SC-200 Respond to security incidents Practice Test 26 — 15 Questions

Question 1

A security analyst detects a suspicious sign-in from an unusual location using Microsoft Entra ID. The user has not enabled MFA. Which action should the analyst take first to investigate and potentially contain the incident?

Accepted Answer

Disable the user account.. Disabling the user account is the immediate containment action to prevent further unauthorized access while investigation proceeds. Resetting password alone doesn't stop current session; blocking legacy auth is a broader action that may break legitimate services; MFA is enabling but not immediate containment.

Answer

Reset the user's password immediately.

Answer

Enable Conditional Access to block all sign-ins from that location.

Answer

Block legacy authentication for the entire tenant.

Question 2

An incident in Microsoft Defender XDR shows a device with high severity alert: 'Suspicious PowerShell command line.' The device is currently isolated from the network. What is the best next step to investigate the alert?

Accepted Answer

Run a live response session on the device.. Running a live response session allows the analyst to remotely investigate the isolated device, collect artifacts, or execute commands without risking lateral movement. Full scan is reactive; reviewing timeline is passive; restoring connectivity prematurely could spread the threat.

Answer

Review the device timeline for related alerts.

Answer

Restore network connectivity to allow the device to communicate with the cloud for analysis.

Answer

Initiate a full antivirus scan on the device.

Question 3

During a ransomware investigation, a security analyst finds that multiple files on a file server have been encrypted. The server runs Microsoft Defender for Cloud and has been onboarded to Microsoft Sentinel. Which data source in Sentinel would provide the most granular information about the file encryption events?

Accepted Answer

Microsoft Defender for Cloud (Azure Defender) alerts. Microsoft Defender for Cloud (formerly Azure Defender) provides file integrity monitoring and security events at the OS level. Sysmon via AMA would need specific configuration; Windows Security Events may not capture encryption; Azure Activity Log is for control plane events.

Answer

Azure Activity Log

Answer

Windows Security Events via MMA

Answer

Sysmon events via Azure Monitor Agent

Question 4

Refer to the exhibit. The KQL query runs in Microsoft Sentinel and returns no results. The analyst expects to see failed logon attempts. What is the most likely reason?

Accepted Answer

The ResultType field does not exist in IdentityLogonEvents.. The query filters on ResultType == 'Failed', but the field is likely named 'Result' or uses different values like 'Failure'. Also, the table 'IdentityLogonEvents' may not exist; it might be 'AADSignInEventsBeta' or similar. But the most common issue is incorrect field name for result type.

Answer

The Application filter is incorrect.

Answer

The summarize operator is misused.

Answer

The TimeRange variable is too short.

Question 5

A security operations center (SOC) analyst is investigating an incident involving a user who received a phishing email with a malicious macro. The analyst needs to determine if any other users received the same email. Which Microsoft 365 Defender feature should the analyst use?

Accepted Answer

Threat Explorer (Investigation). Threat Explorer in Microsoft 365 Defender allows hunting for email messages by sender, subject, or other attributes. Advanced Hunting is for raw queries; Email entity page shows one email; Alert queue filters by alert not email.

Answer

Advanced Hunting

Answer

Alert queue filtering

Answer

Email entity page

Question 6

An organization uses Microsoft Purview Communication Compliance to detect insider trading. An alert is generated for a user who sent a message containing sensitive financial data. The compliance officer needs to initiate a legal hold on the user's mailbox to preserve evidence. Which role must the officer have to perform this action?

Accepted Answer

eDiscovery Manager (Legal Hold). Legal hold requires the 'Legal Hold' role in Microsoft Purview (eDiscovery). Communication Compliance roles alone do not include hold capabilities. Exchange Online roles may not have cross-functional hold.

Answer

Communication Compliance admin

Answer

Compliance Administrator (Global)

Answer

Exchange Online Mailbox Search role

Question 7

During an incident response, an analyst runs a live response command on a Windows device using Microsoft Defender for Endpoint. The command 'Get-Service -Name BITS' returns no output. What is the most likely cause?

Accepted Answer

The command is blocked due to PowerShell ConstrainedLanguage mode.. Live response uses a restricted PowerShell language mode (ConstrainedLanguage) which blocks many commands. Get-Service may not be available. The service might be stopped but still exist; permissions are usually fine.

Answer

The live response session has insufficient privileges.

