SC-200 Respond to security incidents Practice Test 26 — 15 Questions

Question 1

You receive an alert in Microsoft Sentinel indicating a potential privilege escalation using the 'AzureHound' tool. You need to determine if the alert is a true positive. What is the first step you should take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Check the user's recent activity and the targeted resource in Microsoft Entra ID audit logs. The correct first step is to investigate the alert by checking the user's recent activity and the targeted resource in Microsoft Entra ID audit logs (the identity provider) to confirm if privilege escalation actually occurred. Option A is correct because it validates the alert before taking action. Option B is wrong because Defender for Cloud recommendations focus on security configurations and vulnerabilities, not on investigating a specific alert about AzureHound. Option C is wrong because blocking the user immediately could be premature if the alert is a false positive. Option D is wrong because running a full antivirus scan on all devices is not the first step for a privilege escalation alert; it's broad and unrelated to investigating the specific tool and user.

Answer

Review the Microsoft Defender for Cloud recommendation for the resource

Answer

Block the user account immediately

Answer

Run a full antivirus scan on all devices

Question 2

You are reviewing this ARM template for a Microsoft Sentinel analytics rule. What is the most likely issue with the rule?

Accepted Answer

The query references a table that does not exist in Microsoft Sentinel. The query references the 'IdentityInfo' table, which does not exist in Microsoft Sentinel. Standard tables for identity-related data include 'IdentityLogonEvents' or 'AuditLogs'. Option A is incorrect because the rule type (Scheduled) is appropriate for this scenario. Option B is incorrect because the query syntax is valid. Option D is incorrect because the severity property can be set to 'High' or other levels, not necessarily 'Informational'.

Answer

The rule type is incorrect for this scenario

Answer

The query syntax is invalid

Answer

The severity property should be 'Informational'

Question 3

You are responding to an incident where a user's Microsoft Entra ID account was compromised and used to send phishing emails internally. You need to prevent further damage. Which two actions should you take first?

Accepted Answer

Revoke the user's sessions. When a user's account is compromised and used to send phishing internally, the immediate priority is to stop ongoing malicious activity. Revoking the user's sessions (Option B) invalidates any active tokens and forces reauthentication, stopping the attacker's current access. Disabling the user account in Microsoft Entra ID (Option C) prevents any future sign-ins and further misuse. Resetting the password (Option A) is important but should follow session revocation to ensure the attacker cannot use existing sessions. Blocking all external email (Option D) is too broad and not directly targeted. Removing from distribution groups (Option E) may be done later but is not the first action.

Answer

Reset the user's password

Answer

Block all external email from the organization

Answer

Remove the user from all distribution groups

Question 4

Which THREE actions should you take when investigating a potential data exfiltration incident detected by Microsoft Defender for Cloud Apps?

Accepted Answer

Create a file policy to detect similar activities in the future. Creating a file policy in Defender for Cloud Apps allows you to detect similar exfiltration activities in the future by monitoring file sharing and access patterns. Option C is correct because integrating with Microsoft Sentinel enables you to correlate events across multiple sources and perform advanced hunting for related incidents. Option E is correct because reviewing the user's activity log in the Defender for Cloud Apps portal provides detailed audit of file access, downloads, and sharing that reveals the exfiltration. Option B is incorrect because Microsoft Defender for Identity focuses on on-premises Active Directory threats, not cloud app activities. Option D is incorrect because the cloud discovery report identifies unsanctioned apps in use, but is not a tool for investigating a specific exfiltration incident.

Answer

Check Microsoft Defender for Identity for related alerts

Answer

Run a cloud discovery report to identify unsanctioned apps

Question 5

Which TWO remediation actions are available in Microsoft Defender for Endpoint when responding to a malware infection?

Accepted Answer

Run a full antivirus scan. Microsoft Defender for Endpoint allows running a full antivirus scan as a remediation action for malware infections. Option E is correct because isolating the device from the network is a built-in remediation action to contain the threat and prevent lateral movement. Option B is incorrect because disabling the user account is an identity-related action typically performed in Microsoft Entra ID, not within MDE's remediation capabilities. Option C is incorrect because resetting to factory settings is not a standard remediation action in MDE; it would be a post-remediation step. Option D is incorrect because blocking the application in Defender for Cloud Apps is a cloud app security control, not a remediation action within Endpoint.

