SC-200 Respond to security incidents Practice Test 25 — 15 Questions

Question 1

An incident in Microsoft Defender XDR shows a device with high severity alert: 'Suspicious PowerShell command line.' The device is currently isolated from the network. What is the best next step to investigate the alert?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Run a live response session on the device.. Running a live response session allows the analyst to remotely investigate the isolated device, collect artifacts, or execute commands without risking lateral movement. Full scan is reactive; reviewing timeline is passive; restoring connectivity prematurely could spread the threat.

Answer

Review the device timeline for related alerts.

Answer

Restore network connectivity to allow the device to communicate with the cloud for analysis.

Answer

Initiate a full antivirus scan on the device.

Question 2

During a ransomware investigation, a security analyst finds that multiple files on a file server have been encrypted. The server runs Microsoft Defender for Cloud and has been onboarded to Microsoft Sentinel. Which data source in Sentinel would provide the most granular information about the file encryption events?

Accepted Answer

Microsoft Defender for Cloud (Azure Defender) alerts. Microsoft Defender for Cloud (formerly Azure Defender) provides file integrity monitoring and security events at the OS level. Sysmon via AMA would need specific configuration; Windows Security Events may not capture encryption; Azure Activity Log is for control plane events.

Answer

Azure Activity Log

Answer

Windows Security Events via MMA

Answer

Sysmon events via Azure Monitor Agent

Question 3

Refer to the exhibit. The KQL query runs in Microsoft Sentinel and returns no results. The analyst expects to see failed logon attempts. What is the most likely reason?

Accepted Answer

The ResultType field does not exist in IdentityLogonEvents.. The query filters on ResultType == 'Failed', but the field is likely named 'Result' or uses different values like 'Failure'. Also, the table 'IdentityLogonEvents' may not exist; it might be 'AADSignInEventsBeta' or similar. But the most common issue is incorrect field name for result type.

Answer

The Application filter is incorrect.

Answer

The summarize operator is misused.

Answer

The TimeRange variable is too short.

Question 4

A security operations center (SOC) analyst is investigating an incident involving a user who received a phishing email with a malicious macro. The analyst needs to determine if any other users received the same email. Which Microsoft 365 Defender feature should the analyst use?

Accepted Answer

Threat Explorer (Investigation). Threat Explorer in Microsoft 365 Defender allows hunting for email messages by sender, subject, or other attributes. Advanced Hunting is for raw queries; Email entity page shows one email; Alert queue filters by alert not email.

Answer

Advanced Hunting

Answer

Alert queue filtering

Answer

Email entity page

Question 5

An organization uses Microsoft Purview Communication Compliance to detect insider trading. An alert is generated for a user who sent a message containing sensitive financial data. The compliance officer needs to initiate a legal hold on the user's mailbox to preserve evidence. Which role must the officer have to perform this action?

Accepted Answer

eDiscovery Manager (Legal Hold). Legal hold requires the 'Legal Hold' role in Microsoft Purview (eDiscovery). Communication Compliance roles alone do not include hold capabilities. Exchange Online roles may not have cross-functional hold.

Answer

Communication Compliance admin

Answer

Compliance Administrator (Global)

Answer

Exchange Online Mailbox Search role

Question 6

During an incident response, an analyst runs a live response command on a Windows device using Microsoft Defender for Endpoint. The command 'Get-Service -Name BITS' returns no output. What is the most likely cause?

Accepted Answer

The command is blocked due to PowerShell ConstrainedLanguage mode.. Live response uses a restricted PowerShell language mode (ConstrainedLanguage) which blocks many commands. Get-Service may not be available. The service might be stopped but still exist; permissions are usually fine.

Answer

The live response session has insufficient privileges.

Answer

The BITS service is disabled and hidden.

Answer

The BITS service is not installed on the device.

Question 7

An organization uses Microsoft Sentinel with the Microsoft Defender XDR connector. An incident is generated for a user who is suspected of being compromised. The analyst wants to automatically block the user's sign-ins using a playbook. Which connector should the playbook use?

Accepted Answer

Microsoft Entra ID connector. Microsoft Entra ID (Azure AD) connector allows updating user risk or disabling account. Microsoft 365 Defender is for alerts; Teams is for notifications; Sentinel connector is for ingestion.

Answer

Microsoft Sentinel connector

Answer

Microsoft 365 Defender connector

Answer

Microsoft Teams connector

Question 8

Refer to the exhibit. An automation rule is created in Microsoft Sentinel. A new incident is created with severity 'Medium' and two alerts: one 'High' and one 'Medium'. Will the playbook run?

Accepted Answer

Yes, because the incident contains a High severity alert.. The condition checks 'AlertSeverity', but an incident can have multiple alerts with different severities. The condition evaluates the incident's overall severity, which is set to the highest alert severity. Since there is a High alert, the incident severity becomes High, so condition is met.

Answer

No, because the incident severity is Medium.

Answer

Yes, because the playbook runs on all incidents regardless.

