SC-200 Respond to security incidents Practice Test 21 — 15 Questions

Question 1

Your organization uses Microsoft Defender for Identity and Microsoft Defender XDR. You receive an alert about a suspicious LDAP query originating from a domain controller. The alert indicates potential use of the DCSync attack technique. What is the most effective immediate action to contain the attack?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Disable the account that initiated the suspicious replication request.. The DCSync attack abuses the Directory Replication Service Remote Protocol (MS-DRSR) to impersonate a domain controller and request replication of credentials. Disabling the compromised account that initiated the suspicious LDAP replication request immediately stops the attacker's ability to request further replication, effectively containing the attack at the source without disrupting the entire domain.

Answer

Block all LDAP traffic at the firewall.

Answer

Restart the domain controller to clear any malicious processes.

Answer

Reset the krbtgt account password twice.

Question 2

Your organization uses Microsoft Sentinel. You have configured a data connector to ingest events from a third-party firewall. However, you notice that the logs are not appearing in Sentinel. What is the first thing you should check?

Accepted Answer

Check the connector health page in Microsoft Sentinel.. The connector health page in Microsoft Sentinel is the first place to check because it shows whether the data connector is connected, when data was last received, and any ingestion errors. If the connector shows a healthy status but no data arrives, the issue is likely upstream (firewall or agent); if it shows disconnected or error, the problem is with the connector itself. This diagnostic step narrows the fault domain before investigating the firewall or agent.

Answer

Check the firewall's syslog server configuration.

Answer

Verify that the workspace is in the correct region.

Answer

Reinstall the Log Analytics agent on the firewall.

Question 3

Your organization uses Microsoft Sentinel. You have a scheduled analytics rule that queries Windows Security Events to detect local admin group modifications. The rule runs every hour and looks back 1 hour. However, you are missing events that occur within the first few minutes of the hour. What is the most likely cause?

Accepted Answer

The event time is in local time, and the query uses UTC, causing events near the boundary to be excluded.. The scheduled analytics rule uses a lookback period of 1 hour, but if the event time is stored in local time while the query uses UTC, events near the hour boundary can be excluded due to time zone offset. Microsoft Sentinel stores events in UTC by default, and the query's time filter (e.g., 'TimeGenerated > ago(1h)') compares against UTC timestamps. If the Windows Security Events are logged in local time and not converted, events occurring just after the hour in local time may fall outside the UTC lookback window, causing them to be missed.

Answer

The query period is too short; it should be 2 hours.

Answer

The rule is using 'Last activity' instead of 'TimeGenerated'.

Answer

There is a 5-minute ingestion delay for Windows events.

Question 4

Your organization uses Microsoft Defender for Identity and Microsoft Defender XDR. You receive an alert about a suspicious LDAP query originating from a domain controller. The alert indicates potential use of the DCSync attack technique. What is the most effective immediate action to contain the attack?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a custom indicator of compromise (IoC) to block the specific file's hash.. Creating a custom indicator of compromise (IoC) with the specific file hash allows you to block only that exact PUA file without affecting other software. This leverages Microsoft Defender for Endpoint's custom IoC capability to override the default PUA detection policy, targeting the specific file hash rather than enabling a broad block on all PUAs.

Answer

Enable blocking of all potentially unwanted applications in the antivirus policy.

Answer

Reset the device to its factory settings.

Answer

Run a full scan on the device to remove the PUA.

Question 5

Your organization uses Microsoft Sentinel and Microsoft Defender XDR (including Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps). You have an incident response team that operates 24/7. Recently, there have been multiple incidents involving users receiving phishing emails that lead to credential theft. The phishing emails are sophisticated and bypass Exchange Online Protection (EOP) and Defender for Office 365's built-in phishing filters. The emails contain links to fake login pages that harvest credentials. Once credentials are stolen, the attacker uses them to sign in from anonymous IP addresses and attempts to access sensitive data in SharePoint Online. You need to design a response strategy that includes automated containment and investigation. The solution must:
- Automatically disable user accounts when a phishing incident is confirmed.
- Automatically trigger an investigation into the user's activity in Microsoft Defender for Cloud Apps.
- Send a notification to the incident response team with a summary of the incident.
- Minimize manual effort.

You have the following components available:
- Microsoft Sentinel with automation rules and playbooks.
- Microsoft Defender XDR with advanced hunting.
- Microsoft Power Automate.

