SC-200 Respond to security incidents Practice Test 22 — 15 Questions

Question 1

Your security team receives an alert from Microsoft Defender for Endpoint indicating a suspicious PowerShell command was executed on a device. The command attempted to download a payload from a known malicious IP. After confirming the alert is a true positive, what should be your first containment step?

Accepted Answer

Isolate the device from the network using Microsoft Defender for Endpoint. Option B is correct because immediately isolating the affected device from the network prevents lateral movement and further compromise. Option A is wrong because password reset does not address the existing compromise. Option C is wrong because disabling the user account may not stop the malicious process already running. Option D is wrong because searching for indicators is part of investigation, not immediate containment.

Answer

Search for similar commands across all devices using advanced hunting

Answer

Disable the user account in Microsoft Entra ID

Answer

Reset the user's password

Question 2

During a ransomware incident, Microsoft Sentinel generated an incident with high severity. The incident includes alerts from Microsoft Defender for Endpoint, Microsoft Defender for Office 365, and Microsoft Entra ID. Your team needs to automate the containment process. What is the best approach to automatically isolate affected devices and disable compromised accounts?

Accepted Answer

Create an automation rule in Microsoft Sentinel that runs a playbook to isolate devices and disable accounts. Option D is correct because automation rules in Sentinel can trigger playbooks that perform cross-product actions like isolation and account disablement. Option A is wrong because automated investigation in Defender for Endpoint only isolates devices, not accounts. Option B is wrong because custom detection rules only create alerts, not automated responses. Option C is wrong because advanced hunting is manual and does not automate response.

Answer

Use advanced hunting to find all affected devices and accounts

Answer

Create a custom detection rule in Microsoft Sentinel to trigger an incident

Answer

Configure automated investigation and response in Microsoft Defender for Endpoint

Question 3

You are investigating a phishing incident in Microsoft Defender XDR. The alert indicates that a user clicked a malicious link in an email. After confirming the email was delivered to the user's inbox, what should be your first action?

Accepted Answer

Use Microsoft Defender for Office 365 to soft-delete the email from the user's mailbox and other recipients. Option A is correct because soft-deleting the email from all mailboxes removes the threat from the user's and possibly other recipients' inboxes. Option B is wrong because blocking the URL is important but does not remove the already delivered email. Option C is wrong because resetting the password is necessary only if credentials were compromised, but the immediate action is to remove the email. Option D is wrong because training is a long-term prevention, not an immediate response.

Answer

Add the URL to the tenant block list in Microsoft Defender for Office 365

Answer

Send a training notification to the user

Answer

Reset the user's password immediately

Question 4

Your organization uses Microsoft Sentinel with a workspace in the East US region. You need to respond to an incident involving data exfiltration from a virtual machine in West Europe. The incident was created from a custom analytics rule that queries the AzureActivity table. What should you do to ensure the incident contains all relevant evidence from the West Europe region?

Accepted Answer

Ensure that Azure activity logs from West Europe are streamed to the same Sentinel workspace in East US. Option C is correct because the workspace is in East US, but data from West Europe must be ingested into the same workspace for the rule to query it. Option A is wrong because the analytics rule runs in the workspace where it is defined, not in multiple workspaces. Option B is wrong because setting the scope to West Europe does not bring data into the East US workspace. Option D is wrong because incidents are workspace-scoped and cannot be merged across workspaces by default.

Answer

Create the analytics rule in a separate workspace in West Europe

Answer

Configure the analytics rule to query the West Europe workspace

Answer

Use the incident merge feature to combine incidents from multiple workspaces

Question 5

Refer to the exhibit. You have created an automation rule in Microsoft Sentinel with the above configuration. The playbook isolates the device and disables the user account. After enabling the rule, you notice that a low-severity incident containing an alert titled 'Ransomware Behavior' did NOT trigger the automation. What is the most likely reason?

Accepted Answer

The incident severity is Low, but the rule only triggers on High severity. Option B is correct because the trigger condition requires incident severity 'Equals High', so low-severity incidents are excluded. Option A is wrong because the condition uses 'ContainsAny' for alert title, which works for a single value. Option C is wrong because the playbook ID is referenced correctly. Option D is wrong because automation rules do not require explicit permissions beyond the playbook's permissions.

Answer

The 'ContainsAny' operator does not match single values

Answer

The automation rule does not have permission to run the playbook

Answer

The playbook ID is invalid

Question 6

Your Microsoft Defender XDR environment generates an incident indicating that a user's account was used to sign in from an anonymous IP address and then accessed sensitive data in SharePoint Online. After confirming the account is compromised, what should be your first containment step?

Accepted Answer

Revoke the user's session and require reauthentication using Microsoft Entra ID Protection. Option C is correct because revoking the user's session and requiring reauthentication immediately stops the ongoing access. Option A is wrong because disabling the account prevents further logins but does not terminate existing sessions. Option B is wrong because blocking the IP may affect other users. Option D is wrong because reviewing audit logs is investigation, not containment.

Answer

Disable the user account in Microsoft Entra ID

Answer

Block the anonymous IP address in the firewall

Answer

Review audit logs to determine the extent of data access

Question 7

During a security incident, you need to collect forensic evidence from a compromised Linux server running in Azure. The server is not domain-joined and has the Azure Monitor Agent installed. You need to capture volatile data such as running processes and network connections. What is the most efficient method?

Accepted Answer

Use a custom script via Azure Custom Script Extension to collect data and send to Log Analytics. Option D is correct because the Azure Monitor Agent can collect syslog and custom logs, but to capture volatile data like processes and connections, you need to run a script or use a tool like PowerShell or bash. Using a Azure Automation Runbook or a Custom Script Extension can execute commands and forward the output to Log Analytics. Option A is wrong because Azure Disk Snapshots capture disk state, not memory or processes. Option B is wrong because Event Viewer is Windows-only. Option C is wrong because Microsoft Defender for Endpoint may not be installed and its live response may not be available.

