SC-200 Respond to security incidents Practice Test 27 — 15 Questions

Question 1

During an incident response, you need to collect forensic evidence from a compromised Azure virtual machine that is currently offline. What is the most efficient method to acquire a disk snapshot for analysis while preserving the integrity of the evidence?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a snapshot of the OS disk from the Azure portal. Exporting a disk via AzCopy is not the most efficient forensic-sound method here because it requires first generating a SAS URL for the disk (e.g., via Grant-AzDiskAccess), which typically means the disk should not be attached to a running VM — the opposite of what this option implies. Even done correctly, going straight to an AzCopy export skips the read-only, platform-level point-in-time snapshot step, so any error or interruption during export risks touching the original disk. Taking a snapshot first (option B) is safer and is the standard first step; the snapshot can subsequently be exported with AzCopy for offline analysis if needed.

Answer

Attach a new data disk and copy the contents manually

Answer

Start the VM and use Azure Backup to take a backup

Answer

Export the disk to a storage account using AzCopy

Question 2

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You have a custom analytics rule that triggers on a Defender for Endpoint alert. When the rule triggers, a playbook is executed that creates an incident in Microsoft Sentinel and sends a message to a Teams channel. The playbook fails to execute. Which permission should you verify first?

Accepted Answer

The automation rule has the correct managed identity or connection permissions. The playbook executes as part of an automation rule triggered by a custom analytics rule. For the playbook to run successfully, the automation rule must have the correct permissions to invoke the playbook. This is typically configured via a managed identity (recommended) or a connection resource. Without this, the automation rule cannot trigger the playbook, regardless of other permissions.

Answer

The Teams channel has the appropriate permissions for incoming webhooks

Answer

The analyst has Microsoft Sentinel Reader role

Answer

The user has Microsoft Entra ID Global Administrator role

Question 3

Which TWO response actions are available in Microsoft Defender for Endpoint for a compromised device? (Choose two.)

Accepted Answer

Run a full antivirus scan. Options B and D are correct because Microsoft Defender for Endpoint includes predefined response actions such as running a full antivirus scan and isolating a device from the network. Option A is incorrect because disabling the user account is an identity mitigation action in Microsoft Entra ID, not a device response in Defender for Endpoint. Option C is incorrect because changing Windows Firewall rules is not a standard response action in Defender for Endpoint. Option E is incorrect because resetting a device to factory defaults is not a supported response action.

Answer

Disable the user account

Answer

Change the Windows Firewall rules

Answer

Reset the device to factory defaults

Question 4

Refer to the exhibit. A security analyst runs the KQL query in Microsoft Defender XDR to find devices running encoded PowerShell commands in the last hour. The query returns results showing a device named 'DESKTOP-123' with account 'jdoe'. The analyst suspects malicious activity. Which immediate next step should the analyst take?

Accepted Answer

Click on the result to open the full device timeline and analyze the process tree. When a KQL query in Microsoft Defender XDR returns suspicious results — such as encoded PowerShell commands on a device — the immediate next step is to investigate by clicking the result to open the full device timeline and analyze the process tree. This provides context on parent processes, command-line arguments, and related events to determine whether the activity is truly malicious before taking disruptive action.

Answer

Delete the query because it returned results

Answer

Modify the query to increase the time range to 24 hours

Answer

Isolate the device 'DESKTOP-123' from the network

Question 5

You are investigating a potential ransomware incident in Microsoft Defender XDR. The incident has a high severity alert indicating that a user installed a suspicious application. Which initial response action should you take to contain the threat while preserving evidence?

Accepted Answer

Isolate the device using Microsoft Defender for Endpoint.. Isolating the device using Microsoft Defender for Endpoint immediately stops lateral movement and data exfiltration while preserving forensic data. Option B is wrong because resetting the password and enforcing MFA does not contain the threat on the device itself. Option C is wrong because uninstalling the suspicious application may remove evidence needed for investigation. Option D is wrong because disabling the user account does not stop malware already running on the device.

Answer

Reset the user's password and enforce MFA.

Answer

Uninstall the suspicious application via Intune.

Answer

Disable the user account in Microsoft Entra ID.

Question 6

During a security incident, you need to collect email messages associated with a phishing campaign from multiple mailboxes in Microsoft 365. Which tool should you use to search and export these emails?