Answer

Disable the user account

Answer

Reset the device to factory settings

Answer

Block the application in Defender for Cloud Apps

Question 6

You are reviewing this analytics rule in Microsoft Sentinel. What is the problem with this rule?

Accepted Answer

The query is missing a time range filter. The query lacks a time range filter (e.g., '| where TimeGenerated > ago(7d)'), which would cause it to run against the entire historical dataset in Sentinel, leading to excessive resource usage and potential timeouts. Option B is wrong because the query correctly uses 'summarize' with 'dcount' as an aggregate; the syntax is valid and not the issue. Option C is wrong because the trigger threshold (e.g., 5) is not the problem—the rule could match correctly once a time filter is added. Option D is wrong because the query syntax is valid; the problem is the missing time filter, not invalid syntax.

Answer

The aggregate function should be 'summarize' with 'dcount'

Answer

The trigger threshold should be set to 5

Answer

The query syntax is invalid

Question 7

A user reports that they cannot access their Microsoft 365 apps after clicking a link in an email. You suspect token theft. In Microsoft Defender XDR, which incident investigation action should you take first to verify the scope?

Accepted Answer

Review the user's sign-in logs in Microsoft Entra ID for anomalous locations. The correct first action is to review the user's sign-in logs in Microsoft Entra ID for anomalous locations (Option A). This allows you to verify if the token is being used from unusual IP addresses or locations, which is a strong indicator of token theft. Isolating the device (B) is a containment step, not initial verification. Checking for malware (C) may be relevant later but does not directly confirm token theft. Investigating the email (D) is about the phishing vector, not the token usage.

Answer

Isolate the user's device from the network

Answer

Check the user's device for malware using Microsoft Defender for Endpoint

Answer

Investigate the email in Microsoft Defender for Office 365

Question 8

You are working on a security incident in Microsoft Sentinel where you need to contain a compromised virtual machine. What is the most immediate containment action?

Accepted Answer

Isolate the VM by applying a network security group (NSG) rule. In Microsoft Sentinel, immediately containing a compromised VM by isolating it (e.g., using a network security group rule) stops lateral movement, which is the priority. Option B is wrong because applying patches is a remediation step, not an immediate containment. Option C is wrong because running an antivirus scan is a detection or remediation step, not immediate containment. Option D is wrong because taking a snapshot is for forensic preservation, not containment.

Answer

Apply the latest security patches to the VM

Answer

Run a full antivirus scan on the VM

Answer

Take a snapshot of the VM for forensic analysis

Question 9

Which TWO data sources should you enable in Microsoft Sentinel to improve detection of credential theft attacks?

Accepted Answer

Windows Security Events (via AMA). (Windows Security Events via AMA) is correct because Windows Security Events log credential theft related events such as logon attempts, login failures, and account lockouts, which are crucial for detecting credential theft attacks. Option C (Azure Active Directory Sign-in logs) is correct because Azure AD Sign-in logs contain details of authentication attempts, including failed logins, impossible travel, and other anomalies that indicate credential theft. Option B (DNS logs) is incorrect because while DNS logs can help with threat detection, they are not directly used for credential theft attacks. Option D (Windows Firewall logs) is incorrect because firewall logs track network traffic but do not directly record credential theft. Option E (Performance counters) is incorrect because performance counters monitor system performance and are not security-related.

Answer

DNS logs

Answer

Windows Firewall logs

Answer

Performance counters

Question 10

Which THREE steps are part of the containment phase of incident response in a hybrid environment using Microsoft Defender XDR?

Accepted Answer

Disable compromised user accounts in Microsoft Entra ID. The containment phase focuses on stopping the spread of an incident. In a hybrid environment using Microsoft Defender XDR, disabling compromised user accounts in Microsoft Entra ID (formerly Azure AD) prevents further unauthorized access. Isolating affected devices using Microsoft Defender for Endpoint cuts off network communication to contain lateral movement. Blocking malicious IP addresses at the firewall stops inbound/outbound threats. These actions align with NIST SP 800-61 containment. Options A (removing malware) and B (restoring from backups) are part of eradication and recovery, not containment.

Answer

Remove malware from affected systems

Answer

Restore data from backups

Question 11

You are testing this analytics rule. It should detect encoded PowerShell commands not from System32, but it is generating false positives. What is the most likely cause?

