SC-200 Respond to security incidents Practice Test 23 — 15 Questions

Question 1

Which THREE indicators of compromise (IOCs) are commonly used in Microsoft Sentinel to detect advanced persistent threats (APTs)? (Choose THREE.)

Accepted Answer

Suspicious domains and URLs.. Option A is correct because suspicious domains and URLs are classic network-based IOCs that Microsoft Sentinel ingests via threat intelligence connectors and matches against DNS, proxy, and firewall logs to surface APT beaconing or phishing infrastructure. Option C is correct because SHA256 file hashes of known malware are high-fidelity, atomic IOCs that Sentinel uses in scheduled analytics rules and the Threat Intelligence matching rule to detect malicious binaries on endpoints and in file events. Option E is correct because IP addresses of known command-and-control servers are standard network IOCs that Sentinel correlates with CommonSecurityLog, Azure Firewall, and DNS data to identify active C2 communication. Option B is not an IOC but a vulnerability assessment artifact describing exposure rather than evidence of compromise, and Option D is a normal operational event (e.g., Event ID 4624) that only becomes suspicious in context, not a standalone IOC.

Answer

Vulnerability scan results.

Answer

Windows event IDs for successful logins.

Question 2

Which TWO playbook actions can be used to automatically contain a compromised user account in Microsoft Entra ID during an incident? (Choose TWO.)

Accepted Answer

Disable the user account via Microsoft Graph API.. Disabling a user account via Microsoft Graph API is a direct containment action that immediately prevents the compromised account from authenticating and accessing resources. This is a standard automated response in Microsoft Sentinel or Microsoft 365 Defender playbooks to stop an active incident.

Answer

Reset the user's password.

Answer

Send a notification email to the user.

Answer

Add the user to a group that has access to critical resources.

Question 3

Your company uses Microsoft Sentinel with the Microsoft Defender for Cloud Apps connector. An incident is created when a user performs an unusual mass download from SharePoint Online. The playbook assigned to the incident automatically suspends the user account in Microsoft Entra ID. However, after investigation, the user's activity is determined to be legitimate (they were backing up data for a migration). You need to restore the user's account and ensure that the user can access all resources immediately. You also need to update the incident to reflect the findings. What should you do?

Accepted Answer

Re-enable the user account in Microsoft Entra ID and set the incident status to Closed with classification 'False positive'.. The user account was suspended by the playbook, so you must manually re-enable it in Microsoft Entra ID to restore access immediately. Setting the incident status to 'Closed' with classification 'False positive' accurately reflects that the alert was triggered by legitimate activity, which is the proper way to close a false positive in Microsoft Sentinel.

Answer

Send a new invitation to the user via Microsoft Entra ID and close the incident as resolved.

Answer

Reset the user's password in Microsoft Entra ID and force a password change at next sign-in.

Answer

Edit the playbook to remove the suspend action and re-run it for the incident.

Question 4

Your organization uses Microsoft Sentinel. A security analyst reports a high number of false positives from a scheduled analytics rule that detects anomalous sign-ins. The rule uses the 'UserAgent' field in the SigninLogs table. What is the best practice to reduce false positives while maintaining detection coverage?

Accepted Answer

Add a condition to the rule query to filter out known legitimate user agents.. The high number of false positives is caused by legitimate user agents triggering the anomaly detection. By adding a condition to the KQL query that filters out known legitimate user agents (e.g., 'Mozilla/5.0' for standard browsers), you reduce noise without losing detection of truly anomalous sign-ins. This preserves the rule's coverage for unknown or malicious user agents while eliminating predictable false positives.

Answer

Increase the alert threshold to require more than one anomalous sign-in per hour.

Answer

Create a watchlist of legitimate IP addresses and reference it in the rule.

Answer

Disable the analytics rule and create a new one with different MITRE tactics.

Question 5

Your company uses Microsoft Defender for Office 365. A user reports receiving a phishing email that bypassed the default policy. The email contains an external link to a credential harvesting site. You need to block similar emails in the future. What should you do?

Accepted Answer

Create a Safe Links policy and add the malicious domain to the blocked URLs list.. The phishing email contains a link to a credential harvesting site, so the most direct way to block similar emails in the future is to use a Safe Links policy. Safe Links proactively scans and blocks URLs at time of click, and you can add the malicious domain to the blocked URLs list to prevent users from accessing that site. This addresses the specific threat vector (malicious URL) rather than the sender's domain or attachment type.

Answer

Create an anti-spam policy to block the sender's domain.

Answer

Create an anti-malware policy to block the attachment type.

Answer

Add the sender's domain to the Tenant Allow/Block List.