Answer

The BITS service is disabled and hidden.

Answer

The BITS service is not installed on the device.

Question 8

An organization uses Microsoft Sentinel with the Microsoft Defender XDR connector. An incident is generated for a user who is suspected of being compromised. The analyst wants to automatically block the user's sign-ins using a playbook. Which connector should the playbook use?

Accepted Answer

Microsoft Entra ID connector. Microsoft Entra ID (Azure AD) connector allows updating user risk or disabling account. Microsoft 365 Defender is for alerts; Teams is for notifications; Sentinel connector is for ingestion.

Answer

Microsoft Sentinel connector

Answer

Microsoft 365 Defender connector

Answer

Microsoft Teams connector

Question 9

Refer to the exhibit. An automation rule is created in Microsoft Sentinel. A new incident is created with severity 'Medium' and two alerts: one 'High' and one 'Medium'. Will the playbook run?

Accepted Answer

Yes, because the incident contains a High severity alert.. The condition checks 'AlertSeverity', but an incident can have multiple alerts with different severities. The condition evaluates the incident's overall severity, which is set to the highest alert severity. Since there is a High alert, the incident severity becomes High, so condition is met.

Answer

No, because the incident severity is Medium.

Answer

Yes, because the playbook runs on all incidents regardless.

Answer

No, because the condition requires all alerts to be High.

Question 10

Which TWO actions are appropriate when handling a confirmed ransomware incident in Microsoft 365?

Accepted Answer

Isolate affected devices from the network.. Correct: Isolate affected devices to prevent spread, and change passwords for compromised accounts. Wrong: Paying ransom is not recommended; restoring from backup is good but not immediate; scanning with antivirus is reactive and may not remove all traces.

Answer

Run a full antivirus scan on all devices.

Answer

Restore encrypted files from backup immediately without investigation.

Answer

Pay the ransom to regain access.

Question 11

Which THREE elements are required to create a custom detection rule in Microsoft Sentinel?

Accepted Answer

A KQL query. A custom detection rule requires a KQL query to define logic, a schedule to run the query, and entity mapping to link results to incidents. Alert threshold is optional; playbook is separate.

Answer

An alert threshold

Answer

An automation playbook

Question 12

Which TWO tools in Microsoft Defender XDR provide automated investigation and response capabilities?

Accepted Answer

Microsoft Defender for Endpoint. Automated investigation and response (AIR) is available in Defender for Office 365 and Defender for Endpoint. Defender for Identity and Defender for Cloud Apps have some automation but not full AIR. Defender for Cloud is separate.

Answer

Microsoft Defender for Identity

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Cloud

Question 13

Which THREE conditions must be met for a Microsoft Sentinel incident to be automatically closed by a playbook?

Accepted Answer

The playbook must have the 'Microsoft Sentinel Incident' connector with 'Update incident' action.. The playbook must have a trigger for incident update, the rule must have automatic incident creation enabled, and the playbook must be assigned to the automation rule. Closing reason and classification are not required but may be set.

Answer

The incident must have a classification set.

Answer

The playbook must be triggered on incident creation.

Question 14

Refer to the exhibit. An admin creates this activity policy in Microsoft Defender for Cloud Apps. What will happen when a user fails to log in from 3 different IP addresses within 10 minutes?

Accepted Answer

The user will be blocked only if the third IP is different from the first two.. The policy triggers when the count of different IPs for failed logins reaches 3 within 10 minutes. The action is to block the user. 'DifferentCount' means distinct IPs, not total attempts. So exactly 3 different IPs trigger it.

Answer

The policy will generate an alert but not block the user.

Answer

The user will be blocked immediately after the third failed login from any IP.

Answer

The user will be blocked after 10 minutes regardless of the number of IPs.

Question 15

Refer to the exhibit. An analyst runs this Azure CLI command and receives no output. The workspace has many High severity incidents in 'New' status. What is the most likely reason?

Accepted Answer

The query syntax is incorrect; the pipe between conditions is invalid.. The JMESPath query uses '||' operator incorrectly; the correct syntax for filtering is '&&' or multiple filters. The query as written tries to combine two conditions with '|' which is not valid. Also the index [0] might be wrong if no matches, but the issue is the query syntax.

Answer

The analyst does not have read permissions for the workspace.

Answer

No incidents match both conditions.

Answer

The --query parameter is not supported for this command.