SC-200 Respond to security incidents Practice Test 22 — 15 Questions

Question 1

Which TWO of the following are valid methods to retrieve data from Microsoft Sentinel for external analysis during an incident?

Accepted Answer

Connect Log Analytics workspace to external tools via API.. The Log Analytics workspace that underpins Microsoft Sentinel exposes a REST API, allowing external tools to query and export data programmatically for analysis. This API supports OAuth 2.0 authentication and can retrieve log data via KQL queries, making it a valid method for external integration during incident response.

Answer

Use Microsoft Sentinel PowerShell cmdlets.

Answer

Create a Power BI dashboard.

Answer

Use the Export to CSV feature in the Logs blade.

Question 2

Your organization uses Microsoft Sentinel with Microsoft Defender XDR integrated. A critical incident has been raised involving a user account that was used to access a confidential SharePoint site from an unusual location at 2:00 AM. The incident includes alerts from Microsoft Defender for Cloud Apps, Microsoft Defender for Identity, and Microsoft Defender for Office 365. The analyst needs to contain the incident, investigate the scope, and begin remediation. The environment has the following: Microsoft Entra ID with conditional access policies, Microsoft Intune for device management, and Microsoft Defender for Endpoint on all devices. The analyst has identified the user account and the device used. Which course of action should the analyst take first?

Accepted Answer

Disable the user account in Microsoft Entra ID and revoke all sessions.. Disabling the user account in Microsoft Entra ID and revoking all sessions is the immediate containment step because it stops the compromised account from being used for any further access, including the suspicious SharePoint access and any lateral movement. This action directly addresses the core of the incident—the user account—and is the fastest way to cut off the attacker's current authentication tokens and sessions, preventing further damage while the investigation proceeds.

Answer

Create a conditional access policy to block the user.

Answer

Isolate the user's device using Microsoft Defender for Endpoint.

Answer

Run a KQL query to find all resources accessed by the user.

Question 3

You are a SOC analyst at Contoso Ltd. The company uses Microsoft Sentinel and Microsoft Defender XDR. A high-severity incident is generated from a Sentinel analytics rule that detects multiple failed logins followed by a successful login from a geographically unusual location for a user. The incident includes an alert from Microsoft Defender for Identity indicating a possible brute-force attack. The user's account is a privileged administrator. Your organization has strict compliance requirements: any privileged account compromise must be contained within 15 minutes of detection. You have the following tools available: Microsoft Entra ID with Privileged Identity Management (PIM), Microsoft Defender for Cloud Apps, and Microsoft 365 Defender automation rules. The incident is now 5 minutes old. What should you do to meet the compliance requirement?

Accepted Answer

Disable the user account in Microsoft Entra ID immediately.. Disabling the account in Microsoft Entra ID immediately is the fastest, most direct containment action for a confirmed privileged-account compromise. It revokes the account's ability to authenticate and blocks all new sign-ins and token issuance at the identity provider level, satisfying the 15-minute containment SLA. Since the incident is only 5 minutes old and involves a privileged admin, immediate account disablement is the correct incident-response action rather than a detective or policy-based control.

Answer

Create an automation rule in Microsoft 365 Defender to alert the security team.

Answer

Create a conditional access policy to block the user's sign-ins.

Answer

Activate PIM and remove the user's role assignments.

Question 4

Your company uses Microsoft Sentinel as its SIEM. You are investigating an incident where a user reported receiving a phishing email that appeared to come from the CEO requesting a wire transfer. The user did not respond. However, the incident also contains alerts from Microsoft Defender for Office 365 indicating that other users clicked on a malicious link in a similar email. The email was sent to 100 users. The company has Microsoft Defender for Endpoint deployed on all devices. The incident requires immediate containment to prevent further compromise. What should you do first?

Accepted Answer

Block the malicious URL using Microsoft Defender for Cloud Apps.. Blocking the malicious URL using Microsoft Defender for Cloud Apps (now part of Microsoft 365 Defender) immediately prevents all users from accessing the phishing link, stopping further compromise at the network level. This is the fastest containment action as it applies a URL block across the tenant without requiring individual mailbox or device actions. The incident involves multiple users clicking the link, so a URL block is the most efficient first step to halt the attack chain.

Answer

Run a threat hunting query to find all users who clicked the link.

Answer

Isolate the device of the user who reported the email.