Question 6

Your organization uses Microsoft Defender for Cloud Apps. A security investigator discovers that a user's session token was stolen and used to access sensitive data in SharePoint Online from an anomalous IP address. You need to immediately revoke the attacker's access while minimizing impact on the legitimate user. What should you do?

Accepted Answer

From Microsoft Defender for Cloud Apps, use the 'Require re-authentication' action on the anomalous session.. The 'Require re-authentication' action in Microsoft Defender for Cloud Apps immediately terminates the attacker's session by invalidating the stolen session token, forcing the attacker to re-authenticate. This action targets only the anomalous session, leaving the legitimate user's other sessions intact and minimizing disruption. It directly addresses the session token theft without affecting the user's account status or requiring password changes.

Answer

Suspend the user account in Microsoft Entra ID until the investigation is complete.

Answer

Revoke all refresh tokens for the user in Microsoft Entra ID.

Answer

Reset the user's password immediately.

Question 7

Your organization uses Microsoft Sentinel. A fusion incident was created involving multiple alerts from different sources. You need to investigate the incident to determine if it is a true positive. What is the first step you should take?

Accepted Answer

Review the incident timeline and entity mapping in the incident details.. The first step in investigating a Fusion incident in Microsoft Sentinel is to review the incident timeline and entity mapping. This provides a consolidated view of all correlated alerts, their timestamps, and the entities involved (e.g., IP addresses, user accounts), enabling you to quickly assess whether the alerts are logically connected and indicative of a true positive attack chain. Starting with this high-level overview is efficient before diving into raw logs.

Answer

Run a KQL query on the raw logs to see if the alerts are connected.

Answer

Assign the incident to a senior analyst for further investigation.

Answer

Close the incident as a false positive if the alerts seem unrelated.

Question 8

Your organization uses Microsoft 365 Defender. You are investigating a potential malware outbreak on several endpoints. Which TWO actions should you take to isolate affected devices and prevent lateral movement?

Accepted Answer

Use Microsoft Defender for Endpoint to initiate device isolation on affected devices.. Microsoft Defender for Endpoint's device isolation feature disconnects the device from the network while keeping the endpoint connected to the Defender service for monitoring and remediation. This prevents lateral movement by stopping all inbound and outbound communication, effectively containing the malware without losing visibility or control.

Answer

Run a full antivirus scan on all endpoints.

Answer

Reset the passwords of all users on the affected devices.

Answer

Delete the user accounts that logged into the affected devices.

Question 9

Your organization uses Microsoft Sentinel. A new analytics rule is needed to detect brute-force attacks against your Azure SQL databases. The rule should minimize false positives and trigger only when multiple failed logins occur from a single IP address within a short time window. Which THREE components are essential for building this rule?

Accepted Answer

An alert threshold set to trigger when the count exceeds 10 failed attempts in 5 minutes.. Setting an alert threshold to trigger when the count exceeds 10 failed attempts in 5 minutes directly reduces false positives by requiring a meaningful number of failures before alerting. This threshold aligns with common brute-force detection patterns, ensuring the rule only fires when there is a high likelihood of an actual attack rather than occasional user errors.

Answer

A reference to the SQLInsights table for performance data.

Answer

A watchlist containing known malicious IP addresses.

Question 10

Your organization uses Microsoft Defender for Cloud. You need to remediate a security recommendation that indicates a virtual machine is missing critical security updates. Which TWO actions should you take to remediate this recommendation?

Accepted Answer

Connect to the VM and install the missing updates.. Installing the missing updates directly on the VM resolves the underlying vulnerability that Defender for Cloud identified. Option D is correct because configuring automatic updates ensures the VM receives future critical security patches without manual intervention, which proactively remediates the recommendation over time.

Answer

Add a network security group to block inbound traffic to the VM.

Answer

Create an exemption for the recommendation in Defender for Cloud.

Answer

Restart the VM to trigger update installation.

Question 11

Refer to the exhibit. An alert in Microsoft Defender for Identity shows suspicious PowerCLI execution on an Exchange server. The service account 'svc_exchange' is used. What is the most likely true-positive scenario?

Accepted Answer

An attacker using a compromised service account to access mailboxes via remote PowerShell. PowerCLI execution on an Exchange server, especially using a service account like 'svc_exchange', is a strong indicator of an attacker leveraging compromised credentials to remotely access Exchange via PowerShell. Microsoft Defender for Identity detects this because PowerCLI is not a native Exchange management tool; it is typically used by attackers to interact with Exchange Web Services (EWS) or Remote PowerShell (WinRM) for mailbox access, data exfiltration, or persistence. The combination of a service account (often over-privileged and not monitored) and PowerCLI from an unusual source or time makes this a true-positive compromise scenario.