Accepted Answer

Content Search in the Microsoft Purview compliance portal.. Content Search in the Microsoft Purview compliance portal is the purpose-built tool for searching across Exchange mailboxes (and SharePoint/OneDrive) and exporting results to a PST or mailbox. It supports keyword queries, date ranges, sender/recipient filters, and bulk export across multiple mailboxes, which matches the phishing-campaign scenario.

Answer

Advanced Hunting in Microsoft Defender XDR.

Answer

Incident investigation in the Microsoft 365 Defender portal.

Answer

Mail Flow in the Exchange admin center.

Question 7

You are responding to a data exfiltration incident involving a user who copied sensitive files to a personal cloud storage service. The files were accessed from the user's managed device. Which Microsoft  Defender for Cloud Apps activity policy should you create to detect similar future incidents?

Accepted Answer

An activity policy that detects uploads to personal cloud storage services.. The incident involves a user copying sensitive files to a personal cloud storage service from a managed device. An activity policy in Microsoft Defender for Cloud Apps can be configured to detect specific activities, such as uploads to personal cloud storage services (e.g., Dropbox, Google Drive), by monitoring the 'Upload' event for recognized cloud apps. This directly addresses the detection of similar future incidents by alerting on the exact action (upload) to the specific service category (personal storage).

Answer

An anomaly detection policy that flags impossible travel.

Answer

A file policy that detects files shared with external users.

Answer

An app discovery policy that identifies new cloud apps used in the organization.

Question 8

Your organization uses Microsoft Sentinel with the Microsoft Defender XDR connector. You have a critical incident that involves multiple alerts across different services. The incident is being updated with new alerts. You need to ensure that a specific playbook runs only when the incident severity is updated to High. How should you configure the automation rule?

Accepted Answer

Set the trigger to 'When incident is updated' and add a condition on severity equals High.. The requirement is to run the playbook only when the incident severity is updated to High, so the automation rule must trigger on 'When incident is updated' and include a condition that severity equals High. This ensures the playbook fires on the severity change event rather than on creation or alert events.

Answer

Set the trigger to 'When an alert is created' and filter for alerts with High severity.

Answer

Set the trigger to 'When incident is created' and add a condition on severity equals High.

Answer

Configure the condition inside the playbook to check severity and exit if not High.

Question 9

During an incident response, you need to collect forensic evidence from a compromised Azure virtual machine that is currently offline. What is the most efficient method to acquire a disk snapshot for analysis while preserving the integrity of the evidence?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AzCopy to upload the data to Azure Blob Storage.. AzCopy, is the correct tool because it is designed for efficient, secure data transfer to Azure Blob Storage, supports Linux, and does not require a managed agent. Option A is incorrect because Azure CLI is a management tool, not optimized for large file uploads. Option C is incorrect because PowerShell is not natively installed on Linux typically, and Log Analytics works with structured log data, not arbitrary forensic files. Option D is incorrect because the Log Analytics agent forwards structured log data, not raw files.

Answer

Azure CLI to upload the data to an Azure Files share.

Answer

PowerShell to send the data to Log Analytics workspace.

Answer

The Log Analytics agent to forward the data.

Question 10

You are responding to a ransomware incident where multiple devices are encrypted. The incident is captured in Microsoft Sentinel. Which TWO actions should you take first to contain the incident?

Accepted Answer

Disable user accounts associated with the affected devices in Microsoft Entra ID.. Option A is correct because disabling the associated user accounts in Microsoft Entra ID immediately blocks the compromised identities from authenticating and prevents the attacker from using those credentials to move laterally or re-access resources during containment. Option B is correct because isolating affected devices through Microsoft Defender for Endpoint severs network communication while preserving the device state for forensic investigation, which is the standard first containment step for ransomware. Option C is not a first containment action; password resets are remediation steps that come after disabling accounts and can be performed later without stopping active spread. Option D is incorrect because malware analysis is a post-containment investigative activity, not an immediate containment measure. Option E is incorrect because restoring from backups is a recovery action and should only occur after the threat is fully contained and eradicated, otherwise restored data can be re-encrypted.

Answer

Reset passwords for all affected users.

Answer

Run a malware analysis on a sample of the ransomware.

Answer

Restore encrypted files from backups.

Question 11

You deploy this ARM template to a Microsoft Sentinel workspace. After deployment, you notice that the saved search does not appear as an analytics rule. What is the most likely reason?

