SC-200 Respond to security incidents Practice Test 26 — 15 Questions

Question 1

Refer to the exhibit. You run this KQL query in Microsoft Defender XDR to detect suspicious PowerShell activity. Why might this query generate many false positives?

Accepted Answer

Legitimate administrators often use encoded PowerShell commands.. Legitimate administrators often use encoded PowerShell commands, which would match this query and generate false positives. Option A is wrong because the time range shown in the exhibit (e.g., 7 days) is not excessively broad for hunting. Option B is wrong because the query is specific to encoded commands, but it does not miss attacks; it targets a specific technique. Option D is wrong because, while filtering by user could reduce noise, the main reason for false positives is that encoded commands are used legitimately, not because of the absence of user filtering.

Answer

The time range is too broad.

Answer

The query is too specific and misses many attacks.

Answer

The query does not filter by user.

Question 2

Your organization uses Microsoft Sentinel. A security incident is created, and the assigned analyst needs to perform initial triage. What is the first step the analyst should take according to Microsoft best practices for incident response?

Accepted Answer

Review the incident details and verify the alert is a true positive.. The first step in the Microsoft incident response process is to verify the alert and determine its validity. Option A is wrong because containment should follow after verification. Option B is wrong because escalating before verification bypasses triage. Option D is wrong because detailed investigation comes after initial triage.

Answer

Contain the affected resources immediately to prevent further damage.

Answer

Run a full investigation using Microsoft 365 Defender hunting queries.

Answer

Escalate the incident to the senior security team.

Question 3

Your organization uses Microsoft Purview Data Loss Prevention (DLP) and Microsoft Defender for Cloud Apps. During an incident, you discover that a user is exfiltrating sensitive data via a sanctioned cloud app. You need to block the user's ability to share files in that app immediately. What should you do?

Accepted Answer

Create a session policy in Microsoft Defender for Cloud Apps to block the user's file sharing activity.. To immediately block a user's file-sharing activity in a sanctioned cloud app, create a session policy in Microsoft Defender for Cloud Apps. Session policies use Conditional Access App Control to proxy the session and apply real-time controls such as block download, block upload, or block sharing for specific users or groups. This is the fastest, most targeted control for the described scenario.

Answer

Disable the app connector for that cloud app in Microsoft Defender for Cloud Apps.

Answer

Remove the user from the Microsoft Entra ID group that allows access to the cloud app.

Answer

Create a Microsoft Purview DLP policy to block sharing of sensitive content.

Question 4

Your team uses Microsoft Sentinel to manage incidents. You want to automatically assign incidents with a severity of 'High' to the Tier 2 security team. Which feature should you configure?

Accepted Answer

Automation rule. Automation rules in Microsoft Sentinel are designed to perform lightweight incident-level orchestration such as assigning owners, changing severity, adding tags, or closing incidents based on conditions. To auto-assign High-severity incidents to Tier 2, you create an automation rule with a condition on severity and an action to assign the owner. This is exactly the native, no-code mechanism for incident triage routing.

Answer

Playbook

Answer

Analytics rule

Answer

Workbook

Question 5

During an incident response, you need to collect email messages from a user's mailbox in Microsoft 365 for evidence. The user is suspected of phishing. Which Microsoft Purview solution should you use?

Accepted Answer

eDiscovery (Standard). Microsoft Purview eDiscovery (Standard) is designed for identifying, collecting, and preserving electronically stored information (ESI) such as email messages for legal or investigative purposes. It supports mailbox searches, holds, and export of evidence, making it the correct tool for collecting a user's mailbox during incident response.

Answer

Data Loss Prevention

Answer

Records Management

Answer

Audit (Standard)

Question 6

Refer to the exhibit. A security analyst runs this KQL query in Microsoft Sentinel during an investigation. The analyst expects to see alerts related to malware from IP 10.0.0.5 but receives no results. The SecurityAlert table contains data from the last 24 hours. What is the most likely reason for no results?

Accepted Answer

The ExtendedProperties column does not contain a key named 'IPAddress' for these alerts.. The most likely reason for no results is that the ExtendedProperties column does not contain a key named 'IPAddress' for these alerts. In Microsoft Sentinel, the SecurityAlert table stores additional alert details in the ExtendedProperties column as a dynamic (JSON) field, and the specific key name varies by alert provider — if the key is not 'IPAddress', the query filter returns nothing.