Answer

A security tool scanning for vulnerabilities

Answer

A misconfigured backup application running from an external IP

Answer

A legitimate IT admin running Exchange management scripts

Question 12

Your organization uses Microsoft Sentinel. You are responsible for responding to incidents. A new 'MFA Denied' incident is created from Microsoft Entra ID sign-in logs, indicating that a user in your organization had multiple MFA denials from a suspicious IP address (203.0.113.5). The user is a sales representative who frequently travels. The incident severity is Medium. The incident contains entities: user 'jsmith@contoso.com', IP address 203.0.113.5, and a device running Windows 11. You need to investigate and determine if this is a true positive. The user is currently on a business trip in Europe, but the sign-in attempts originated from an IP address in a different region. What should you do first?

Accepted Answer

Contact the user to confirm if they attempted to sign in at the time of the alerts.. The first step in investigating a potential true positive is to contact the user to confirm if they attempted to sign in. This helps determine if the MFA denials were legitimate (e.g., user error) or malicious. It is a non-destructive action that gathers critical context.

Answer

Immediately reset the user's password and revoke sessions.

Answer

Block the suspicious IP address in the Conditional Access policy.

Answer

Isolate the user's device using Microsoft Defender for Endpoint.

Question 13

Your organization uses Microsoft Sentinel and Microsoft Defender for Cloud Apps. You receive a high-severity incident indicating that a user's credentials were used to access a sensitive SharePoint site from an unmanaged device. The user, 'jdoe@contoso.com', is a senior executive. The IP address is from a public Wi-Fi hotspot. The incident includes a recommendation to apply session policy to block download of sensitive files. You need to create a policy in Microsoft Defender for Cloud Apps that blocks downloads from unmanaged devices for this specific user when accessing the sensitive site. The policy should trigger only when the user accesses the specific SharePoint site named 'ExecConfidential'. What should you do?

Accepted Answer

Create an app connector for SharePoint and a session policy that targets the user, site, and device tag 'Unmanaged' with the action 'Block download'.. Blocking downloads from unmanaged devices for a specific user and site requires a Defender for Cloud Apps session policy, which is enforced through Conditional Access app control and requires the SharePoint app connector to be configured. The session policy can be scoped to the user, the specific site 'ExecConfidential', and the 'Unmanaged' device tag, with the action set to block download. This is the only option that combines the app connector, session control, and the precise scoping the requirement demands.

Answer

Create a device compliance policy in Microsoft Intune to block unmanaged devices from accessing SharePoint.

Answer

Create a Conditional Access policy in Microsoft Entra ID to require compliant device for the SharePoint site.

Answer

Create a file policy in Defender for Cloud Apps to quarantine files downloaded from the site.

Question 14

Your organization uses Microsoft 365 Defender. An incident is created for a user who received a phishing email that contained a link to a malicious website. The user clicked the link but did not enter any credentials. The incident includes the alert 'Phishing delivered' from Microsoft Defender for Office 365. You need to remediate the incident and prevent future occurrences. The user is in the Finance department and frequently receives emails from external vendors. What is the best course of action?

Accepted Answer

Use Threat Explorer to delete the email from the user's mailbox and create a Safe Links policy to block the malicious URL.. The best remediation combines immediate containment with prevention: Threat Explorer (or the unified action center) lets you soft-delete or hard-delete the phishing email from the user's mailbox, and a Safe Links policy blocks the malicious URL so future clicks are neutralized. This addresses both the current incident and the recurring risk from external vendors, which is the correct incident-response sequence of contain, eradicate, and prevent.

Answer

Report the email to Microsoft for analysis and block the sender domain.

Answer

Provide security awareness training to the user and mark the incident as resolved.

Answer

Add the sender's domain to the Tenant Allow/Block List as allowed to avoid future false positives.

Question 15

Your organization uses Microsoft Sentinel with the Microsoft 365 Defender connector. You receive an incident indicating that a user's account was used to sign in from an unusual location (Russia) while the user is in the United States. The sign-in was successful and no MFA challenge was prompted because the user had a valid session. The incident severity is High. You need to respond immediately. What should you do first?

Accepted Answer

Revoke the user's session in Microsoft Entra ID.. Revoking the user's session in Microsoft Entra ID immediately terminates all active tokens and sessions, preventing the attacker from continuing to use the authenticated session. This is the fastest way to stop the ongoing compromise because the sign-in succeeded without MFA due to a valid session, and the attacker is already inside. Other actions like blocking IP or resetting password are slower or less direct in this scenario.

Answer

Block the IP address in the Conditional Access policy.

Answer

Investigate the sign-in logs to determine if there are other compromised accounts.

Answer

Reset the user's password.