SC-200 Respond to security incidents Practice Test 23 — 15 Questions

Question 1

A security analyst receives an alert from Microsoft Defender for Cloud Apps indicating that a user from the finance department downloaded 500 files from SharePoint Online in 10 minutes. The analyst needs to determine if this is a true positive and, if so, contain the incident. Which action should the analyst take first?

Accepted Answer

Suspend the user's account in Microsoft Entra ID.. The correct answer is B. Google Dorking is a technique used by attackers to find exposed sensitive information via Google search queries. Searching for the domain with site: and filetype: is an example of Google Dorking, which is not a standard security tool. The other options are legitimate security features.

Answer

Run a KQL query in Microsoft Sentinel to correlate with other alerts.

Answer

Create an alert in Microsoft Sentinel for similar behavior.

Answer

Check the user's risk score in Microsoft Entra ID Identity Protection.

Question 2

During a security incident, a SOC analyst uses Microsoft Defender XDR to investigate a compromised device. The analyst needs to collect a memory dump for forensic analysis. Which action should the analyst take from the Microsoft Defender XDR portal?

Accepted Answer

Use the 'Collect investigation package' action.. The correct answer is C. 'Collect investigation package' collects memory dumps, registry hives, and other forensic data. The other options do not provide memory dumps.

Answer

Initiate a live response session.

Answer

Run a custom detection rule.

Answer

Submit the file to Microsoft Defender for Cloud Apps.

Question 3

A SOC analyst is reviewing an incident in Microsoft Sentinel that involves a user receiving a phishing email with a malicious attachment. The attachment was opened on a device managed by Microsoft Intune. Which Microsoft Defender XDR component would have provided the earliest detection of the malicious file?

Accepted Answer

Microsoft Defender for Endpoint. The correct answer is B. Microsoft Defender for Endpoint (now part of Microsoft Defender XDR) provides real-time antimalware protection and would detect the file when opened. The other options are either not involved in file detection or are cloud-specific.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Office 365

Answer

Microsoft Purview Data Loss Prevention

Question 4

An organization uses Microsoft Sentinel and Microsoft Defender XDR. A critical incident is created when a user is detected as compromised. The incident severity is set to High. The SOC manager wants to ensure that all incidents with severity High or above are automatically assigned to the senior analyst tier. What should the analyst configure?

Accepted Answer

Define an automation rule to assign incidents based on severity.. The correct answer is D. Automation rules in Microsoft Sentinel allow setting conditions based on incident properties (like severity) and then assigning the incident to an owner or group. The other options do not provide automatic assignment based on severity.

Answer

Set a playbook to run when an incident is created.

Answer

Create an analytics rule with a custom severity.

Answer

Configure an alert tuning rule.

Question 5

Refer to the exhibit. You have an automation rule in Microsoft Sentinel that triggers a playbook to isolate a device when a High severity incident is created. However, you notice that the playbook is not triggered for incidents that are created from analytics rules that use entity mapping. What is the most likely cause?

Accepted Answer

The analytics rule sets the severity after incident creation, so the condition does not match at creation time.. The correct answer is C. The automation rule triggers on incident creation, but the condition checks severity. If the severity is set after creation (e.g., by a playbook or analytics rule), the condition may not match when the incident is created. The exhibit shows the trigger is 'Created' and condition on severity. If the analytics rule sets severity later, the rule won't fire. The other options are plausible but less likely.

Answer

The playbook requires a managed identity, which is missing.

Answer

The playbook is not authorized to run for automation rules.

Answer

The automation rule is disabled.

Question 6

During a security incident, a SOC analyst needs to collect evidence from multiple Microsoft 365 workloads including Exchange Online, SharePoint Online, and Teams. Which Microsoft Purview solution should the analyst use to perform a unified investigation?

Accepted Answer

Microsoft Purview eDiscovery. The correct answer is B. Microsoft Purview eDiscovery allows searching across Exchange, SharePoint, Teams, and other workloads from a single interface. The other options are specific to certain workloads or not investigation tools.

Answer

Microsoft Purview Data Lifecycle Management

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Audit

Question 7

A company uses Microsoft Defender XDR and has enabled automatic attack disruption for human-operated ransomware. During an incident, the system automatically contains a compromised account. However, the SOC team wants to ensure that the containment action is reversible and that the account can be restored after investigation. What should the team do before restoring the account?

Accepted Answer

Change the account's password and enable multi-factor authentication.. The correct answer is D. The account must be reset and verified clean to prevent the attacker from regaining access. The other options are not sufficient or incorrect.

