SC-200 Respond to security incidents Practice Test 22 — 15 Questions

Question 1

A security analyst receives an alert from Microsoft Defender for Cloud Apps indicating that a user from the finance department downloaded 500 files from SharePoint Online in 10 minutes. The analyst needs to determine if this is a true positive and, if so, contain the incident. Which action should the analyst take first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Suspend the user's account in Microsoft Entra ID.. When a user downloads a large number of files in a short period from SharePoint Online, it may indicate a data exfiltration attempt. The first action should be to contain the incident by suspending the user's account in Microsoft Entra ID to prevent further access. This is an immediate containment step before investigating further. Checking the user's risk score (D) or creating alerts (C) are secondary steps. Correlating with other alerts (A) can be done but containment takes priority.

Answer

Run a KQL query in Microsoft Sentinel to correlate with other alerts.

Answer

Create an alert in Microsoft Sentinel for similar behavior.

Answer

Check the user's risk score in Microsoft Entra ID Identity Protection.

Question 2

During a security incident, a SOC analyst uses Microsoft Defender XDR to investigate a compromised device. The analyst needs to collect a memory dump for forensic analysis. Which action should the analyst take from the Microsoft Defender XDR portal?

Accepted Answer

Use the 'Collect investigation package' action.. 'Collect investigation package' is the action available in Microsoft Defender XDR that collects a memory dump along with other forensic data such as registry hives and event logs. This is specifically designed for in-depth forensic analysis of a compromised device. Option B, 'Initiate a live response session,' allows remote command execution but does not directly collect a memory dump as a single action. Option C, 'Run a custom detection rule,' is for creating detection logic, not collection. Option D, 'Submit the file to Microsoft Defender for Cloud Apps,' is for file analysis in cloud apps, not memory collection.

Answer

Initiate a live response session.

Answer

Run a custom detection rule.

Answer

Submit the file to Microsoft Defender for Cloud Apps.

Question 3

A SOC analyst is reviewing an incident in Microsoft Sentinel that involves a user receiving a phishing email with a malicious attachment. The attachment was opened on a device managed by Microsoft Intune. Which Microsoft Defender XDR component would have provided the earliest detection of the malicious file?

Accepted Answer

Microsoft Defender for Endpoint. Microsoft Defender for Endpoint (MDE) provides the earliest detection of malicious files at the endpoint level. When the user opens the malicious attachment on an Intune-managed device, MDE's real-time protection (antivirus and behavior monitoring) scans the file immediately upon execution or write, blocking the threat before it can execute further. This is faster than cloud-based or email-level detections because the file is already on the device.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Office 365

Answer

Microsoft Purview Data Loss Prevention

Question 4

An organization uses Microsoft Sentinel and Microsoft Defender XDR. A critical incident is created when a user is detected as compromised. The incident severity is set to High. The SOC manager wants to ensure that all incidents with severity High or above are automatically assigned to the senior analyst tier. What should the analyst configure?

Accepted Answer

Define an automation rule to assign incidents based on severity.. Automation rules in Microsoft Sentinel allow setting conditions based on incident properties (like severity) and then assigning the incident to an owner or group. The other options do not provide automatic assignment based on severity.

Answer

Set a playbook to run when an incident is created.

Answer

Create an analytics rule with a custom severity.

Answer

Configure an alert tuning rule.

Question 5

Refer to the exhibit. You have an automation rule in Microsoft Sentinel that triggers a playbook to isolate a device when a High severity incident is created. However, you notice that the playbook is not triggered for incidents that are created from analytics rules that use entity mapping. What is the most likely cause?

Accepted Answer

The analytics rule sets the severity after incident creation, so the condition does not match at creation time.. Automation rules in Microsoft Sentinel trigger when an incident is created, and the condition checks the severity at that moment. If an analytics rule uses entity mapping, it may set the severity after the incident is created (e.g., during enrichment or correlation), so at creation time the severity might not match the condition (High severity). This means the automation rule won't trigger for those incidents. Options A, B, and C are possible but less likely to be the cause in this specific scenario.

Answer

The playbook requires a managed identity, which is missing.

Answer

The playbook is not authorized to run for automation rules.

Answer

The automation rule is disabled.

Question 6

During a security incident, a SOC analyst needs to collect evidence from multiple Microsoft 365 workloads including Exchange Online, SharePoint Online, and Teams. Which Microsoft Purview solution should the analyst use to perform a unified investigation?

Accepted Answer

Microsoft Purview eDiscovery. After containment, the next step in the incident response lifecycle is eradication. Eradication involves removing the root cause of the incident, such as deleting malware or closing vulnerabilities, to prevent recurrence. Post-incident review (option D) occurs after recovery and closure, not immediately after containment. Detection (A) is the initial phase, and analysis (B) is ongoing throughout but does not represent the distinct next step.

Answer

Microsoft Purview Data Lifecycle Management

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Audit

Question 7

A company uses Microsoft Defender XDR and has enabled automatic attack disruption for human-operated ransomware. During an incident, the system automatically contains a compromised account. However, the SOC team wants to ensure that the containment action is reversible and that the account can be restored after investigation. What should the team do before restoring the account?