Answer

The 'contains' operator is case-sensitive.

Answer

The time filter 'ago(1d)' is too restrictive; should use 'ago(7d)'.

Answer

The 'project' statement drops the necessary columns.

Question 7

Your organization is responding to a ransomware incident. Which TWO actions should be taken first to contain the incident while preserving forensic evidence?

Accepted Answer

Isolate affected devices using Microsoft Defender for Endpoint.. Option A is correct because isolating affected devices through Microsoft Defender for Endpoint (using the "Isolate device" action) severs network communication while keeping the device powered on, so volatile memory and forensic artifacts remain intact for investigation. Option C is correct because disabling compromised user accounts in Microsoft Entra ID immediately blocks the attacker's ability to authenticate, move laterally, or access cloud resources, and it is a reversible containment step that preserves sign-in and audit logs as evidence. Option B is not appropriate as a first action because a blanket password reset across all users is disruptive, does not stop an active session or token-based access, and can destroy or complicate evidence of which accounts were actually compromised. Option D is wrong because a factory reset wipes the device and destroys the forensic evidence needed for the investigation. Option E is wrong because shutting down network switches disrupts the entire segment and business operations, and powering off systems can lose volatile evidence, making it a disproportionate and evidence-destructive containment measure.

Answer

Reset passwords for all users in the organization.

Answer

Perform a factory reset on all affected devices.

Answer

Shut down network switches to isolate the network segment.

Question 8

A security analyst is investigating a potential data exfiltration incident in Microsoft Sentinel. The analyst needs to identify which users may have been compromised. Which THREE data sources should be queried to gather the most relevant evidence?

Accepted Answer

SigninLogs and AuditLogs from Microsoft Entra ID.. SigninLogs and AuditLogs from Microsoft Entra ID (C) are essential because SigninLogs reveal authentication anomalies such as impossible-travel or risky sign-ins tied to compromised accounts, while AuditLogs capture directory changes like new credentials or permission grants made by an attacker. OfficeActivity from Microsoft 365 (D) is correct because it records user and admin actions across Exchange, SharePoint, OneDrive, and Teams, exposing mail-forwarding rules, mass downloads, or file-sharing activity typical of exfiltration. CloudAppEvents from Microsoft Defender for Cloud Apps (E) is correct because it provides granular SaaS activity, including file downloads, uploads, and sharing events across connected cloud apps that reveal data movement. WindowsEvent from Defender for Endpoint (A) is endpoint telemetry focused on device-level process and file events, not user identity or cloud-service activity, so it is less directly relevant to identifying compromised users. AzureActivity from Azure Monitor (B) logs control-plane operations on Azure resources (e.g., role assignments, resource deployments) and does not capture the identity, mail, or SaaS activity needed here.

Answer

WindowsEvent from Microsoft Defender for Endpoint.

Answer

AzureActivity from Azure Monitor.

Question 9

Your organization uses Microsoft 365 Defender. During an incident, which TWO actions can be taken directly from the Microsoft 365 Defender portal to remediate a compromised email account?

Accepted Answer

Soft delete malicious emails from the user's mailbox.. Option C is correct because the Microsoft 365 Defender portal (via the Email & collaboration > Explorer/Threat Explorer remediation actions) lets responders soft delete malicious emails from a user's mailbox, moving them to the Recoverable Items folder so they can be purged or restored. Option D is correct because the portal's action center and user investigation page provide 'Reset password' and 'Revoke sessions' actions, which force a password change and invalidate existing authentication tokens to cut off an attacker's access. Option A is not a direct remediation action offered in the Defender portal for a compromised account, and mailbox delegation is managed through Exchange admin center/PowerShell. Option B is a preventive tenant-level allow/block list change, not an account remediation action, and it targets a sender address rather than the compromised mailbox. Option E is not a supported action; mail flow cannot be selectively 'isolated' for a mailbox from the Defender portal.

Answer

Remove mailbox delegation permissions.

Answer

Block the sender's email address in the tenant's allow/block list.

Answer

Isolate the user's mailbox from receiving emails.

Question 10

Your organization uses Microsoft Sentinel and Microsoft Defender for Cloud. During a security incident involving a compromised Azure VM, which THREE actions are appropriate to contain and investigate the incident?

