SC-200 Respond to security incidents Practice Test 21 — 15 Questions

Question 1

You are investigating a potential ransomware incident in Microsoft Defender XDR. The incident has a high severity alert indicating that a user installed a suspicious application. Which initial response action should you take to contain the threat while preserving evidence?

Accepted Answer

Isolate the device using Microsoft Defender for Endpoint.. Option B is correct because isolating the device from the network immediately stops lateral movement and data exfiltration while preserving forensic data. Option A is wrong because disabling the user account does not stop the malware from running. Option C is wrong because deleting the application may remove evidence. Option D is wrong because resetting the password does not contain the threat.

Answer

Reset the user's password and enforce MFA.

Answer

Uninstall the suspicious application via Intune.

Answer

Disable the user account in Microsoft Entra ID.

Question 2

During a security incident, you need to collect email messages associated with a phishing campaign from multiple mailboxes in Microsoft 365. Which tool should you use to search and export these emails?

Accepted Answer

Content Search in the Microsoft Purview compliance portal.. Option A is correct because Content Search in the Microsoft Purview compliance portal allows searching across mailboxes and exporting results. Option B is wrong because Advanced Hunting is for threat hunting, not email export. Option C is wrong because Mail Flow is for mail routing. Option D is wrong because the Microsoft 365 Defender portal provides incident management but not bulk email export.

Answer

Advanced Hunting in Microsoft Defender XDR.

Answer

Incident investigation in the Microsoft 365 Defender portal.

Answer

Mail Flow in the Exchange admin center.

Question 3

Your organization uses Microsoft Sentinel with the Microsoft Defender XDR connector. During an incident, you receive a critical alert for a user who is reported as compromised. You need to verify if the compromise is real and respond quickly. Which feature should you use to automatically trigger a playbook that contains the account?

Accepted Answer

An automation rule that triggers a playbook when the alert is created.. Option D is correct because automation rules in Microsoft Sentinel can trigger playbooks based on alert creation. Option A is wrong because analytics rules generate alerts but do not trigger playbooks directly. Option B is wrong because watchlists are for enrichment, not response. Option C is wrong because workbooks are visualization tools.

Answer

An analytics rule configured to run a playbook when the alert is generated.

Answer

A workbook that displays the user's activity for manual investigation.

Answer

A watchlist that includes the user's name to block the account.

Question 4

You are responding to a data exfiltration incident involving a user who copied sensitive files to a personal cloud storage service. The files were accessed from the user's managed device. Which Microsoft  Defender for Cloud Apps activity policy should you create to detect similar future incidents?

Accepted Answer

An activity policy that detects uploads to personal cloud storage services.. Option C is correct because an activity policy can monitor file uploads to non-corporate cloud apps. Option A is wrong because a file policy applies to files already in cloud apps. Option B is wrong because an anomaly detection policy is for unusual behavior, not specific uploads. Option D is wrong because an app discovery policy identifies shadow IT apps, not specific activities.

Answer

An anomaly detection policy that flags impossible travel.

Answer

A file policy that detects files shared with external users.

Answer

An app discovery policy that identifies new cloud apps used in the organization.

Question 5

During an incident investigation, you find that a user's credentials were used to sign in from an unfamiliar location. You want to force a password reset and revoke all sessions immediately. Which action should you take in the Microsoft 365 Defender portal?

Accepted Answer

Use the 'Require password reset' action from the user investigation page.. Option B is correct because 'Require password reset' in the user investigation section revokes sessions and forces a reset. Option A is wrong because disabling the account blocks access but does not reset credentials. Option C is wrong because blocking sign-in requires additional configuration. Option D is wrong because MFA registration does not reset the password.

Answer

Disable the user account in Microsoft Entra ID.

Answer

Block the user's sign-in from the unfamiliar location via Conditional Access.

Answer

Remove the user's MFA registration to force re-registration.

Question 6

Your incident response team uses Microsoft Sentinel with automation rules and playbooks. During an incident, you need to automatically collect a memory dump from an affected Windows server and upload it to an Azure storage account for analysis. Which type of playbook should you use?

Accepted Answer

A playbook triggered by an automation rule when the incident is created.. Option A is correct because automation rules can trigger playbooks on incident creation or update. Option B is wrong because playbooks can be triggered by automation rules, not directly by analytics rules. Option C is wrong because playbooks can be triggered automatically. Option D is wrong because playbooks run in Azure, not on the server.

Answer

A playbook that installs a script on the server to collect the dump.

Answer

A playbook triggered directly from the analytics rule that generates the alert.

Answer

A playbook that must be run manually from the incident page.

Question 7

You are investigating a suspicious sign-in reported in Microsoft Defender for Cloud Apps. The activity shows that a user accessed a sensitive SharePoint site from an anonymous IP address. What is the most effective immediate response to prevent further access?

Accepted Answer

Suspend the user account in Microsoft 365 Defender.. Option D is correct because suspending the user immediately blocks access to all cloud apps. Option A is wrong because disabling the device does not prevent cloud access from other devices. Option B is wrong because changing permissions on the site does not address the user's compromised state. Option C is wrong because blocking the IP may not be effective if the attacker uses different IPs.

Answer

Change the SharePoint site permissions to remove the user's access.

Answer

Disable the user's device in Microsoft Intune.

Answer

Add the anonymous IP address to the blocked IP address list in Conditional Access.

