SC-200 Respond to security incidents Practice Test 24 — 15 Questions

Question 1

Your organization uses Microsoft Sentinel and Microsoft Defender for Cloud. You receive an alert from Defender for Cloud that a virtual machine has a high severity vulnerability: 'CVE-2023-XXXX' with a CVSS score of 9.8. The virtual machine is running a critical application for the finance department. You need to remediate the vulnerability as quickly as possible while minimizing downtime. The application vendor has not yet released a patch but has provided a workaround. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement the workaround provided by the vendor and create a custom remediation task in Defender for Cloud to track the issue.. When no vendor patch exists but a workaround is available, applying the workaround immediately mitigates the risk while a custom remediation task in Defender for Cloud tracks the issue until a permanent patch arrives. This balances urgency (CVSS 9.8 is critical) with the business need to keep the finance application running.

Answer

Dismiss the alert as a false positive because no patch is available.

Answer

Shut down the virtual machine until a patch is available.

Answer

Apply a network security group to block all inbound traffic to the VM.

Question 2

A security analyst is investigating a potential ransomware incident in Microsoft Defender XDR. The analyst needs to confirm the scope of the attack and halt further propagation. Which TWO actions should the analyst take first?

Accepted Answer

Initiate automated investigation on the affected devices. Initiating automated investigation on affected devices (A) is correct because Microsoft Defender XDR's automated investigation uses built-in playbooks to automatically analyze alerts, determine the scope of compromise, and suggest remediation actions without manual intervention. This is the fastest way to confirm the attack scope while simultaneously halting propagation. Isolating affected devices (D) is correct because network isolation immediately cuts off communication between the compromised device and other systems, preventing lateral movement and further encryption of network shares. Both actions are first-response steps in a ransomware incident.

Answer

Reset passwords for all users in the organization

Answer

Collect forensic evidence from affected systems

Answer

Run a full antivirus scan on all endpoints

Question 3

During a security incident, a Microsoft Sentinel analytics rule generated an alert for a suspicious sign-in from an unusual location. The incident involves a user whose account has been compromised. The security team needs to take immediate actions to remediate and prevent further damage. Which THREE actions should the security team prioritize?

Accepted Answer

Reset the user's password. Resetting the user's password (A) is a critical immediate step because it invalidates the current compromised credentials, preventing the attacker from using the known password to authenticate again. In Microsoft Entra ID, a password reset forces the user to create a new credential, which the attacker does not possess, effectively cutting off one of the most common attack vectors.

Answer

Review audit logs for all users

Answer

Raise the user's risk level in Identity Protection

Question 4

Your organization uses Microsoft Defender for Cloud Apps and Microsoft Sentinel. You receive an alert indicating that a user from the finance department accessed a sensitive SharePoint file from an IP address associated with a known malicious Tor exit node. The file contains payment information. The user's account has not been disabled. What should you do first to contain the incident?

Accepted Answer

Suspend the user's account in Microsoft Entra ID. The first step to contain the incident is to suspend the user's account in Microsoft Entra ID (Option D). This immediately revokes access to all resources, preventing further data exfiltration while preserving the current state for investigation. Option A is incorrect because deleting the SharePoint file may destroy evidence. Option B is incorrect because blocking the IP address in Defender for Cloud Apps is less effective; the attacker can easily switch to a different IP address. Option C is incorrect because notifying the user could alert a potential attacker who might have compromised the account, leading to further malicious actions.

Answer

Delete the SharePoint file from the site

Answer

Notify the user of the suspicious activity

Answer

Block the IP address in Microsoft Defender for Cloud Apps

Question 5

Your organization has deployed Microsoft Sentinel with the Microsoft Defender XDR connector. A high-severity incident is created for a user who received a phishing email that contained a malicious link. The user clicked the link, and the attacker gained access to the user's mailbox. The security team needs to remove the attacker's access and prevent future occurrences. What should you do first?