Answer

Delete the email from all users' mailboxes using Microsoft 365 Defender.

Question 5

A security analyst detects a suspicious sign-in from an unfamiliar IP address for a user with high privileges. The analyst wants to immediately contain the threat while preserving the user's ability to work with proper approvals. What is the most effective first step?

Accepted Answer

Initiate a user risk remediation in Microsoft Entra ID Protection by confirming compromise and resetting password with session revocation.. It directly addresses the immediate threat by confirming compromise in Microsoft Entra ID Protection, which triggers a password reset and revokes all existing sessions, effectively terminating the attacker's access. This approach preserves the user's ability to work after re-authentication with proper approvals, as the account remains enabled and can be restored once the risk is mitigated. It is the most effective first step because it combines containment (session revocation) with remediation (password reset) while maintaining operational continuity.

Answer

Block the IP address in the firewall.

Answer

Disable the user account in Microsoft Entra ID.

Answer

Reset the user's password without revoking sessions.

Question 6

During a ransomware incident, security team needs to prevent encryption while preserving forensic data. Which action best achieves this balance?

Accepted Answer

Enable network micro-segmentation to isolate affected systems from file servers and take memory snapshots.. Network micro-segmentation (e.g., using Azure Network Security Groups or software-defined networking) isolates affected systems from file servers, halting lateral movement and preventing encryption of shared data, while memory snapshots (e.g., via Azure VM snapshots or live memory acquisition tools like WinPmem) preserve volatile forensic evidence such as encryption keys or process artifacts. This balances containment with forensic preservation, unlike destructive actions like shutdown or disconnection that lose memory data.

Answer

Shut down all affected servers immediately.

Answer

Run a full antivirus scan on all endpoints.

Answer

Disconnect the network but leave systems running.

Question 7

An incident response playbook in Microsoft Sentinel has a step: 'Investigate the user's recent activities using Microsoft 365 Defender.' Which data source would provide the most relevant information for this step?

Accepted Answer

Microsoft 365 Defender's user investigation page. The Microsoft 365 Defender user investigation page is the correct data source because it provides a consolidated view of a user's activities across Microsoft 365 services, including email, Teams, and endpoint alerts. This directly supports the incident response step of investigating recent user activities within the Microsoft 365 Defender ecosystem, which is the explicit scope of the playbook step.

Answer

Azure Activity Log

Answer

Microsoft Purview Data Loss Prevention reports

Answer

Azure Resource Graph

Question 8

The analyst notices that the rule does not fire for a user who has 12 sign-ins from the same IP address, but all are low risk. The expected behavior is to alert when a single user has more than 10 sign-ins from the same IP with at least one high-risk sign-in. What is the issue?

Accepted Answer

The query requires a high-risk sign-in from the same IP, but none exist, so no match.. The KQL query uses an inner join on UserPrincipalName and IPAddress, which only returns rows where a high-risk sign-in exists from the same IP. Since all 12 sign-ins from that IP are low risk, the join produces no matching rows, and the rule does not fire. The threshold of 10 is irrelevant when the join condition fails to produce any results.

Answer

The join should be on UserPrincipalName only, not IPAddress.

Answer

The join should be leftouter to include sign-ins without high risk.

Answer

The threshold is set to 10, but the user has 12 sign-ins, so it should fire.

Question 9

During an incident, an analyst wants to use Microsoft Defender XDR's automatic attack disruption to contain an ongoing attack. What prerequisite must be met?

Accepted Answer

Devices must be onboarded to Microsoft Defender for Endpoint.. Microsoft Defender XDR's automatic attack disruption relies on Microsoft Defender for Endpoint (MDE) signals to automatically contain compromised devices or user accounts. Devices must be onboarded to MDE so that the high-confidence alerts (e.g., from ransomware or lateral movement) can trigger automated containment actions like device isolation or blocking an IP. Without MDE onboarding, the attack disruption engine has no endpoint telemetry or remediation capability to act upon.

Answer

Microsoft Purview compliance portal must be configured.

Answer

Users must have Azure AD Premium P2 licenses.

Answer

Microsoft Sentinel must be enabled and connected to Defender XDR.

Question 10

A company uses Microsoft Sentinel with Microsoft Defender for Cloud Apps. An incident is created when a user downloads 500 GB from SharePoint in one hour. The analyst wants to create a playbook that automatically suspends the user in Microsoft Entra ID when such activity is detected. Which connector and action should the analyst use in the playbook?

