SC-200 Respond to security incidents Practice Test 24 — 15 Questions

Question 1

During an incident response, your team identifies a suspicious PowerShell command executed on multiple devices. Which Microsoft Defender XDR feature should you use to block the command across all endpoints immediately?

Accepted Answer

Indicators of compromise (IoC). Option C is correct because Microsoft Defender XDR's Indicator of Compromise (IoC) allows custom indicators to block file hashes, IPs, URLs, or commands. Option A is wrong because ASR rules are broader and not designed for ad-hoc command blocking. Option B is wrong because Device Control manages hardware peripherals. Option D is wrong because PUA protection targets potentially unwanted applications, not specific commands.

Answer

Potentially Unwanted Application (PUA) protection

Answer

Attack Surface Reduction (ASR) rules

Answer

Device Control policies

Question 2

Your incident response team receives an alert from Microsoft Sentinel for a user account that has been compromised. The alert indicates that the user's credentials were used from an unfamiliar location. What is the first action you should take?

Accepted Answer

Disable the user account in Microsoft Entra ID. Option B is correct because immediately disabling the compromised user account stops further unauthorized access. Option A is wrong because reviewing logs delays the containment. Option C is wrong because resetting password after disabling is standard, but disabling first is critical. Option D is wrong because notifying the user before containment could alert the attacker.

Answer

Review the sign-in logs to confirm the alert

Answer

Reset the user's password

Answer

Notify the user and ask them to change their password

Question 3

Your Microsoft Sentinel workspace is receiving a high volume of false positive alerts from a specific analytics rule. You need to suppress these alerts without disabling the rule. Which feature should you use?

Accepted Answer

Configure alert suppression in the analytics rule. Option D is correct because alert suppression in Sentinel allows you to temporarily suppress alerts matching specific criteria. Option A is wrong because automation rules execute actions but do not suppress alerts. Option B is wrong because the alert threshold is a rule setting, not a suppression mechanism. Option C is wrong because incident creation setting only controls whether incidents are created, not alert suppression.

Answer

Create an automation rule to close incidents

Answer

Adjust the alert threshold in the analytics rule

Answer

Disable incident creation for the rule

Question 4

During a security incident, you need to collect forensic evidence from a compromised Windows device. Which Microsoft Defender for Endpoint action should you use to collect a memory dump?

Accepted Answer

Collect investigation package. Option C is correct because 'Collect investigation package' gathers forensic data including memory dump. Option A is wrong because 'Run antivirus scan' only scans for malware. Option B is wrong because 'Isolate device' disconnects from network but does not collect memory. Option D is wrong because 'Initiate Live Response' provides remote shell but does not specifically collect memory dump as a single action.

Answer

Initiate Live Response

Answer

Isolate device

Answer

Run antivirus scan

Question 5

Your security operations center (SOC) uses Microsoft Sentinel. An incident is created from a fusion alert. What does Fusion technology do?

Accepted Answer

Correlates alerts from different products to detect multi-stage attacks. Option A is correct because Fusion correlates multiple alerts and signals to identify multi-stage attacks. Option B is wrong because that describes Scheduled rules. Option C is wrong because that describes Machine Learning (ML) analytics. Option D is wrong because that describes Anomaly detection.

Answer

Uses machine learning to detect suspicious user behavior

Answer

Runs queries at scheduled intervals to detect threats

Answer

Detects unusual patterns in Azure activity logs

Question 6

Your organization is using Microsoft Defender XDR. During an incident, you need to create a custom detection rule that triggers when a specific file hash is executed on any device. Which component should you use?

Accepted Answer

Custom detection rules. Option B is correct because custom detection rules in Defender XDR allow you to create detection logic based on advanced hunting queries. Option A is wrong because indicators of compromise (IoC) block or alert but are not detection rules. Option C is wrong because automation rules in Sentinel are for incident response, not detection. Option D is wrong because ASR rules are built-in and cannot be customized for specific file hashes.

Answer

Attack Surface Reduction (ASR) rules

Answer

Automation rules in Microsoft Sentinel

Answer

Indicators of compromise (IoC)

Question 7

Your incident response team has identified a phishing campaign targeting your organization. The emails contain a link to a malicious site. Which Microsoft Defender for Office 365 feature should you use to block the URL across all users?

Accepted Answer

Tenant Allow/Block List. Option C is correct because Tenant Allow/Block List in Defender for Office 365 allows blocking URLs at the tenant level. Option A is wrong because Safe Attachments scans attachments, not URLs. Option B is wrong because Safe Links can block URLs but is policy-based; Tenant Allow/Block List is immediate. Option D is wrong because Anti-Phish policies protect against impersonation, not specific URLs.