Accepted Answer

Remove any mailbox forwarding rules and delegated access. The first step should be to remove any mailbox forwarding rules and delegated access because attackers often set up persistence mechanisms to maintain access even after password resets. Removing these ensures the attacker cannot continue to receive emails or access the mailbox. This is a critical containment step before other remediation actions.

Answer

Run a full antivirus scan on the user's device

Answer

Reset the user's password immediately

Answer

Report the incident to Microsoft for further investigation

Question 6

You are a security analyst for a company using Microsoft Defender XDR. An incident is detected involving a device that has been communicating with a known command-and-control (C2) server. The device is currently online and the user is active. What should you do first to contain the threat?

Accepted Answer

Isolate the device from the network using Microsoft Defender for Endpoint. Isolating the device from the network using Microsoft Defender for Endpoint immediately cuts off all communication with the C2 server, preventing data exfiltration and further command execution. This is the fastest containment action that does not rely on user compliance or process-level responses, and it preserves the device's state for forensic analysis. In an active incident, stopping network-level communication is the priority over scanning or process termination.

Answer

Run a full antivirus scan on the device

Answer

Notify the user to disconnect the device

Answer

Kill the suspicious processes on the device

Question 7

You are investigating a low-severity incident in Microsoft Sentinel where a user reported receiving a phishing email. The email was not blocked by the email security solution. The user did not click any links. What should you do first?

Accepted Answer

Report the email for analysis using the Microsoft 365 Defender portal. The first step is to report the email for analysis using the Microsoft 365 Defender portal. Since the email was not blocked and the user did not click any links, the immediate priority is to submit the message to Microsoft for analysis (via the Submissions page or the Report button) so that detections can be tuned and the sender/URLs can be blocked if malicious. This preserves evidence and improves organizational protection before taking remediation actions.

Answer

Delete the phishing email from the user's inbox

Answer

Reset the user's password as a precaution

Answer

Isolate the user's device from the network

Question 8

Your organization uses Microsoft Defender for Cloud Apps and Microsoft Sentinel. An alert indicates that an external IP address is downloading large amounts of data from a SharePoint site containing confidential documents. The activity is coming from a valid user account that appears to be compromised. What should you do first to stop the data exfiltration?

Accepted Answer

Suspend the user account in Microsoft Entra ID. The first priority is to immediately stop the ongoing data exfiltration by suspending the compromised user account in Microsoft Entra ID. This disables the attacker's access via that account, halting the download. Blocking the external IP address (Option C) is less effective because the attacker could switch IPs. Changing SharePoint permissions (Option D) or deleting documents (Option A) would not stop the current download session as quickly as suspending the account.

Answer

Delete the confidential documents from SharePoint

Answer

Block the external IP address in Microsoft Defender for Cloud Apps

Answer

Change the SharePoint site permissions to deny access

Question 9

Your organization has Microsoft Sentinel and Microsoft Defender for Identity deployed. An incident is created for a user whose account was used to access a sensitive database from an unusual workstation. The user is a member of the 'Database Admins' group. The security team needs to prevent further unauthorized access and preserve evidence. What should you do first?

Accepted Answer

Disable the user's account in Active Directory. Disabling the user's account in Active Directory is the fastest and most effective way to immediately prevent further unauthorized access while preserving the account and its associated evidence for forensic investigation. It stops all authentication and access without deleting data or altering group memberships that investigators may need to review. Resetting the password or removing group membership does not immediately terminate existing sessions or prevent access as decisively.

Answer

Reset the user's password

Answer

Force the user to log off all sessions

Answer

Remove the user from the Database Admins group

Question 10

A security analyst receives a Microsoft Defender for Cloud Apps alert about a suspicious sign-in from an IP address in a sanctioned app. The analyst needs to immediately prevent further access from that IP. What should the analyst do?