Answer

Verify that no other accounts were compromised.

Answer

Remove the account from all administrative roles.

Answer

Run a full antivirus scan on the account's devices.

Question 8

A SOC analyst is using Microsoft Sentinel to investigate an incident involving a user who accessed a sensitive database from an unusual location. The analyst wants to find all activities performed by this user within the last 24 hours from multiple data sources. Which KQL operator should the analyst use to combine the results of two queries that return different schemas?

Accepted Answer

union. The correct answer is C. The union operator combines tables or query results with different schemas by adding columns. Join requires a common column. The other operators are not appropriate.

Answer

summarize

Answer

join

Answer

where

Question 9

Refer to the exhibit. A SOC analyst runs this KQL query in Microsoft Sentinel to investigate devices in the finance subnet. Which result would indicate that a device might be compromised?

Accepted Answer

A device with multiple connected networks, including an external IP.. The correct answer is D. A device with multiple connected networks, especially if those networks are unusual (e.g., a finance device connecting to external networks), could indicate lateral movement or command and control. The other options are not inherently suspicious.

Answer

A device named 'finance-server-01' with a single network connection.

Answer

A device with no network connections in the last 7 days.

Answer

A device with a LocalIPAddress starting with 10.0.0.

Question 10

Which TWO actions should a SOC analyst take immediately after confirming a ransomware incident in Microsoft Defender XDR?

Accepted Answer

Isolate affected devices from the network.. Correct answers are A and D. Isolating affected devices and resetting compromised account credentials are immediate containment steps. Collecting forensic data is important but after containment. Starting recovery can wait. Disabling mailboxes is not necessary unless email is a vector.

Answer

Begin restoring data from backups.

Answer

Disable all mailboxes in the organization.

Answer

Collect a full memory dump from each affected device.

Question 11

Which THREE components can be used in Microsoft Sentinel to automate incident response?

Accepted Answer

Automation rules. Correct answers are A, B, and E. Automation rules, playbooks, and triggers are part of Microsoft Sentinel's automation capabilities. Analytics rules generate incidents but do not automate response. Watchlists are for enrichment, not automation.

Answer

Watchlists

Answer

Analytics rules

Question 12

Which TWO indicators of compromise (IOCs) are most likely to be included in a Microsoft Sentinel threat intelligence feed to detect a known malware campaign?

Accepted Answer

File hash (SHA-256). Correct answers are A and E. File hashes and IP addresses are common IOCs used in threat intelligence feeds. Domain names and email addresses are also used but less common for malware detection. Registry keys are not typical IOCs in feeds.

Answer

Domain name

Answer

Email address

Answer

Registry key

Question 13

Refer to the exhibit. A SOC analyst runs this Advanced Hunting query in Microsoft Defender XDR to detect potential living-off-the-land (LotL) attacks. An alert is triggered when a device shows multiple occurrences of 'mshta.exe' executing with a remote script. Which additional data source should the analyst check to confirm the attack?

Accepted Answer

DeviceNetworkEvents. The correct answer is D. Network communication from the device to an external IP would confirm a remote connection attempt. The other options are not directly relevant or are redundant.

Answer

DeviceFileEvents

Answer

DeviceLogonEvents

Answer

DeviceRegistryEvents

Question 14

An organization uses Microsoft Defender for Cloud Apps to detect anomalous behavior. An alert indicates that a user has signed in from an impossible travel scenario. The SOC analyst confirms the alert is a false positive due to a VPN. What should the analyst do to prevent future false positives for this user?

Accepted Answer

Add the VPN IP range to the trusted IP addresses in Defender for Cloud Apps.. The correct answer is C. Adding the trusted IP range in Microsoft Defender for Cloud Apps allows the system to ignore impossible travel alerts from VPN IPs. The other options are not effective or appropriate.

Answer

Change the user's location in Microsoft Entra ID.

Answer

Ignore the alert and continue monitoring.

Answer

Disable the impossible travel detection rule.

Question 15

A SOC team uses Microsoft Sentinel and wants to automatically enrich incidents with threat intelligence from a third-party feed. Which feature should they configure to ingest the threat intelligence and correlate it with alerts?

Accepted Answer

Threat intelligence connectors. The correct answer is B. Threat intelligence connectors in Microsoft Sentinel allow ingestion of TI feeds and enable correlation with alerts. The other options do not provide this capability.

Answer

Analytics rules

Answer

Data connectors

Answer

Watchlists