Accepted Answer

The resource type is 'savedSearches', not 'scheduledQueryRules' or 'alertRules'.. In Azure Resource Manager, the resource type determines what kind of object is created. A 'savedSearches' resource creates a saved search query in Log Analytics/Sentinel, which is a reusable query definition — not an analytics rule. Analytics rules in Microsoft Sentinel are created using the 'scheduledQueryRules' resource type (or the older 'alertRules' type). Therefore, even though the template deployed successfully, the saved search will never appear as an analytics rule because it is a fundamentally different resource type.

Answer

The tags are incorrectly formatted.

Answer

The API version is incorrect.

Answer

The KQL query syntax is invalid.

Question 12

You are investigating a potential malicious PowerShell execution in Microsoft Defender for Endpoint using this KQL query in Advanced Hunting. The query returns no results. What is the most likely cause?

Accepted Answer

The table name should be 'DeviceProcessEvents' instead of 'DeviceEvents'.. The query uses the table 'DeviceEvents', which is incorrect for hunting process execution events. The correct table for process creation events in Microsoft Defender for Endpoint Advanced Hunting is 'DeviceProcessEvents'. 'DeviceEvents' contains other types of events (e.g., registry, file, network) but not process creation data, so the query returns no results.

Answer

The column names are incorrect; 'InitiatingProcessFileName' should be 'ParentProcessFileName'.

Answer

The 'take 100' operator limits results to only 100, but the query may return results if more data exists.

Answer

The query uses 'ago(7d)' which may be too short for historical data.

Question 13

Your security team receives an alert from Microsoft Defender for Endpoint indicating a suspicious PowerShell command was executed on a device. The command attempted to download a payload from a known malicious IP. After confirming the alert is a true positive, what should be your first containment step?

Accepted Answer

Isolate the device from the network using Microsoft Defender for Endpoint. Isolating the device via Microsoft Defender for Endpoint is the correct first containment step because it immediately cuts the endpoint off from the network while preserving the Defender agent's communication channel for further investigation and remediation. This stops lateral movement and C2 traffic from the compromised host without destroying forensic evidence. It is the standard 'contain first, investigate second' playbook for confirmed endpoint compromise.

Answer

Search for similar commands across all devices using advanced hunting

Answer

Disable the user account in Microsoft Entra ID

Answer

Reset the user's password

Question 14

During a ransomware incident, Microsoft Sentinel generated an incident with high severity. The incident includes alerts from Microsoft Defender for Endpoint, Microsoft Defender for Office 365, and Microsoft Entra ID. Your team needs to automate the containment process. What is the best approach to automatically isolate affected devices and disable compromised accounts?

Accepted Answer

Create an automation rule in Microsoft Sentinel that runs a playbook to isolate devices and disable accounts. The best approach is to create an automation rule in Microsoft Sentinel that triggers a playbook to isolate devices and disable accounts. Automation rules can be configured to run playbooks automatically when an incident is created, and the playbook can call Microsoft Defender for Endpoint to isolate devices and Microsoft Entra ID to disable accounts. This provides a centralized, automated containment workflow across multiple sources.

Answer

Use advanced hunting to find all affected devices and accounts

Answer

Create a custom detection rule in Microsoft Sentinel to trigger an incident

Answer

Configure automated investigation and response in Microsoft Defender for Endpoint

Question 15

Your organization uses Microsoft Sentinel with a workspace in the East US region. You need to respond to an incident involving data exfiltration from a virtual machine in West Europe. The incident was created from a custom analytics rule that queries the AzureActivity table. What should you do to ensure the incident contains all relevant evidence from the West Europe region?

Accepted Answer

Ensure that Azure activity logs from West Europe are streamed to the same Sentinel workspace in East US. To have the analytics rule in the East US workspace evaluate AzureActivity logs from West Europe, those logs must be collected into the same workspace. Streaming activity logs from West Europe to the East US workspace ensures all relevant data is available for the rule to query. Option A is incorrect because creating a separate workspace in West Europe would isolate the data, and the incident is in the East US workspace; cross-workspace queries would be required. Option C is incorrect because the analytics rule runs only in the workspace where it is defined; to query data from another workspace, you would need a cross-workspace query, but the rule is already defined in East US and cannot directly query the West Europe workspace without additional configuration. Option D is incorrect because incident merge is used to combine duplicate incidents within the same workspace, not across different workspaces.

Answer

Create the analytics rule in a separate workspace in West Europe

Answer

Configure the analytics rule to query the West Europe workspace

Answer

Use the incident merge feature to combine incidents from multiple workspaces