Accepted Answer

The rule does not exclude other legitimate paths like SysWOW64. False positives occur because the rule excludes System32 but does not exclude other legitimate directories such as SysWOW64, where PowerShell is also installed. Encoded PowerShell commands from SysWOW64 trigger the alert, even though they are legitimate. Option A is incorrect because severity does not cause false positives. Option B is incorrect because including System32 would negate the rule's purpose. Option C is incorrect because the query syntax appears correct.

Answer

The severity should be Informational

Answer

The rule should also include System32

Answer

The query syntax is incorrect

Question 12

You are handling an incident where a user's account was used to access sensitive data from an unusual location. Microsoft Entra ID Identity Protection flagged the sign-in as risky. You need to determine if the account is compromised. Which investigation step should you perform first?

Accepted Answer

Review the sign-in details and compare with the user's typical behavior. The first step in investigating a risky sign-in is to review the sign-in details (location, time, device) and compare them with the user's typical behavior to assess whether it is indeed anomalous. This helps determine if the account is compromised or if it's a false positive. Option A is incorrect because blocking the user from signing in is a remedial action that should be taken after confirming compromise, not before investigation. Option B is incorrect because forcing a password reset is also a remediation step and may alert an attacker if the account is compromised; it should be done after investigation. Option C is incorrect because checking if the device is managed by Intune is part of the investigation but not the first step; the first step is to review the sign-in details themselves.

Answer

Block the user from signing in

Answer

Force a password reset for the user

Answer

Check if the device used is managed by Intune

Question 13

After a security incident, you need to preserve evidence from a compromised Microsoft 365 tenant. What is the best method to preserve data?

Accepted Answer

Place the user's mailbox and OneDrive on litigation hold. Placing the user's mailbox and OneDrive on litigation hold is the best method for preserving evidence because it preserves all data in its original state, preventing deletion or modification. Option A (backup of entire tenant) is excessive and not immediate. Option B (eDiscovery) is for search and export, not preservation. Option C (export to PST and delete) destroys the original evidence, which is inadvisable.

Answer

Take a backup of the entire tenant

Answer

Use Microsoft Purview eDiscovery to search and export

Answer

Export the data to a PST file and delete the original

Question 14

You are investigating a security incident in Microsoft Defender XDR where a user received a phishing email that bypassed Exchange Online Protection. The email contained a link to a credential harvesting page. After the user entered credentials, the attacker used them to sign in from an unusual location. You need to recommend an automated response to prevent further credential theft from similar emails. What should you implement?

Accepted Answer

Create an Attack Simulation Training campaign in Microsoft Defender for Office 365.. Attack Simulation Training in Microsoft Defender for Office 365 allows security teams to create and automate realistic phishing campaigns to train users, reducing the risk of credential theft from similar emails. Option B is wrong because Cloud App Security is focused on shadow IT discovery and controlling cloud app usage, not email-based phishing prevention. Option C is wrong because Safe Links protects users in real time by scanning and blocking malicious links in email, but it does not provide training or an automated response to prevent future credential theft. Option D is wrong because Conditional Access policies can block sign-ins from unusual locations as a reactive measure, but they do not prevent the credential theft from the phishing email itself.

Answer

Enable Cloud App Security to detect and block malicious cloud apps.

Answer

Enable Safe Links policy for all users.

Answer

Configure a Conditional Access policy to block sign-ins from unusual locations.

Question 15

You run the above KQL query in Microsoft Sentinel to detect potential brute-force attacks on Microsoft Teams. After reviewing the results, you notice that some entries have a high LogonCount but are missing from the output. What is the most likely reason?

Accepted Answer

The inner join excludes entries that do not have a corresponding risky sign-in event.. The inner join only returns rows that have matching AccountUpn and IPAddress in both tables. If high LogonCount entries do not have a corresponding risky sign-in event (RiskLevelDuringSignIn medium or high), they will be excluded. Option A is wrong because the query correctly spells 'RiskLevelDuringSignIn', so a misspelling is not the issue. Option B is wrong because the query filters by Application == 'Microsoft Teams', so it only considers Teams logons. Option D is wrong because the join condition includes both AccountUpn and IPAddress, not just AccountUpn.

Answer

The RiskLevelDuringSignIn field is misspelled as RiskLevelDuringSignIn.

Answer

The query only considers logons to Microsoft Teams, but the high LogonCount may be from other applications.

Answer

The join condition does not include AccountUpn, so it fails to match.