SC-200 Respond to security incidents Practice Test 25 — 15 Questions

Question 1

A security analyst receives a Microsoft Defender for Identity alert about a suspicious Kerberos attack. The analyst needs to contain the compromised account immediately. What should the analyst do?

Accepted Answer

Disable the user account in Microsoft Entra ID.. Disabling the user account in Microsoft Entra ID immediately prevents any further authentication and access, containing the compromised account. This is the fastest and most direct containment action for a suspicious Kerberos attack alert in Microsoft Defender for Identity.

Answer

Remove the user from all privileged groups.

Answer

Require the user to change their password at next sign-in.

Answer

Reset the user's password and notify the user.

Question 2

A SOC analyst is responding to a ransomware incident. The analyst identifies that the ransomware encrypted files on a file share and left a ransom note. The analyst needs to prevent the ransomware from spreading to other shares. Which action should the analyst take first?

Accepted Answer

Isolate the server from the network using Microsoft Defender for Endpoint's device isolation.. The immediate priority in a ransomware incident is containment to prevent lateral movement and further encryption. Microsoft Defender for Endpoint's device isolation feature disconnects the compromised server from the network while allowing communication with the Defender for Cloud backend, stopping the ransomware from spreading to other shares. This aligns with the NIST incident response framework's containment phase, which must occur before eradication or recovery actions.

Answer

Revoke the user's access to the file share.

Answer

Run a full antivirus scan on the server.

Answer

Restore the encrypted files from backup.

Question 3

Which TWO actions should an analyst take when a user reports receiving a suspicious email with an attachment? (Select TWO.)

Accepted Answer

Submit the email to Microsoft for analysis using the Submissions page in Microsoft 365 Defender.. Option A is correct because submitting the suspicious email via the Submissions page in Microsoft 365 Defender sends the message, including its attachment, to Microsoft for analysis, allowing the service to detonate and inspect it and then update its threat intelligence and filtering. Option C is correct because an analyst can use Microsoft 365 Defender (for example, via Threat Explorer or the Email entity page) to soft-delete or hard-delete the malicious message from the user's mailbox, removing the threat and preventing further user interaction. Option B is wrong because automatically forwarding a potentially malicious email with a live attachment to IT spreads the threat and is not a standard containment action. Option D is wrong because opening the attachment could execute malicious code and compromise the analyst's workstation. Option E is wrong because blocking the sender only in the user's Outlook settings is a weak, local action that does not remove the message or protect the organization, and sender addresses are easily spoofed.

Answer

Run a PowerShell script to automatically forward the email to IT.

Answer

Open the attachment to verify if it is malicious.

Answer

Block the sender in the user's Outlook settings.

Question 4

Which THREE steps are part of the containment phase of incident response in Microsoft Sentinel? (Select THREE.)

Accepted Answer

Disable compromised user accounts in Microsoft Entra ID.. Disabling compromised user accounts in Microsoft Entra ID is a containment step because it immediately revokes the account's access tokens and prevents further authentication, stopping an attacker from using that identity to move laterally or access resources. This aligns with the containment phase's goal of limiting the blast radius of an incident.

Answer

Collect forensic data from affected endpoints.

Answer

Restore encrypted files from backup.

Question 5

Which THREE are valid incident classification categories in Microsoft Sentinel? (Select THREE.)

Accepted Answer

False Positive. In Microsoft Sentinel, incident classification captures the analyst's triage verdict on an incident, and the three supported values are True Positive, Benign Positive, and False Positive. Option D (True Positive) is correct because it marks an incident confirmed as a genuine security threat requiring action. Option E (Benign Positive) is correct because it marks an incident that triggered legitimately but represents expected or authorized activity rather than an attack. Option A (False Positive) is correct because it marks an incident caused by inaccurate or misconfigured detection logic that does not reflect real activity. Option B (Malicious) is not a classification value — maliciousness is conveyed through severity and tactics/entities, not the classification field. Option C (Informational) is not a classification value either; it is not one of the three triage verdicts Sentinel exposes for incident classification.

Answer

Malicious

Answer

Informational

Question 6

Refer to the exhibit. An analyst runs Get-MpThreat on a device. Based on the output, what is the status of the threat?

Accepted Answer

The threat was blocked and did not execute.. The output of Get-MpThreat shows the threat's state as 'Blocked' and its execution status as 'Not Executed'. This indicates that Microsoft Defender Antivirus successfully prevented the threat from running on the device. Therefore, the threat was blocked and did not execute, making D the correct answer.

Answer

The threat executed and is now inactive.

Answer

The threat was quarantined and is still active.

Answer

The threat is currently active on the device.

Question 7

Refer to the exhibit. An analyst runs the command to install the Azure Monitor Agent on a VM. What is the primary purpose of installing this agent in the context of security incident response?

Accepted Answer

To collect security events and performance data for analysis in Microsoft Sentinel.. The Azure Monitor Agent (AMA) is the modern replacement for the Log Analytics agent (MMA/OMS) and is used to collect security events, Windows Event Logs, Syslog, and performance counters from VMs and forward them to a Log Analytics workspace. In Microsoft Sentinel, that workspace is the data lake that powers analytics rules, hunting queries, and workbooks — so AMA's primary purpose in incident response is feeding telemetry into Sentinel for detection and investigation.

Answer

To integrate the VM with Microsoft Defender for Cloud.

