SC-200 Respond to security incidents Practice Test 25 — 15 Questions

Question 1

Your organization uses Microsoft Sentinel. A security analyst receives an alert from a custom analytics rule that triggers on a specific sequence of failed logon attempts followed by a successful logon from an unusual location. The incident is generated but the analyst is not sure if the activity is malicious or a user error. What should the analyst do first to quickly gather additional context?

Accepted Answer

Use the Investigation graph to explore related entities and events. Option C is correct because using the Investigation graph in Microsoft Sentinel allows the analyst to visually explore related entities and events to understand the scope and context of the incident. Option A is wrong because creating a new analytics rule would not help with immediate investigation. Option B is wrong because running a KQL query across the entire workspace is time-consuming and less efficient. Option D is wrong because modifying the existing rule is not appropriate for investigating a single incident.

Answer

Run a KQL query across the entire workspace to find all related events

Answer

Create a new analytics rule to detect similar patterns

Answer

Modify the existing analytics rule to add more conditions

Question 2

Your company uses Microsoft Defender XDR. A critical server is exhibiting signs of a potential ransomware attack, with files being encrypted and a ransom note appearing. The incident has been escalated to the security operations center (SOC). What is the most immediate action to contain the threat and prevent further spread?

Accepted Answer

Initiate the 'Contain device' action from Microsoft Defender XDR. Option B is correct because deploying the 'Contain device' action in Microsoft Defender XDR immediately isolates the device from the network, stopping the ransomware from spreading. Option A is wrong because running a full antivirus scan takes time and does not contain the threat. Option C is wrong because collecting an investigation package is for analysis, not containment. Option D is wrong because removing the user's access does not stop the ransomware already running on the device.

Answer

Collect an investigation package for analysis

Answer

Disable the user account that was logged on

Answer

Run a full antivirus scan on the server

Question 3

An organization uses Microsoft Sentinel. A security engineer needs to set up automatic response actions when a high-severity incident is created. The engineer wants to trigger a playbook that sends a notification to a Microsoft Teams channel and creates a ticket in ServiceNow. What should the engineer use?

Accepted Answer

An automation rule that triggers a playbook. Option B is correct because automation rules in Microsoft Sentinel can trigger playbooks (Azure Logic Apps) when incidents are created or updated. Option A is wrong because analytics rules create alerts, not incidents directly. Option C is wrong because workbooks are for visualization, not automation. Option D is wrong because watchlists are for correlation, not automated response.

Answer

An analytics rule with incident creation enabled

Answer

A watchlist to detect the incident

Answer

A workbook with a custom alert

Question 4

Your organization uses Microsoft Defender for Cloud Apps. A security analyst discovers that a user's account has been compromised and is exfiltrating sensitive data from SharePoint Online. The analyst needs to immediately block the suspicious activities while allowing legitimate user activities to continue. What should the analyst do?

Accepted Answer

Suspend the user from Defender for Cloud Apps. Option C is correct because the 'Suspend user' action in Defender for Cloud Apps immediately blocks the user's access to cloud apps, stopping exfiltration. Option A is wrong because revoking all OAuth tokens might affect other apps and is less targeted. Option B is wrong because changing the password does not immediately stop active sessions. Option D is wrong because blocking the IP address may affect other users if the IP is shared.

Answer

Reset the user's password and require MFA

Answer

Revoke all OAuth tokens for the user

Answer

Block the user's IP address in the firewall

Question 5

A company uses Microsoft Sentinel as its SIEM. The security team is investigating an incident that involves multiple alerts from different data sources. The team wants to see a timeline of all related activities across all data sources in one view. Which Microsoft Sentinel feature should they use?

Accepted Answer

Incident timeline. Option D is correct because the Incident timeline in Microsoft Sentinel provides a unified chronological view of all alerts and events related to an incident. Option A is wrong because the Investigation graph is more about entity relationships. Option B is wrong because workbooks are for custom dashboards. Option C is wrong because the Hunting page is for proactive searches, not incident investigation.

Answer

Workbooks

Answer

Investigation graph

Answer

Hunting page

Question 6

An organization uses Microsoft Defender for Endpoint. A user reports that their device is running slowly and they see unexpected pop-ups. The security team suspects malware. What should the team do first to investigate?

Accepted Answer

Run a quick scan on the device from Microsoft Defender for Endpoint. Option A is correct because running a quick scan in Microsoft Defender for Endpoint will detect common malware quickly. Option B is wrong because submitting the file to Microsoft for analysis is not the first step. Option C is wrong because initiating a live response session is more invasive and should be used after initial detection. Option D is wrong because checking the device inventory does not help with active malware.

Answer

Check the device inventory for recent software installations

Answer

Initiate a live response session on the device

Answer

Submit a suspicious file to Microsoft for analysis

Question 7

Your company uses Microsoft Sentinel. A security analyst receives an incident that includes a large number of alerts from a single data source. The analyst needs to identify which alerts are duplicates or related so they can focus on unique threats. Which feature should the analyst use?

Accepted Answer

Alert grouping. Option C is correct because alert grouping in Microsoft Sentinel automatically groups similar alerts into a single incident, reducing noise. Option A is wrong because automation rules are for response, not grouping. Option B is wrong because entity mapping is for enriching alerts with entities. Option D is wrong because the Investigation graph is for exploring relationships, not grouping.