Answer

Use Event Viewer to export logs

Answer

Use Microsoft Defender for Endpoint live response to run commands

Answer

Take a snapshot of the OS disk for later analysis

Question 8

Your security team detects a potential data exfiltration incident where an employee emailed sensitive customer data to a personal email address. The email was sent via Exchange Online. What is the immediate action to prevent further data loss?

Accepted Answer

Use Microsoft Purview to perform a content search and purge the email from the recipient's mailbox. Option A is correct because purging the email from the recipient's mailbox removes the data from the external location. Option B is wrong because blocking the user's account does not remove the already sent email. Option C is wrong because data loss prevention policies are preventive, not reactive. Option D is wrong while important, it is an investigation step, not immediate containment.

Answer

Create a data loss prevention rule to block future emails to that domain

Answer

Review the user's email archive for other suspicious emails

Answer

Disable the user's account in Microsoft Entra ID

Question 9

Refer to the exhibit. You run this KQL query in Microsoft Defender for Endpoint advanced hunting as part of an incident investigation. The query returns zero results, but you suspect PowerShell execution with encoded commands occurred. What is the most likely reason for no results?

Accepted Answer

The query only looks at the last hour; the event may have occurred earlier. Option D is correct because the query filters on 'DeviceProcessEvents' table, but advanced hunting in Defender for Endpoint uses 'DeviceProcessEvents' only if you are in the Defender portal; however, the table name might be slightly different (e.g., 'DeviceProcessEvents' is correct). The more likely issue is that the time filter is too restrictive (ago(1h) but the event might have occurred earlier, or the data might not yet be ingested. Option A is wrong because the table is correct. Option B is wrong because the column name is correct. Option C is wrong because the query syntax is valid.

Answer

The query uses 'contains' which is case-sensitive

Answer

The table name is incorrect; it should be 'ProcessEvents'

Answer

The column 'ProcessCommandLine' should be 'CommandLine'

Question 10

Which THREE are valid response actions when using Microsoft Sentinel automation rules?

Accepted Answer

Assign the incident to a specific analyst. The correct answers are A, B, and D. Automation rules can assign incidents, run playbooks, and change incident status. Disabling a user account is not a direct action; it must be done via a playbook. Tagging incidents is not a built-in action; it can be done via playbook or manual editing.

Answer

Tag the incident with custom labels

Answer

Disable a compromised user account

Question 11

Which TWO are recommended first steps when responding to a confirmed ransomware incident in Microsoft Defender XDR?

Accepted Answer

Isolate affected devices using Microsoft Defender for Endpoint. The correct answers are A and D. Isolating affected devices and revoking user sessions are immediate containment steps. Disabling accounts is also important but can be done after revoking sessions. Running a full antivirus scan is not a first step; it may alert the attacker. Assessing impact is part of investigation, not first containment.

Answer

Assess the financial impact of the incident

Answer

Disable all user accounts

Answer

Run a full antivirus scan on all devices

Question 12

Which THREE are valid incident severity levels in Microsoft Sentinel?

Accepted Answer

Low. The correct answers are A, B, and D. Sentinel uses Low, Medium, High, and Informational. Critical is not a level; the highest is High. Informational is a valid severity.

Answer

Critical

Answer

Informational

Question 13

Refer to the exhibit. You are configuring a Microsoft Sentinel scheduled analytics rule with the above incident creation settings. What is the effect of setting 'groupingConfiguration.enabled' to false?

Accepted Answer

Each alert will generate a separate incident. Option A is correct because grouping configuration controls whether alerts are grouped into a single incident. Disabling it means each alert creates its own incident. Option B is wrong because the rule still creates incidents. Option C is wrong because the rule runs on the schedule defined elsewhere. Option D is wrong because suppression is a different setting.

Answer

Alerts will be suppressed for 5 minutes

Answer

The rule will run every 5 minutes

Answer

No incidents will be created

Question 14

You are investigating an incident in Microsoft Defender XDR that involves a user who clicked a link in a phishing email. The email was detected and blocked by Microsoft Defender for Office 365, but the user still clicked the link before it was blocked. The incident includes an alert for 'Malicious URL click'. What additional information should you check to determine if the user's credentials were compromised?

Accepted Answer

Check for sign-in events from unusual locations or anonymous IP addresses after the click. Option D is correct because a URL click could lead to a credential harvesting page. Checking for subsequent failed logins from unusual locations indicates that credentials were used. Option A is wrong because the email was blocked, so there was no attachment. Option B is wrong because a password reset does not indicate compromise. Option C is wrong because the block already happened; the click is what matters.

Answer

Check if the link was blocked by the time the user clicked

Answer

Check if the user has recently changed their password

Answer

Check if the email had any attachments

Question 15

Refer to the exhibit. You run this KQL query in Microsoft 365 Defender advanced hunting to investigate an incident involving IP address 203.0.113.1. The query returns results, but you need to also see which devices communicated with this IP. How should you modify the query?

Accepted Answer

Join with DeviceNetworkEvents on DeviceId where RemoteIP == "203.0.113.1". Option C is correct because you need to join with DeviceNetworkEvents to see device-level network connections to the IP. Option A is wrong because DeviceInfo does not contain network connections. Option B is wrong because EmailEvents contains email data, not device network traffic. Option D is wrong because IdentityLogonEvents contains authentication events, not network connections.

Answer

Join with IdentityLogonEvents on AccountUpn

Answer

Join with DeviceInfo on DeviceId

Answer

Join with EmailEvents on AlertId