Accepted Answer

Microsoft Entra ID connector with 'Update user' action to set accountEnabled to false.. The Microsoft Entra ID connector provides the 'Update user' action, which can set the 'accountEnabled' property to false, effectively suspending the user in Microsoft Entra ID. This directly addresses the requirement to automatically disable a user account when a high-volume SharePoint download incident is detected in Microsoft Sentinel. The playbook can be triggered by the incident and use this action to perform the suspension without manual intervention.

Answer

Microsoft Teams connector with 'Post message' action to notify admin.

Answer

Microsoft 365 Defender connector with 'Run advanced hunting' action.

Answer

Exchange Online connector with 'Set mailbox' action.

Question 11

An analyst is investigating a potential data exfiltration incident involving a user who accessed sensitive files from a personal device. The analyst wants to gather evidence about the device's compliance status and recent activity. Which Microsoft Intune feature should the analyst use?

Accepted Answer

Microsoft Intune device inventory and compliance reports. Microsoft Intune device inventory and compliance reports provide detailed information about a device's compliance status, including whether it meets security policies, has required updates, and is managed correctly. This is essential for investigating potential data exfiltration from a personal device, as it allows the analyst to verify if the device was compliant and review recent activity logs within Intune.

Answer

Exchange Online message trace

Answer

Azure Activity Log

Answer

Microsoft 365 Defender's service health dashboard

Question 12

A security analyst receives an alert from Microsoft Defender for Cloud Apps indicating that a user has signed in from a banned country. The analyst needs to block further access from that country for all users. What should the analyst configure?

Accepted Answer

Create an IP range group for the country and configure a session policy to block it.. Microsoft Defender for Cloud Apps session policies can block access based on IP address geolocation. By creating an IP range group for the banned country and configuring a session policy to block traffic from that group, the analyst can enforce real-time blocking of all user sessions originating from that country, leveraging the reverse proxy architecture of Defender for Cloud Apps.

Answer

Modify the device compliance policy in Microsoft Intune.

Answer

Configure a data loss prevention (DLP) policy in Microsoft Purview.

Answer

Create a conditional access policy in Microsoft Entra ID to block the country.

Question 13

Which TWO actions should an analyst take when a confirmed ransomware incident is detected on multiple endpoints? (Choose TWO.)

Accepted Answer

Isolate affected endpoints using Microsoft Defender for Endpoint.. Microsoft Defender for Endpoint's device isolation feature immediately severs all network communication (both inbound and outbound) from the affected endpoint while keeping the device powered on for forensic analysis. This containment action prevents lateral movement and further encryption of data across the network, which is critical during a ransomware incident.

Answer

Run a full antivirus scan on all endpoints.

Answer

Disconnect network cables but leave endpoints powered on.

Answer

Shut down all affected endpoints to prevent data loss.

Question 14

Which THREE elements are essential when creating a custom incident response playbook in Microsoft Sentinel? (Choose THREE.)

Accepted Answer

Appropriate permissions via managed identity or service principal for the playbook to execute actions.. A custom incident response playbook in Microsoft Sentinel requires appropriate permissions to execute actions against Azure resources. This is achieved by assigning a managed identity or configuring a service principal for the Logic App, which authenticates and authorizes the playbook to run actions such as blocking IPs, isolating machines, or querying threat intelligence. Without these permissions, the playbook would fail at runtime due to authentication errors, making it non-functional.

Answer

A mandatory approval step before any action is taken.

Answer

An analytics rule that generates the incident.

Question 15

Which TWO are valid methods to collect forensic evidence from a compromised Windows endpoint during an incident? (Choose TWO.)

Accepted Answer

Run KAPE (Kroll Artifact Parser and Extractor) to collect artifacts.. KAPE (Kroll Artifact Parser and Extractor) is a purpose-built tool for collecting and parsing forensic artifacts from live Windows endpoints during incident response. It efficiently gathers critical evidence such as prefetch files, registry hives, event logs, and browser history without altering the system state, making it a valid method for forensic collection.

Answer

Run Windows Update to fix vulnerabilities.

Answer

Reboot the system and boot from a forensic USB drive.

Answer

Use FTK Imager to create a forensically sound image of the hard drive.