SC-200 Respond to security incidents Practice Test 23 — 15 Questions

Question 1

During an incident response, your team identifies a suspicious PowerShell command executed on multiple devices. Which Microsoft Defender XDR feature should you use to block the command across all endpoints immediately?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Indicators of compromise (IoC). Microsoft Defender XDR's Indicators of compromise (IoC) allow creating custom indicators to block file hashes, IPs, URLs, or commands across endpoints. Option A is wrong because Potentially Unwanted Application (PUA) protection targets unwanted software, not specific commands. Option C is wrong because Attack Surface Reduction (ASR) rules are designed to block common attack patterns, not ad-hoc commands. Option D is wrong because Device Control policies manage peripheral devices like USB drives.

Answer

Potentially Unwanted Application (PUA) protection

Answer

Attack Surface Reduction (ASR) rules

Answer

Device Control policies

Question 2

Your incident response team receives an alert from Microsoft Sentinel for a user account that has been compromised. The alert indicates that the user's credentials were used from an unfamiliar location. What is the first action you should take?

Accepted Answer

Disable the user account in Microsoft Entra ID. The first action should be to disable the user account in Microsoft Entra ID (Option A). This immediately stops any further unauthorized access using the compromised credentials. Reviewing sign-in logs (Option B) is important for investigation but should follow containment to prevent additional damage. Resetting the password (Option C) is a step after disabling, but disabling first is critical to block access instantly. Notifying the user (Option D) could tip off an attacker if the user is not the actual person or if they are compromised.

Answer

Review the sign-in logs to confirm the alert

Answer

Reset the user's password

Answer

Notify the user and ask them to change their password

Question 3

Your Microsoft Sentinel workspace is receiving a high volume of false positive alerts from a specific analytics rule. You need to suppress these alerts without disabling the rule. Which feature should you use?

Accepted Answer

Configure alert suppression in the analytics rule. Alert suppression in the analytics rule allows you to temporarily suppress alerts matching specific criteria, reducing false positives without disabling the rule. Option A is incorrect because automation rules execute actions but do not suppress alerts. Option B is incorrect because adjusting the alert threshold changes sensitivity, not suppression. Option D is incorrect because disabling incident creation still generates alerts but stops incident creation, not suppressing alerts.

Answer

Create an automation rule to close incidents

Answer

Adjust the alert threshold in the analytics rule

Answer

Disable incident creation for the rule

Question 4

During a security incident, you need to collect forensic evidence from a compromised Windows device. Which Microsoft Defender for Endpoint action should you use to collect a memory dump?

Accepted Answer

Collect investigation package. 'Collect investigation package' gathers forensic data including memory dump. Option A is wrong because 'Initiate Live Response' provides remote shell but does not specifically collect memory dump as a single action. Option B is wrong because 'Isolate device' disconnects from network but does not collect memory. Option D is wrong because 'Run antivirus scan' only scans for malware.

Answer

Initiate Live Response

Answer

Isolate device

Answer

Run antivirus scan

Question 5

Your security operations center (SOC) uses Microsoft Sentinel. An incident is created from a fusion alert. What does Fusion technology do?

Accepted Answer

Correlates alerts from different products to detect multi-stage attacks. Microsoft Sentinel Fusion technology uses machine learning to correlate alerts from multiple products (e.g., Microsoft Defender for Cloud, Microsoft 365 Defender) to detect multi-stage attacks. Option A is incorrect because that describes User and Entity Behavior Analytics (UEBA). Option B is incorrect because that describes scheduled analytics rules. Option C is incorrect because that describes anomaly detection rules.

Answer

Uses machine learning to detect suspicious user behavior

Answer

Runs queries at scheduled intervals to detect threats

Answer

Detects unusual patterns in Azure activity logs

Question 6

Your organization is using Microsoft Defender XDR. During an incident, you need to create a custom detection rule that triggers when a specific file hash is executed on any device. Which component should you use?

Accepted Answer

Custom detection rules. Custom detection rules in Defender XDR allow you to create detection logic based on advanced hunting queries. Option A is wrong because Attack Surface Reduction (ASR) rules are built-in and cannot be customized for specific file hashes. Option C is wrong because automation rules in Sentinel are for incident response, not detection. Option D is wrong because indicators of compromise (IoC) block or alert but are not detection rules.

Answer

Attack Surface Reduction (ASR) rules

Answer

Automation rules in Microsoft Sentinel

Answer

Indicators of compromise (IoC)

Question 7

Your incident response team has identified a phishing campaign targeting your organization. The emails contain a link to a malicious site. Which Microsoft Defender for Office 365 feature should you use to block the URL across all users?

Accepted Answer

Tenant Allow/Block List. The Tenant Allow/Block List in Microsoft Defender for Office 365 allows administrators to block specific URLs at the tenant level, providing immediate protection across all users. Option A is wrong because Safe Links policies protect users from malicious URLs in real time but are policy-based and do not offer immediate tenant-wide blocking. Option B is wrong because Anti-Phish policies protect against impersonation attacks and phishing attempts, not specific URL blocking. Option C is wrong because Safe Attachments scans email attachments for malware, not URLs.

Answer

Safe Links policy

Answer

Anti-Phish policy

Answer

Safe Attachments policy

Question 8

Your organization is using Microsoft Sentinel as a SIEM. You need to forward logs from a legacy firewall that does not support common event format (CEF) or Syslog. Which solution should you use?

