SC-200 Respond to security incidents Practice Test 27 — 15 Questions

Question 1

You are investigating a security incident in Microsoft Sentinel where a user reported receiving a phishing email with a malicious attachment. You need to identify all users who received the same email within the last 24 hours. Which KQL query should you use?

Accepted Answer

EmailEvents | where SenderFromAddress == 'attacker@example.com' and Subject == 'Invoice' and Timestamp > ago(24h) | project RecipientEmailAddress. The correct query uses EmailEvents table and filters by sender and subject. Option A is wrong because EmailAttachmentInfo does not contain recipient info. Option B is wrong because it would only show the specific user. Option D is wrong because EmailUrlInfo is for URLs, not attachments.

Answer

EmailEvents | where RecipientEmailAddress == 'user@contoso.com' and Timestamp > ago(24h) | project SenderFromAddress, Subject

Answer

EmailUrlInfo | where Url == 'http://malicious.com' | project RecipientEmailAddress

Answer

EmailAttachmentInfo | where FileName == 'malicious.doc' | project RecipientEmailAddress

Question 2

During a ransomware response in Microsoft Defender XDR, you identify that multiple devices are communicating with a known C2 server over port 443. You need to block this communication across all devices immediately. What is the most effective course of action?

Accepted Answer

Create a firewall rule to block outbound traffic to the C2 server IP address. Option C is correct because blocking the IOC at the firewall is immediate and network-wide. Option A is wrong because ISE actions are endpoint-only and may not cover all devices. Option B is wrong because this only affects endpoints, not network traffic. Option D is wrong because it only blocks at the proxy level, not all traffic.

Answer

Add the C2 server domain to the Microsoft Defender for Office 365 Tenant Allow/Block List

Answer

Create an indicator of compromise (IoC) in Microsoft Defender for Endpoint with action 'Alert and block'

Answer

Add the C2 server URL to the custom indicator list in Microsoft Defender for Cloud Apps

Question 3

You receive an alert in Microsoft Sentinel indicating a potential privilege escalation using the 'AzureHound' tool. You need to determine if the alert is a true positive. What is the first step you should take?

Accepted Answer

Check the user's recent activity and the targeted resource in Microsoft Entra ID audit logs. Option B is correct because the alert provides the user and resource details that should be verified. Option A is wrong because blocking the user may be premature. Option C is wrong because it's too broad. Option D is wrong because it doesn't investigate the specific alert.

Answer

Review the Microsoft Defender for Cloud recommendation for the resource

Answer

Block the user account immediately

Answer

Run a full antivirus scan on all devices

Question 4

You are reviewing this ARM template for a Microsoft Sentinel analytics rule. What is the most likely issue with the rule?

Accepted Answer

The query references a table that does not exist in Microsoft Sentinel. Option A is correct because the query uses 'IdentityInfo' table which is not a standard Sentinel table; it should be 'IdentityLogonEvents' or 'AuditLogs'. Option B is wrong because the syntax is valid. Option C is wrong because severity is valid. Option D is wrong because the rule type is correct.

Answer

The rule type is incorrect for this scenario

Answer

The query syntax is invalid

Answer

The severity property should be 'Informational'

Question 5

You are responding to an incident where a user's Microsoft Entra ID account was compromised and used to send phishing emails internally. You need to prevent further damage. Which two actions should you take first?

Accepted Answer

Revoke the user's sessions. Option A is correct because disabling the account stops immediate use. Option D is correct because revoking sessions ensures any active tokens are invalidated. Option B is wrong because resetting password is secondary. Option C is wrong because blocking external email is too broad. Option E is wrong because it's unnecessary for internal phishing.

Answer

Reset the user's password

Answer

Block all external email from the organization

Answer

Remove the user from all distribution groups

Question 6

Which THREE actions should you take when investigating a potential data exfiltration incident detected by Microsoft Defender for Cloud Apps?

Accepted Answer

Create a file policy to detect similar activities in the future. Option A is correct because governance actions can be applied to the user. Option C is correct because SIEM integration provides context. Option D is correct because file policies are key. Option B is wrong because MDI is for on-premises AD. Option E is wrong because cloud discovery is for shadow IT.

Answer

Check Microsoft Defender for Identity for related alerts

Answer

Run a cloud discovery report to identify unsanctioned apps

Question 7

Which TWO remediation actions are available in Microsoft Defender for Endpoint when responding to a malware infection?

Accepted Answer

Run a full antivirus scan. Option A is correct because Defender for Endpoint can run AV scan. Option B is correct because isolation is a common action. Option C is wrong because this is a post-remediation step. Option D is wrong because this is done in Microsoft Entra ID. Option E is wrong because this is for cloud apps.