Answer

Investigation graph

Answer

Entity mapping

Answer

Automation rules

Question 8

An organization uses Microsoft Defender XDR. During an incident investigation, the security team needs to determine if a specific file was executed on any devices in the organization over the past 30 days. They have the file hash. What is the most efficient way to get this information?

Accepted Answer

Use advanced hunting to query for file execution events. Option B is correct because advanced hunting in Microsoft Defender XDR allows querying for file execution events across all devices using the file hash. Option A is wrong because the device inventory does not show execution history. Option C is wrong because the incident timeline is for a specific incident, not a file search across devices. Option D is wrong because the action center is for response actions, not queries.

Answer

Use the action center to search for the file

Answer

Review the incident timeline for the file

Answer

Check the device inventory for the file

Question 9

A security analyst is investigating a phishing incident in Microsoft Defender XDR. The analyst wants to see the full email content and attachments. Where should the analyst look?

Accepted Answer

The email entity page. Option D is correct because the Email entity page in Microsoft Defender XDR provides detailed information about an email, including content and attachments. Option A is wrong because the user entity page shows user information, not email content. Option B is wrong because the incident timeline shows events, not full email content. Option C is wrong because the action center is for response actions.

Answer

The incident timeline

Answer

The action center

Answer

The user entity page

Question 10

Which TWO actions should a security analyst take when responding to a confirmed malware outbreak in Microsoft Defender for Endpoint?

Accepted Answer

Isolate the affected device. Options A and C are correct. Option A: Isolating the affected device prevents lateral movement. Option C: Running a full scan on the device helps ensure all malware components are detected. Option B is wrong because resetting the user password does not stop active malware. Option D is wrong because the hunter is for proactive threat hunting, not immediate response. Option E is wrong because deleting the user account is too drastic and does not address the malware.

Answer

Create a custom detection rule for the malware

Answer

Delete the user account

Answer

Reset the user's password

Question 11

Which THREE actions are appropriate when investigating a potential data exfiltration incident in Microsoft Defender for Cloud Apps?

Accepted Answer

Use the app dashboard to view unusual behavior alerts. Options A, B, and D are correct. Option A: Reviewing the activity log helps identify the scope of exfiltration. Option B: Using the app dashboard to see unusual behavior provides context. Option D: Checking the file policy matches shows which files were flagged. Option C is wrong because suspending the user is a containment action, not investigation. Option E is wrong because checking device inventory does not apply to cloud apps.

Answer

Check the device inventory for suspicious applications

Answer

Suspend the user's account immediately

Question 12

Which TWO sources of evidence should a security analyst examine first when investigating a user-reported phishing email in Microsoft Defender XDR?

Accepted Answer

The email entity page. Options B and C are correct. Option B: The email entity page provides details about the email, including sender and links. Option C: The user's mailbox audit log shows if the user interacted with the email. Option A is wrong because the device timeline is not relevant for email. Option D is wrong because the action center is for response. Option E is wrong because advanced hunting is for complex queries, not first step.

Answer

The action center

Answer

The user's device timeline

Answer

Advanced hunting for email events

Question 13

Refer to the exhibit. An automation rule is configured as shown. When will the playbook be triggered?

Accepted Answer

When a new incident is created with severity High, from Microsoft Defender for Endpoint, and with 'Malware' in the title. Option A is correct because the rule triggers on incident creation with conditions: severity is High, provider is Microsoft Defender for Endpoint, and title contains 'Malware'. All conditions must be met. Option B is wrong because the condition is IncidentCreated, not IncidentUpdated. Option C is wrong because the provider condition restricts to Defender for Endpoint only. Option D is wrong because severity must be High, not any.

Answer

When any incident is created from Microsoft Defender for Endpoint

Answer

When a new incident with any severity contains 'Malware' in the title

Answer

When an incident is updated to High severity

Question 14

Refer to the exhibit. A security analyst runs this KQL query in Microsoft Defender XDR advanced hunting. What is the most likely purpose of this query?

Accepted Answer

To identify accounts or devices with high volumes of suspicious PowerShell activity. Option B is correct because the query filters for PowerShell executions with encoded or command-line switches and groups by device and account, looking for devices/accounts with more than 5 such executions in the last 7 days. This is typical for detecting excessive use of PowerShell for suspicious activity. Option A is wrong because the query does not check for network connections. Option C is wrong because the query counts executions, not persistence mechanisms. Option D is wrong because the query is not about weak credentials.

Answer

To find accounts with failed logon attempts indicating brute force

Answer

To find devices that made outbound network connections to known malicious IPs

Answer

To detect persistence mechanisms like scheduled tasks

Question 15

Refer to the exhibit. An incident in Microsoft Sentinel contains the entities shown. Which additional data source would be most useful to investigate this incident?

Accepted Answer

Microsoft Entra ID sign-in logs. Option B is correct because the incident involves a suspicious sign-in from an unfamiliar IP. Checking Microsoft Entra ID sign-in logs can provide additional context like authentication details, user agent, and risk level. Option A is wrong because Microsoft Defender for Endpoint focuses on endpoints, not cloud sign-ins. Option C is wrong because Microsoft Purview is for compliance and data governance. Option D is wrong because Microsoft Intune is for device management, not sign-in events.

Answer

Microsoft Defender for Endpoint device timeline

Answer

Microsoft Purview audit logs

Answer

Microsoft Intune device compliance logs