Answer

To scan the VM for vulnerabilities.

Answer

To enable real-time malware protection on the VM.

Question 8

Your organization uses Microsoft Defender for Endpoint. A user reports that their device is running slowly and exhibiting unusual network activity. You run a live response session and find a suspicious process running. Which action should you take first to contain the threat?

Accepted Answer

Isolate the device from the network.. The first containment action in a live response session should be to isolate the device from the network. Isolation stops lateral movement, command-and-control communication, and data exfiltration while preserving the device state for forensic investigation. Terminating the process or collecting a memory dump can wait until the device is contained, because the threat may respawn or the attacker may pivot.

Answer

Collect a full memory dump for analysis.

Answer

Terminate the suspicious process.

Answer

Add a firewall rule to block outbound traffic from the device.

Question 9

You are investigating an incident in Microsoft Sentinel where a user account was used to sign in from an unfamiliar location and then accessed multiple sensitive files. Which step is most important to perform first?

Accepted Answer

Disable the user account and reset the password.. Confirming account compromise and immediately disabling the user account is the highest priority to stop further malicious activity. Resetting the password prevents the attacker from using the compromised credentials. Option A is incorrect because blocking the IP address alone may be ineffective if the attacker uses proxies, and it does not secure the account. Option B is incorrect because checking firewall logs is a secondary forensic step that does not address the immediate threat. Option C is incorrect because reviewing file permissions should be done after securing the account.

Answer

Block the IP address of the unfamiliar location.

Answer

Check firewall logs for related network traffic.

Answer

Review file permissions on the accessed files.

Question 10

During a security incident, you need to create a custom detection rule in Microsoft Sentinel to alert on multiple failed logins followed by a successful login from the same IP within 10 minutes. Which KQL function should you use to group events by IP address and time window?

Accepted Answer

summarize. The `summarize` operator is the correct choice because it groups events by one or more columns (e.g., IP address) and performs aggregations over a defined time window. In this scenario, you need to count failed logins and then check for a subsequent successful login within 10 minutes from the same IP, which requires grouping by IP and time. `summarize` allows you to use `bin()` on a timestamp to create time buckets, enabling the detection of multiple failed logins followed by a success within that window. This is the standard KQL approach for time-based correlation in Microsoft Sentinel.

Answer

join

Answer

extend

Answer

project

Question 11

Your organization uses Microsoft Defender for Cloud Apps. An alert indicates that a user is downloading large amounts of data from SharePoint Online. What should you do first to investigate?

Accepted Answer

Review the user's activity log in Defender for Cloud Apps.. The first step in investigating a potential data exfiltration alert is to review the user's activity log in Defender for Cloud Apps. This log provides granular details about the specific files downloaded, the volume of data, the time frame, and the source IP address, allowing you to validate whether the activity is anomalous or legitimate before taking any restrictive action.

Answer

Govern the user by suspending their account.

Answer

Create a new IP address range for the organization.

Answer

Block the SharePoint Online app for all users in Defender for Cloud Apps.

Question 12

Your organization uses Microsoft Defender XDR. You receive an automated investigation that found a malicious file on a device. The investigation recommends 'Block the file'. What does this action do?

Accepted Answer

Adds the file hash to the block list in Microsoft Defender for Endpoint.. In Microsoft Defender XDR, when an automated investigation finds a malicious file and recommends 'Block the file', the action adds the file's hash to the block list in Microsoft Defender for Endpoint. This prevents the file from executing on any device in the organization by leveraging the indicator of compromise (IoC) system. It does not isolate devices, initiate scans, or delete files; it simply blocks future execution based on the hash.

Answer

Isolates the device where the file was found.

Answer

Initiates a full antivirus scan on all devices.

Answer

Deletes the file from all devices in the organization.

Question 13

During an incident response, you need to collect forensic evidence from a compromised Windows device using Microsoft Defender for Endpoint live response. Which command should you use to gather running processes?

Accepted Answer

processes. The `processes` command in Microsoft Defender for Endpoint live response enumerates all currently running processes on the target device, returning details such as PID, name, and user context. It is one of the built-in live response commands specifically designed for forensic triage and incident investigation without needing to install third-party tooling. This makes it the correct choice for gathering running process evidence during an active incident.

Answer

dir

Answer

reg query

Answer

netstat

Question 14

Your Microsoft Sentinel workspace receives logs from multiple sources. You need to ensure that an incident response playbook is triggered automatically when a specific alert is generated. What should you create?

Accepted Answer

An automation rule.. An automation rule in Microsoft Sentinel is specifically designed to trigger incident response playbooks automatically when an alert is generated. It allows you to define conditions based on alert properties and then invoke a Logic App playbook without manual intervention. This is the correct mechanism for automating incident response actions in Sentinel.

Answer

A data connector.

Answer

An analytics rule.

Answer

A new Logic App.

Question 15

Which THREE are valid investigation actions in Microsoft Sentinel? (Select THREE.)

Accepted Answer

View related entities such as IP addresses.. Viewing related entities such as IP addresses is a fundamental investigation action in Microsoft Sentinel. Option C is correct because viewing related incidents helps in correlating events. Option E is correct because viewing related alerts provides context. Option B is incorrect because running a playbook is a remediation action, not an investigation action. Option D is incorrect because modifying an analytics rule is a configuration task outside the investigation scope.

Answer

Run a playbook.

Answer

Modify an analytics rule.