Answer

No, because the condition requires all alerts to be High.

Question 9

Which TWO actions are appropriate when handling a confirmed ransomware incident in Microsoft 365?

Accepted Answer

Isolate affected devices from the network.. Correct: Isolate affected devices to prevent spread, and change passwords for compromised accounts. Wrong: Paying ransom is not recommended; restoring from backup is good but not immediate; scanning with antivirus is reactive and may not remove all traces.

Answer

Run a full antivirus scan on all devices.

Answer

Restore encrypted files from backup immediately without investigation.

Answer

Pay the ransom to regain access.

Question 10

Which THREE elements are required to create a custom detection rule in Microsoft Sentinel?

Accepted Answer

A KQL query. A custom detection rule requires a KQL query to define logic, a schedule to run the query, and entity mapping to link results to incidents. Alert threshold is optional; playbook is separate.

Answer

An alert threshold

Answer

An automation playbook

Question 11

Which TWO tools in Microsoft Defender XDR provide automated investigation and response capabilities?

Accepted Answer

Microsoft Defender for Endpoint. Automated investigation and response (AIR) is available in Defender for Office 365 and Defender for Endpoint. Defender for Identity and Defender for Cloud Apps have some automation but not full AIR. Defender for Cloud is separate.

Answer

Microsoft Defender for Identity

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Cloud

Question 12

Which THREE conditions must be met for a Microsoft Sentinel incident to be automatically closed by a playbook?

Accepted Answer

The playbook must have the 'Microsoft Sentinel Incident' connector with 'Update incident' action.. The playbook must have a trigger for incident update, the rule must have automatic incident creation enabled, and the playbook must be assigned to the automation rule. Closing reason and classification are not required but may be set.

Answer

The incident must have a classification set.

Answer

The playbook must be triggered on incident creation.

Question 13

Refer to the exhibit. An analyst runs this Azure CLI command and receives no output. The workspace has many High severity incidents in 'New' status. What is the most likely reason?

Accepted Answer

The query syntax is incorrect; the pipe between conditions is invalid.. The JMESPath query uses '||' operator incorrectly; the correct syntax for filtering is '&&' or multiple filters. The query as written tries to combine two conditions with '|' which is not valid. Also the index [0] might be wrong if no matches, but the issue is the query syntax.

Answer

The analyst does not have read permissions for the workspace.

Answer

No incidents match both conditions.

Answer

The --query parameter is not supported for this command.

Question 14

You are investigating a security incident in Microsoft Sentinel where a user reported receiving a phishing email with a malicious attachment. You need to identify all users who received the same email within the last 24 hours. Which KQL query should you use?

Accepted Answer

EmailEvents | where SenderFromAddress == 'attacker@example.com' and Subject == 'Invoice' and Timestamp > ago(24h) | project RecipientEmailAddress. This KQL query filters the EmailEvents table by the attacker's sender address and the specific subject 'Invoice' within the last 24 hours, then projects the RecipientEmailAddress to list all users who received that email. Option A is incorrect because it filters by a specific recipient, which only returns that one user's record, not all recipients. Option B is incorrect because it uses EmailUrlInfo, which is for URL clicks, not email delivery; it would only show users who clicked a malicious URL. Option C uses EmailAttachmentInfo and filters by a filename, but this would only identify recipients of emails with that specific attachment; it may miss variations. Option D directly identifies all recipients of the phishing campaign by matching the sender and subject.

Answer

EmailEvents | where RecipientEmailAddress == 'user@contoso.com' and Timestamp > ago(24h) | project SenderFromAddress, Subject

Answer

EmailUrlInfo | where Url == 'http://malicious.com' | project RecipientEmailAddress

Answer

EmailAttachmentInfo | where FileName == 'malicious.doc' | project RecipientEmailAddress

Question 15

During a ransomware response in Microsoft Defender XDR, you identify that multiple devices are communicating with a known C2 server over port 443. You need to block this communication across all devices immediately. What is the most effective course of action?

Accepted Answer

Create a firewall rule to block outbound traffic to the C2 server IP address. Creating a firewall rule to block outbound traffic to the C2 server IP address is the most effective immediate action because it blocks communication at the network level, affecting all devices behind the firewall without requiring endpoint configuration. Option A is incorrect because the Tenant Allow/Block List in Defender for Office 365 only applies to email and collaboration, not network traffic. Option C is incorrect because an indicator in Defender for Endpoint with 'Alert and block' only blocks on endpoints that have the sensor, not all devices uniformly. Option D is incorrect because custom indicators in Defender for Cloud Apps apply only to cloud app traffic, not general network traffic.

Answer

Add the C2 server domain to the Microsoft Defender for Office 365 Tenant Allow/Block List

Answer

Create an indicator of compromise (IoC) in Microsoft Defender for Endpoint with action 'Alert and block'

Answer

Add the C2 server URL to the custom indicator list in Microsoft Defender for Cloud Apps