Accepted Answer

Use Microsoft Defender for Cloud's Just-in-Time VM access to isolate the VM.. Microsoft Defender for Cloud's Just-in-Time VM access can be used to lock down inbound traffic to the VM, effectively isolating it from the network while preserving the VM for forensic analysis. This action reduces the attack surface and prevents lateral movement without destroying evidence, which is critical during incident response.

Answer

Delete the compromised VM to prevent further damage.

Answer

Update the VM's operating system to the latest patch.

Question 11

Refer to the exhibit. You are reviewing a Microsoft Sentinel automation rule definition. The rule is intended to automatically change the severity to High, assign to tier2, and set status to Active for incidents triggered by alerts containing 'malware'. However, incidents are not being updated. What is the most likely cause?

Accepted Answer

The trigger type should be 'IncidentCreated', not 'AlertRule'.. Microsoft Sentinel automation rules are triggered by incident-related events, and the correct trigger for acting on newly created incidents is 'Incident created' (IncidentCreated). If the rule is configured with an 'Alert rule' trigger, it fires on alert creation rather than incident creation, so the actions (change severity, assign owner, set status) never execute against the incident object — which is why incidents remain unchanged. Automation rules operate on incidents, not raw alerts, so the trigger must match the incident lifecycle.

Answer

The action configuration is missing the 'incident' property.

Answer

The condition operator 'Contains' is incorrect; should be 'Equals'.

Answer

The playbook requires a managed identity to run.

Question 12

Your security team is investigating a suspicious sign-in from an unfamiliar IP address. The user has Microsoft Entra ID P2 licenses and is assigned a Conditional Access policy that requires MFA for all cloud apps. During the incident response, you find that the sign-in succeeded despite the user not completing MFA. Which action should you take first to investigate the discrepancy?

Accepted Answer

Review the Microsoft Entra sign-in logs for the specific sign-in event. Reviewing the Microsoft Entra sign-in logs for the specific sign-in event is the first step because it provides detailed information about the sign-in, including whether MFA was required, satisfied, or bypassed. This log will show the conditional access policy evaluation and any anomalies, helping to identify why MFA was not enforced.

Answer

Review the user risk detection in Microsoft Entra ID Protection

Answer

Check the Microsoft Entra audit logs for policy changes

Answer

Use the Conditional Access What If tool

Question 13

During a ransomware incident, a security analyst needs to isolate an affected Windows 10 device managed by Microsoft Intune. The device is currently online and connected to the corporate network. Which remediation action should be taken from Microsoft Defender XDR to achieve this?

Accepted Answer

Initiate device isolation from the Microsoft Defender for Endpoint console. Device isolation from the Microsoft Defender for Endpoint console (accessible via Microsoft Defender XDR) immediately cuts the device off from the network while preserving the Defender communication channel, allowing the analyst to investigate and remediate without losing contact with the endpoint. This is the purpose-built ransomware containment action.

Answer

Block the device in Microsoft Intune

Answer

Disable the Windows Firewall via Intune

Answer

Run a full antivirus scan from Microsoft Defender for Endpoint

Question 14

Your organization uses Microsoft Sentinel. You receive a high-severity incident indicating a potential data exfiltration from an Azure Storage account. The incident contains entities such as IP addresses and user accounts. Which step should you perform first to contain the threat?

Accepted Answer

Investigate the incident to confirm the activity is malicious. In Microsoft Sentinel, the first step after receiving a high-severity incident is to investigate and confirm whether the activity is truly malicious. This triage step prevents unnecessary containment actions that could disrupt legitimate business operations. Only after confirming the threat should you proceed with containment measures like blocking IPs or disabling accounts.

Answer

Contact the user associated with the storage account

Answer

Block the suspicious IP address in the Azure Firewall

Answer

Disable the storage account

Question 15

An analyst in your SOC receives a Microsoft Defender for Cloud Apps alert indicating a suspicious Power Automate flow that is forwarding emails to an external domain. The analyst needs to disable the flow immediately. Which action should they take?

Accepted Answer

Use the governance action in Microsoft Defender for Cloud Apps to disable the flow. Microsoft Defender for Cloud Apps (MDCA) provides governance actions directly on discovered app activities, including the ability to disable a Power Automate flow from within the alert. This is the fastest, most targeted remediation because it acts on the specific flow rather than broader controls.

Answer

Block the external domain in Exchange Online mail flow rules

Answer

Remove the flow from the Microsoft 365 admin center

Answer

Disable the user account in Microsoft Entra ID