Accepted Answer

Create an IP address-based access policy in Microsoft Defender for Cloud Apps.. Microsoft Defender for Cloud Apps provides native IP address-based access policies that can immediately block traffic from a specific IP address for a sanctioned app. This action is taken directly within Defender for Cloud Apps, without needing to modify Entra ID Conditional Access policies, and it applies in real time to the app session. The analyst can create a policy that blocks access from the suspicious IP, preventing further sign-ins from that address.

Answer

Create a mailbox rule to delete emails from that IP.

Answer

Create a Conditional Access policy in Microsoft Entra ID to block the IP.

Answer

Reset the user's password and require MFA re-registration.

Question 11

During an incident response, a SOC analyst identifies that a malicious PowerShell script was executed on multiple endpoints. The analyst needs to collect relevant files from all affected endpoints for further analysis. What should the analyst use?

Accepted Answer

Microsoft Defender for Endpoint Live Response.. Microsoft Defender for Endpoint Live Response allows analysts to remotely connect to endpoints and collect files, run scripts, and perform forensic actions in real time. This is the correct tool for gathering malicious PowerShell scripts from multiple affected endpoints during incident response.

Answer

Microsoft Defender for Cloud Apps file investigation.

Answer

Microsoft Purview eDiscovery.

Answer

Microsoft Sentinel incident investigation graph.

Question 12

An analyst is investigating a phishing campaign that targeted multiple users. The analyst needs to identify if any users clicked a malicious link in the email. Which Microsoft Defender for Office 365 feature should be used?

Accepted Answer

Threat Explorer. Threat Explorer (also known as Explorer) in Microsoft Defender for Office 365 provides a real-time, interactive view of threat data, including email delivery status and user actions such as clicks on malicious links. It allows analysts to filter by 'Click action' to identify users who clicked a URL that was determined to be malicious, making it the correct tool for this investigation.

Answer

Safe Attachments

Answer

Attack Simulator

Answer

Safe Links

Question 13

Your organization uses Microsoft Sentinel. A new incident is created from a fusion alert that combines multiple low-severity alerts. The analyst needs to determine the entities involved. What should the analyst review?

Accepted Answer

The incident's entities tab.. The incident's entities tab in Microsoft Sentinel provides a consolidated view of all entities (such as users, hosts, IP addresses, and processes) that were identified by the fusion alert. Since fusion alerts combine multiple low-severity alerts, the entities tab is the direct place to see the aggregated entities involved in the incident, enabling the analyst to understand the scope and pivot for investigation.

Answer

The Sentinel Overview workbook.

Answer

The analytics rule that generated the incident.

Answer

The incident's timeline.

Question 14

A SOC team uses Microsoft Sentinel with Microsoft Defender XDR integration. An incident is created from a Defender for Endpoint alert. The analyst wants to run a KQL query across all affected devices without creating a new analytics rule. How can the analyst achieve this?

Accepted Answer

Use the incident's Logs blade to run a KQL query.. The incident's Logs blade in Microsoft Sentinel allows analysts to run KQL queries directly against the data ingested into the workspace, scoped to the incident's context. This enables ad-hoc investigation across all affected devices without modifying or creating any analytics rules, which would require rule authoring and deployment.

Answer

Modify the analytics rule that created the incident.

Answer

Use the Microsoft Sentinel Hunting blade.

Answer

Create a new workbook.

Question 15

During an incident, an analyst finds that a user's account was compromised and used to send spam. The analyst needs to revoke all active sessions for that user. What should the analyst do?

Accepted Answer

Revoke the user's sessions in Microsoft Entra ID.. Revoking sessions in Microsoft Entra ID immediately invalidates all refresh tokens and active sign-in sessions for the compromised user, cutting off the attacker's access without disrupting the account's ability to be re-secured. This is the targeted response for session hijacking because it terminates existing tokens rather than just changing credentials. Password reset alone does not invalidate already-issued tokens, so the attacker could remain authenticated.

Answer

Reset the user's password.

Answer

Create a Conditional Access policy to block the user.

Answer

Disable the user account in Microsoft Entra ID.