsoft Defender for Office 365, but the user still clicked the link before it was blocked. The incident includes an alert for 'Malicious URL click'. What additional information should you check to determine if the user's credentials were compromised?

Accepted Answer

Check for sign-in events from unusual locations or anonymous IP addresses after the click. After a user clicks a link in a phishing email, even if the email was blocked, the link may have already led to a credential harvesting page. To determine if credentials were compromised, it is essential to check for subsequent sign-in events from unusual locations or anonymous IP addresses, which would indicate that an attacker used the stolen credentials. Option A is incorrect because the click occurred before the block, so the timing of the block does not affect potential credential compromise. Option C is incorrect because password changes can be legitimate and do not necessarily indicate compromise. Option D is incorrect because the presence of attachments is irrelevant to credential compromise from a URL click.

Answer

Check if the link was blocked by the time the user clicked

Answer

Check if the user has recently changed their password

Answer

Check if the email had any attachments

Question 15

Refer to the exhibit. You run this KQL query in Microsoft 365 Defender advanced hunting to investigate an incident involving IP address 203.0.113.1. The query returns results, but you need to also see which devices communicated with this IP. How should you modify the query?

Accepted Answer

Join with DeviceNetworkEvents on DeviceId where RemoteIP == "203.0.113.1". DeviceNetworkEvents contains network-level connections from devices, including the remote IP address. By joining on DeviceId and filtering for RemoteIP == "203.0.113.1", you can identify which devices communicated with that IP. Option A (IdentityLogonEvents) contains authentication events, not network connections. Option C (DeviceInfo) provides device metadata but no network traffic. Option D (EmailEvents) covers email data, not device network activity.

Answer

Join with IdentityLogonEvents on AccountUpn

Answer

Join with DeviceInfo on DeviceId

Answer

Join with EmailEvents on AlertId