Accepted Answer

Change the account's password and enable multi-factor authentication.. After automatic containment disables a compromised account, the SOC team must change its password and enable multi-factor authentication before restoring it. This ensures the attacker cannot regain access with stolen credentials. Option B is a good practice but not a prerequisite for restoring this specific account. Option C is unnecessary if the account was not an administrator. Option D is irrelevant because containment applies to the account, not devices.

Answer

Verify that no other accounts were compromised.

Answer

Remove the account from all administrative roles.

Answer

Run a full antivirus scan on the account's devices.

Question 8

A SOC analyst is using Microsoft Sentinel to investigate an incident involving a user who accessed a sensitive database from an unusual location. The analyst wants to find all activities performed by this user within the last 24 hours from multiple data sources. Which KQL operator should the analyst use to combine the results of two queries that return different schemas?

Accepted Answer

union. The union operator combines tables or query results with different schemas by adding columns. Join requires a common column. The other operators are not appropriate.

Answer

summarize

Answer

join

Answer

where

Question 9

Refer to the exhibit. A SOC analyst runs this KQL query in Microsoft Sentinel to investigate devices in the finance subnet. Which result would indicate that a device might be compromised?

Accepted Answer

A device with multiple connected networks, including an external IP.. A device with multiple connected networks, especially including an external IP, could indicate lateral movement or command and control activity, suggesting compromise. The other options are not inherently suspicious.

Answer

A device named 'finance-server-01' with a single network connection.

Answer

A device with no network connections in the last 7 days.

Answer

A device with a LocalIPAddress starting with 10.0.0.

Question 10

Which TWO actions should a SOC analyst take immediately after confirming a ransomware incident in Microsoft Defender XDR?

Accepted Answer

Isolate affected devices from the network.. Correct answers are A and D. Isolating affected devices and resetting compromised account credentials are immediate containment steps. Collecting forensic data is important but after containment. Starting recovery can wait. Disabling mailboxes is not necessary unless email is a vector.

Answer

Begin restoring data from backups.

Answer

Disable all mailboxes in the organization.

Answer

Collect a full memory dump from each affected device.

Question 11

Which THREE components can be used in Microsoft Sentinel to automate incident response?

Accepted Answer

Automation rules. Correct answers are A, B, and C. Automation rules are built-in automation that can automatically perform actions based on triggers when incidents are created or updated. Triggers are the conditions that initiate automation rules, such as 'When incident created' or 'When incident updated.' Playbooks are workflows that can be run automatically from automation rules to perform complex response actions. Analytics rules (E) generate alerts and incidents, but do not automate response; they are detection rules. Watchlists (D) are used for enrichment and correlation, not automation.

Answer

Watchlists

Answer

Analytics rules

Question 12

Which TWO indicators of compromise (IOCs) are most likely to be included in a Microsoft Sentinel threat intelligence feed to detect a known malware campaign?

Accepted Answer

File hash (SHA-256). Correct answers are B and E. File hashes (SHA-256) are commonly used as IOCs to uniquely identify malware samples, and IP addresses are frequently used to identify command-and-control servers or distribution points. Domain names and email addresses are less common for malware detection, and registry keys are not typical IOCs in threat intelligence feeds.

Answer

Domain name

Answer

Email address

Answer

Registry key

Question 13

Refer to the exhibit. A SOC analyst runs this Advanced Hunting query in Microsoft Defender XDR to detect potential living-off-the-land (LotL) attacks. An alert is triggered when a device shows multiple occurrences of 'mshta.exe' executing with a remote script. Which additional data source should the analyst check to confirm the attack?

Accepted Answer

DeviceNetworkEvents. DeviceNetworkEvents would show network connections made by mshta.exe to remote hosts, confirming the LotL attack. The other options are not directly relevant or are redundant.

Answer

DeviceFileEvents

Answer

DeviceLogonEvents

Answer

DeviceRegistryEvents

Question 14

An organization uses Microsoft Defender for Cloud Apps to detect anomalous behavior. An alert indicates that a user has signed in from an impossible travel scenario. The SOC analyst confirms the alert is a false positive due to a VPN. What should the analyst do to prevent future false positives for this user?

Accepted Answer

Add the VPN IP range to the trusted IP addresses in Defender for Cloud Apps.. Adding the trusted IP range in Microsoft Defender for Cloud Apps allows the system to ignore impossible travel alerts from VPN IPs. The other options are not effective or appropriate.

Answer

Change the user's location in Microsoft Entra ID.

Answer

Ignore the alert and continue monitoring.

Answer

Disable the impossible travel detection rule.

Question 15

A SOC team uses Microsoft Sentinel and wants to automatically enrich incidents with threat intelligence from a third-party feed. Which feature should they configure to ingest the threat intelligence and correlate it with alerts?

Accepted Answer

Threat intelligence connectors. Threat intelligence connectors in Microsoft Sentinel allow ingestion of TI feeds and enable correlation with alerts. The other options do not provide this capability.

Answer

Analytics rules

Answer

Data connectors

Answer

Watchlists