Accepted Answer

Deploy a Logstash forwarder with the Sentinel output plugin. Logstash can parse custom log formats and forward to Sentinel via HTTP Data Collector API. Option B is wrong because Azure Policy is for governance, not log ingestion. Option C is wrong because Logic Apps can process logs but is not designed for high-volume log forwarding. Option D is wrong because Azure Monitor Agent supports Windows/Linux, not custom formats.

Answer

Use Azure Policy to export logs from the firewall

Answer

Install Azure Monitor Agent on the firewall

Answer

Create a Logic App with an HTTP trigger

Question 9

Your SOC uses Microsoft Defender for Cloud Apps. An alert indicates that a user is downloading a large number of files from SharePoint. Which action should you take to investigate and potentially block the activity?

Accepted Answer

Suspend the user in Defender for Cloud Apps. Defender for Cloud Apps allows you to govern the user by suspending them or blocking the app. Option A is wrong because Azure AD Conditional Access policies are applied at authentication, not during active session. Option B is wrong because Intune manages devices, not user access to cloud apps. Option C is wrong because blocking the IP may affect other users.

Answer

Create a Conditional Access policy to block the user

Answer

Block the IP address in Azure Firewall

Answer

Use Microsoft Intune to wipe the user's device

Question 10

Which TWO of the following are valid response actions when a malware outbreak is detected on multiple endpoints? (Select TWO.)

Accepted Answer

Isolate the affected devices from the network. Options B and C are correct. Isolating affected devices prevents the spread of malware, and running full antivirus scans attempts to remove the threat. Option A (resetting passwords) does not address the malware itself. Option D (deleting user accounts) is unnecessary and disruptive. Option E (reimaging) is a more drastic step typically taken after further investigation if needed.

Answer

Reset passwords for all users on affected devices

Answer

Delete the affected user accounts

Answer

Reimage the affected devices immediately

Question 11

Which THREE of the following are key steps when containing a ransomware incident in Microsoft Defender XDR? (Select THREE.)

Accepted Answer

Block known malicious file hashes via Indicators of compromise. Blocking malicious file hashes via indicators of compromise (B), disabling compromised user accounts (C), and isolating compromised devices (E) are key steps in containing a ransomware incident. Restoring from backup (A) is part of recovery, and analyzing root cause (D) is part of investigation, both of which occur after containment.

Answer

Restore encrypted files from backup

Answer

Analyze the root cause of the outbreak

Question 12

Which TWO of the following are valid data connectors for Microsoft Sentinel? (Select TWO.)

Accepted Answer

Azure Firewall. Azure Firewall and Microsoft Entra ID are both supported data connectors in Microsoft Sentinel. Azure Firewall can be connected via the Azure Firewall connector, and Microsoft Entra ID (formerly Azure Active Directory) has built-in connectors for auditing and sign-in logs. Docker containers (A) are not a native data source for Sentinel; they would require a custom solution. Amazon RDS (B) is not directly supported; you would need to ingest via AWS CloudTrail or similar. Google Cloud Storage (D) also requires custom ingestion methods.

Answer

Docker containers

Answer

Amazon RDS

Answer

Google Cloud Storage

Question 13

Based on the KQL query shown, what is the purpose of the case() function?

Accepted Answer

To reclassify High severity alerts as Critical. The case() function reclassifies 'High' severity alerts as 'Critical' for better prioritization. Option A is wrong because case() does not aggregate counts; the summarize function does that. Option B is wrong because case() does not filter alerts by name; the where clause does that. Option C is wrong because case() does not filter by severity; it transforms the Severity field.

Answer

To aggregate counts by severity

Answer

To include alerts with name containing Malware or Ransomware

Answer

To filter alerts with severity High or Critical

Question 14

An analyst runs this advanced hunting query to investigate suspicious command-line activity. Which type of activity is this query most likely detecting?

Accepted Answer

Execution of obfuscated scripts via encoded commands. The advanced hunting query likely detects the use of encoded commands (e.g., -EncodedCommand or -enc) in PowerShell execution, which is a common technique to obfuscate the actual script being run. Encoded commands are used to hide malicious intent from basic log inspection. Option A correctly identifies this as execution of obfuscated scripts via encoded commands. Option B is incorrect because data exfiltration would typically involve outbound network connections, not encoded commands. Option C is incorrect because privilege escalation does not directly rely on encoded commands. Option D is incorrect because port scanning involves network connections, not encoded command execution.

Answer

Data exfiltration to external IPs

Answer

Privilege escalation attempts

Answer

Port scanning activity

Question 15

Based on the ARM template snippet, what is the purpose of this analytics rule?

Accepted Answer

To detect multiple failed logon attempts within a time window. The query counts failed logon events (EventID 4625) and triggers when the count exceeds a threshold (e.g., 5) within a time window, indicating multiple failed attempts. Option B is correct because a high count of failed logon attempts from the same account or IP is a classic sign of a brute force attack. Option C is incorrect because EventID 4625 is a failed logon, not a successful login. Option D is incorrect because the query does not include EventID 4740 (account lockout) and does not check for lockouts.

Answer

To detect successful logins by account

Answer

To detect account lockouts