Answer

Disable the user account

Answer

Reset the device to factory settings

Answer

Block the application in Defender for Cloud Apps

Question 8

You are reviewing this analytics rule in Microsoft Sentinel. What is the problem with this rule?

Accepted Answer

The query is missing a time range filter. Option C is correct because the query does not include a time filter, which would cause it to run on all historical data. Option A is wrong because the syntax is valid. Option B is wrong because the threshold is fine for matching. Option D is wrong because the aggregate is fine.

Answer

The aggregate function should be 'summarize' with 'dcount'

Answer

The trigger threshold should be set to 5

Answer

The query syntax is invalid

Question 9

A user reports that they cannot access their Microsoft 365 apps after clicking a link in an email. You suspect token theft. In Microsoft Defender XDR, which incident investigation action should you take first to verify the scope?

Accepted Answer

Review the user's sign-in logs in Microsoft Entra ID for anomalous locations. Option B is correct because reviewing sign-in logs reveals token usage from unusual locations. Option A is wrong because it's not about apps. Option C is wrong because email investigation is secondary. Option D is wrong because device isolation is not the first step.

Answer

Isolate the user's device from the network

Answer

Check the user's device for malware using Microsoft Defender for Endpoint

Answer

Investigate the email in Microsoft Defender for Office 365

Question 10

You are working on a security incident in Microsoft Sentinel where you need to contain a compromised virtual machine. What is the most immediate containment action?

Accepted Answer

Isolate the VM by applying a network security group (NSG) rule. Option A is correct because isolating the VM prevents lateral movement. Option B is wrong because patching is not immediate containment. Option C is wrong because a snapshot is for forensics. Option D is wrong because this is for endpoints.

Answer

Apply the latest security patches to the VM

Answer

Run a full antivirus scan on the VM

Answer

Take a snapshot of the VM for forensic analysis

Question 11

Which TWO data sources should you enable in Microsoft Sentinel to improve detection of credential theft attacks?

Accepted Answer

Windows Security Events (via AMA). Option A is correct because Windows Security Events contain credential theft logs. Option B is correct because Azure AD Sign-in logs show authentication patterns. Option C is wrong because firewall logs are network-level. Option D is wrong because DNS logs are not directly credential theft. Option E is wrong because performance counters are not security-related.

Answer

DNS logs

Answer

Windows Firewall logs

Answer

Performance counters

Question 12

Which THREE steps are part of the containment phase of incident response in a hybrid environment using Microsoft Defender XDR?

Accepted Answer

Disable compromised user accounts in Microsoft Entra ID. Option A is correct because isolation prevents spread. Option B is correct because disabling accounts stops credential misuse. Option D is correct because blocking IoCs is a containment action. Option C is wrong because this is eradication. Option E is wrong because this is recovery.

Answer

Remove malware from affected systems

Answer

Restore data from backups

Question 13

You are testing this analytics rule. It should detect encoded PowerShell commands not from System32, but it is generating false positives. What is the most likely cause?

Accepted Answer

The rule does not exclude other legitimate paths like SysWOW64. Option B is correct because the rule does not filter out other legitimate directories like SysWOW64. Option A is wrong because the syntax is correct. Option C is wrong because the rule should not include System32. Option D is wrong because the query is fine.

Answer

The severity should be Informational

Answer

The rule should also include System32

Answer

The query syntax is incorrect

Question 14

You are handling an incident where a user's account was used to access sensitive data from an unusual location. Microsoft Entra ID Identity Protection flagged the sign-in as risky. You need to determine if the account is compromised. Which investigation step should you perform first?

Accepted Answer

Review the sign-in details and compare with the user's typical behavior. Option C is correct because checking the user's recent activity provides context. Option A is wrong because force password reset may alert the attacker. Option B is wrong because blocking sign-in is premature. Option D is wrong because the device might be the user's personal device.

Answer

Block the user from signing in

Answer

Force a password reset for the user

Answer

Check if the device used is managed by Intune

Question 15

After a security incident, you need to preserve evidence from a compromised Microsoft 365 tenant. What is the best method to preserve data?

Accepted Answer

Place the user's mailbox and OneDrive on litigation hold. Option A is correct because litigation hold preserves all data. Option B is wrong because deletion is destructive. Option C is wrong because eDiscovery is for search, not preservation. Option D is wrong because backup is not immediate preservation.

Answer

Take a backup of the entire tenant

Answer

Use Microsoft Purview eDiscovery to search and export

Answer

Export the data to a PST file and delete the original