Answer

Safe Links policy

Answer

Anti-Phish policy

Answer

Safe Attachments policy

Question 8

Your organization is using Microsoft Sentinel as a SIEM. You need to forward logs from a legacy firewall that does not support common event format (CEF) or Syslog. Which solution should you use?

Accepted Answer

Deploy a Logstash forwarder with the Sentinel output plugin. Option A is correct because Logstash can parse custom log formats and forward to Sentinel via HTTP Data Collector API. Option B is wrong because Azure Policy is for governance, not log ingestion. Option C is wrong because Logic Apps can process logs but is not designed for high-volume log forwarding. Option D is wrong because Azure Monitor Agent supports Windows/Linux, not custom formats.

Answer

Use Azure Policy to export logs from the firewall

Answer

Install Azure Monitor Agent on the firewall

Answer

Create a Logic App with an HTTP trigger

Question 9

Your SOC uses Microsoft Defender for Cloud Apps. An alert indicates that a user is downloading a large number of files from SharePoint. Which action should you take to investigate and potentially block the activity?

Accepted Answer

Suspend the user in Defender for Cloud Apps. Option D is correct because Defender for Cloud Apps allows you to govern the user by suspending them or blocking the app. Option A is wrong because Azure AD Conditional Access policies are applied at authentication, not during active session. Option B is wrong because Intune manages devices, not user access to cloud apps. Option C is wrong because blocking the IP may affect other users.

Answer

Create a Conditional Access policy to block the user

Answer

Block the IP address in Azure Firewall

Answer

Use Microsoft Intune to wipe the user's device

Question 10

Which TWO of the following are valid response actions when a malware outbreak is detected on multiple endpoints? (Select TWO.)

Accepted Answer

Isolate the affected devices from the network. Options A and C are correct. Isolating devices and running antivirus scans are immediate response actions. Option B is wrong because resetting passwords does not remove malware. Option D is wrong because reimaging is a later step after investigation. Option E is wrong because deleting user accounts is unnecessary and disrupts operations.

Answer

Reset passwords for all users on affected devices

Answer

Delete the affected user accounts

Answer

Reimage the affected devices immediately

Question 11

Which THREE of the following are key steps when containing a ransomware incident in Microsoft Defender XDR? (Select THREE.)

Accepted Answer

Block known malicious file hashes via Indicators of compromise. Options A, B, and D are correct. Isolating devices, blocking indicators, and disabling user accounts are key containment steps. Option C is wrong because restoring from backup is part of recovery, not containment. Option E is wrong because analyzing the root cause is part of investigation after containment.

Answer

Restore encrypted files from backup

Answer

Analyze the root cause of the outbreak

Question 12

Which TWO of the following are valid data connectors for Microsoft Sentinel? (Select TWO.)

Accepted Answer

Azure Firewall. Options B and D are correct. Microsoft Entra ID and Azure Firewall have built-in connectors. Option A is wrong because Google Cloud Storage is not a default connector; it requires custom ingestion. Option C is wrong because Docker is not a data source for Sentinel. Option E is wrong because Amazon RDS is not a direct connector.

Answer

Docker containers

Answer

Amazon RDS

Answer

Google Cloud Storage

Question 13

Based on the KQL query shown, what is the purpose of the case() function?

Accepted Answer

To reclassify High severity alerts as Critical. Option A is correct because case() reclassifies 'High' severity alerts as 'Critical' for better prioritization. Option B is wrong because case() does not filter alerts; it only transforms the Severity field. Option C is wrong because the query already filters for Malware and Ransomware. Option D is wrong because case() does not aggregate; summarize does that.

Answer

To aggregate counts by severity

Answer

To include alerts with name containing Malware or Ransomware

Answer

To filter alerts with severity High or Critical

Question 14

An analyst runs this advanced hunting query to investigate suspicious command-line activity. Which type of activity is this query most likely detecting?

Accepted Answer

Execution of obfuscated scripts via encoded commands. Option B is correct because -enc (encoded command) is commonly used in malicious PowerShell commands to obfuscate. Option A is wrong because port scanning does not use encoded commands. Option C is wrong because data exfiltration typically involves network connections, not encoded commands. Option D is wrong because privilege escalation is not directly indicated by encoded commands.

Answer

Data exfiltration to external IPs

Answer

Privilege escalation attempts

Answer

Port scanning activity

Question 15

Based on the ARM template snippet, what is the purpose of this analytics rule?

Accepted Answer

To detect multiple failed logon attempts within a time window. Option C is correct because the query counts failed logon events (EventID 4625) and triggers when count > 5, indicating brute force attempts. Option A is wrong because EventID 4625 is failed logon, not success. Option B is wrong because the query does not include multiple event IDs. Option D is wrong because the query does not check for account lockouts.

Answer

To detect successful logins by account

Answer

To detect account lockouts