What is the most efficient way to achieve these requirements?

Accepted Answer

Create a playbook in Microsoft Sentinel that uses the Microsoft Graph API to disable the user account in Microsoft Entra ID, trigger an investigation in Microsoft Defender for Cloud Apps, and send an email notification. Associate the playbook with an automation rule that runs when the incident is created.. Creating a playbook in Microsoft Sentinel that uses the Microsoft Graph API to disable the user in Microsoft Entra ID, triggers an investigation in Defender for Cloud Apps, and sends an email notification, then associating it with an automation rule that runs automatically when the incident is created, meets all requirements with minimal manual effort. Option B is correct because it enables automated containment and investigation without manual intervention. Option A is incorrect because Microsoft Defender XDR's automated investigation and response (AIR) does not automatically disable user accounts across all services; it focuses on endpoint remediation. Option C is incorrect because relying on a third-party system via webhook introduces additional complexity and may not integrate seamlessly with Microsoft tools. Option D is incorrect because while Power Automate can be used, creating a playbook directly in Microsoft Sentinel is more tightly integrated and efficient for incident response workflows.

Answer

Use Microsoft Defender XDR's automated investigation and response (AIR) to automatically disable the user account.

Answer

Create an automation rule in Microsoft Sentinel that triggers a webhook to a third-party system, which then disables the user account.

Answer

Configure a Playbook in Power Automate that monitors Microsoft Sentinel incidents and automatically disables the user account.

Question 6

Your organization uses Microsoft Sentinel. A security analyst receives an alert for a suspicious sign-in from an unfamiliar IP address. The analyst wants to quickly check if the same IP address has been associated with any other alerts in the past 30 days. Which action should the analyst take?

Accepted Answer

Run a KQL query in the Logs blade to search the Alert table for the IP.. The Alert table in Microsoft Sentinel logs contains historical alert data, including IP addresses associated with each alert. Running a KQL query against this table allows the analyst to quickly search for the same IP address across all alerts generated in the past 30 days, enabling efficient incident correlation without modifying detection or response configurations.

Answer

Create an automation rule to block the IP address.

Answer

Submit the IP address to Microsoft for threat intelligence.

Answer

Create a new analytics rule to detect the IP address.

Question 7

During an incident response, a security analyst identifies that a user's account was used to access sensitive data from an anomalous location. The analyst needs to immediately prevent further access from that account while preserving forensic data. Which action should the analyst take?

Accepted Answer

Disable the user account in Microsoft Entra ID.. Disabling the user account in Microsoft Entra ID immediately prevents any further authentication or access to resources, including sensitive data, while preserving the account's forensic data (e.g., sign-in logs, audit events) for investigation. This action stops all current and future sessions without deleting the account or its associated data, which is critical for incident response.

Answer

Revoke the user's current sessions in Microsoft Entra ID.

Answer

Block the IP address of the anomalous location in the firewall.

Answer

Enable multi-factor authentication (MFA) for the user.

Question 8

The exhibit shows an automation rule in Microsoft Sentinel. The analyst reports that the playbook is not triggered for high-severity incidents. What is the most likely cause?

Accepted Answer

The rule triggers only on incident creation, not on updates.. The automation rule is configured to trigger 'When incident is created,' which means it only runs the playbook at the moment the incident is first generated. If the incident's severity is updated after creation (e.g., from medium to high), the rule does not re-trigger, so the playbook will not execute for that high-severity incident. This is the most likely cause because the analyst reports that high-severity incidents are not triggering the playbook, and the rule's trigger condition explicitly excludes updates.

Answer

The playbook resource ID is invalid.

Answer

The condition syntax is incorrect.

Answer

The tenant ID is missing.

Question 9

A SOC analyst receives a Microsoft Defender for Cloud Apps alert about a mass download of files from a SharePoint site by a single user. The analyst needs to contain the incident. Which action should be taken first?

Accepted Answer

Suspend the user account in Microsoft Entra ID.. Suspending the user account in Microsoft Entra ID immediately revokes all access tokens and prevents further authentication, stopping the mass download in progress. This is the fastest containment action because it disables the user's ability to access any Microsoft 365 resource, including SharePoint, without waiting for other processes like scanning or notifications.

Answer

Increase the SharePoint download limit.