Question 8

Your organization uses Microsoft Sentinel with the Microsoft Defender XDR connector. You have a critical incident that involves multiple alerts across different services. The incident is being updated with new alerts. You need to ensure that a specific playbook runs only when the incident severity is updated to High. How should you configure the automation rule?

Accepted Answer

Set the trigger to 'When incident is updated' and add a condition on severity equals High.. Option B is correct because automation rules can trigger on incident update and filter by severity. Option A is wrong because condition 'when incident is created' would not trigger on update. Option C is wrong because the trigger condition should be on incident update, not alert creation. Option D is wrong because automation rules are not configured inside playbooks.

Answer

Set the trigger to 'When an alert is created' and filter for alerts with High severity.

Answer

Set the trigger to 'When incident is created' and add a condition on severity equals High.

Answer

Configure the condition inside the playbook to check severity and exit if not High.

Question 9

During an incident response, you need to collect forensic data from a compromised Linux server that is not managed by Microsoft Defender for Endpoint. You plan to use a manual collection script. Which tool should you use to securely upload the collected data to Azure for analysis?

Accepted Answer

AzCopy to upload the data to Azure Blob Storage.. Option A is correct because AzCopy can securely upload files to Azure Blob Storage. Option B is wrong because PowerShell is not natively available on Linux. Option C is wrong because Azure CLI requires installation. Option D is wrong because Log Analytics agent sends data to Log Analytics, not arbitrary files.

Answer

Azure CLI to upload the data to an Azure Files share.

Answer

PowerShell to send the data to Log Analytics workspace.

Answer

The Log Analytics agent to forward the data.

Question 10

You are responding to a ransomware incident where multiple devices are encrypted. The incident is captured in Microsoft Sentinel. Which TWO actions should you take first to contain the incident?

Accepted Answer

Disable user accounts associated with the affected devices in Microsoft Entra ID.. Options A and C are correct because isolating devices and disabling user accounts are immediate containment actions. Option B is wrong because restoring from backup is recovery, not containment. Option D is wrong because resetting passwords does not stop encryption. Option E is wrong because analyzing the malware is investigative, not containment.

Answer

Reset passwords for all affected users.

Answer

Run a malware analysis on a sample of the ransomware.

Answer

Restore encrypted files from backups.

Question 11

Which THREE of the following are valid incident response actions in Microsoft Defender XDR?

Accepted Answer

Isolate a device.. Options A, C, and E are correct because isolating a device, disabling a user account, and deleting an email are common response actions. Option B is wrong because resetting a password is done in Microsoft Entra ID. Option D is wrong because blocking a URL is done in Defender for Office 365, not directly in Defender XDR incident actions.

Answer

Reset user password.

Answer

Block a malicious URL.

Question 12

You are investigating a data exfiltration incident in Microsoft Defender for Cloud Apps. The investigation reveals that a user downloaded sensitive files from SharePoint and uploaded them to a third-party cloud storage app. Which THREE actions should you take to contain the incident?

Accepted Answer

Apply a session policy to block uploads to unauthorized apps.. Options A, B, and D are correct because suspending the user, revoking access, and blocking the app contain the threat. Option C is wrong because removing files from the third-party app may be recovery but not containment. Option E is wrong because applying sensitivity labels is a classification action, not immediate containment.

Answer

Delete the files from the third-party cloud app.

Answer

Apply a sensitivity label to the files to prevent sharing.

Question 13

You deploy this ARM template to a Microsoft Sentinel workspace. After deployment, you notice that the saved search does not appear as an analytics rule. What is the most likely reason?

Accepted Answer

The resource type is 'savedSearches', not 'scheduledQueryRules' or 'alertRules'.. Option B is correct because saved searches are not analytics rules; they are saved queries. Analytics rules require a specific resource type. Option A is wrong because the query syntax is correct. Option C is wrong because the API version is valid. Option D is wrong because tags are optional.

Answer

The tags are incorrectly formatted.

Answer

The API version is incorrect.

Answer

The KQL query syntax is invalid.

Question 14

You are investigating a potential malicious PowerShell execution in Microsoft Defender for Endpoint using this KQL query in Advanced Hunting. The query returns no results. What is the most likely cause?

Accepted Answer

The table name should be 'DeviceProcessEvents' instead of 'DeviceEvents'.. Option C is correct because DeviceEvents table is not part of Defender for Endpoint schema; the correct table is DeviceProcessEvents. Option A is wrong because 'take 100' does not affect the query logic. Option B is wrong because the column names are correct. Option D is wrong because the time range is valid.

Answer

The column names are incorrect; 'InitiatingProcessFileName' should be 'ParentProcessFileName'.

Answer

The 'take 100' operator limits results to only 100, but the query may return results if more data exists.

Answer

The query uses 'ago(7d)' which may be too short for historical data.

Question 15

You have an automation rule in Microsoft Sentinel configured as shown. An incident with severity Medium is created, but the playbook does not run. What is the most likely reason?

Accepted Answer

The automation rule trigger is set to 'When incident is created', but the incident may have been created with a lower severity and later updated to Medium.. Option D is correct because automation rules require a trigger condition; if the incident is created with a different severity and later updated to Medium, the rule will not trigger because it is set to 'When incident is created'. Option A is wrong because permissions can cause issues, but typically the rule would show as created. Option B is wrong because the trigger type is incident, not alert. Option C is wrong because playbook ID is valid.

Answer

The triggerType should be 'Alert' instead of 'Incident'.

Answer

The playbook does not have permissions to run in the Sentinel resource group.

Answer

The playbookId is incorrect or the playbook has been deleted.