Answer

Notify the user's manager.

Answer

Run a malware scan on the downloaded files.

Question 10

Your organization uses Microsoft Defender for Identity and Microsoft Defender XDR. You receive an alert about a suspicious LDAP query originating from a domain controller. The alert indicates potential use of the DCSync attack technique. What is the most effective immediate action to contain the attack?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Advanced hunting in Microsoft Defender XDR.. Advanced hunting in Microsoft Defender XDR allows the analyst to query across multiple data sources—including endpoint detection and response (EDR), identity, email, and cloud app data—using Kusto Query Language (KQL). This enables correlation of the malware detection, suspicious PowerShell execution, and data exfiltration alerts on the same device by joining tables such as DeviceEvents, DeviceProcessEvents, and DeviceNetworkEvents, providing a unified timeline of the attack chain.

Answer

Microsoft Defender for Office 365 Explorer.

Answer

Microsoft Defender for Cloud Apps activity log.

Answer

Microsoft Sentinel incident workspace.

Question 11

A security analyst in Microsoft Sentinel receives an incident with a high severity alert from Microsoft Defender for Identity. The incident description mentions a suspected lateral movement pass-the-hash attack. What should the analyst do first?

Accepted Answer

Isolate the affected device from the network.. The immediate priority in a suspected lateral movement pass-the-hash attack is to contain the threat by isolating the affected device from the network. This prevents the attacker from using the compromised account's NTLM hash to authenticate to other systems, stopping the lateral spread while preserving forensic evidence for further investigation.

Answer

Reset the password of the compromised account.

Answer

Review the Microsoft Defender for Cloud Apps logs.

Answer

Create a new analytics rule to detect pass-the-hash attacks.

Question 12

During a ransomware incident, an analyst needs to identify which files were encrypted on an endpoint. The endpoint is running Windows and is managed by Microsoft Defender for Endpoint. Which data source should the analyst query in Advanced hunting?

Accepted Answer

DeviceFileEvents. DeviceFileEvents is the correct data source because it captures file creation, modification, and deletion events on endpoints. During a ransomware incident, encrypted files are typically created with a new extension or modified in place, and DeviceFileEvents logs these changes, allowing the analyst to identify which files were affected.

Answer

DeviceRegistryEvents

Answer

DeviceNetworkEvents

Answer

DeviceProcessEvents

Question 13

Your organization's Microsoft Sentinel workspace ingests logs from multiple regions. During an incident, you need to search for a specific user's activity across all workspaces in a single query. What is the most efficient way to accomplish this?

Accepted Answer

Use a cross-workspace query with the workspace() expression.. The workspace() expression in Kusto Query Language (KQL) allows you to include data from multiple Log Analytics workspaces in a single query. By specifying the workspace ID or name within the expression, you can search across all relevant workspaces without needing to run separate queries or manually combine results. This is the most efficient method because it executes as a single query against the underlying Azure Data Explorer clusters, minimizing latency and administrative overhead.

Answer

Run separate queries in each workspace and combine results manually.

Answer

Create a new analytics rule that queries all workspaces.

Answer

Use the Microsoft Sentinel search feature with the workspace filter.

Question 14

Which TWO actions should be taken immediately when a compromised user account is detected in Microsoft Entra ID?

Accepted Answer

Revoke all current sessions.. Revoking all current sessions (Option A) is a critical immediate action because it terminates all active authentication tokens and sessions for the compromised account, preventing the attacker from continuing to use existing tokens to access resources. This action leverages Microsoft Entra ID's token revocation capabilities, which invalidate refresh tokens and access tokens issued before the revocation, effectively cutting off the attacker's current access without waiting for password changes or other mitigations.

Answer

Notify the user's manager.

Answer

Reset the user's password.

Answer

Block sign-ins from the user's IP address.

Question 15

Which THREE features in Microsoft Sentinel allow an analyst to automate incident response actions?

Accepted Answer

Playbooks (Logic Apps). Playbooks (Logic Apps) are correct because they provide a library of pre-built or custom workflows that can be triggered by automation rules or analytics rules to execute complex, multi-step incident response actions, such as blocking IPs, isolating hosts, or enriching alerts with threat intelligence. They integrate with Azure services and third-party APIs via connectors, enabling automated remediation without manual intervention.

Answer

Watchlists

Answer

Workbooks