SC-200 Respond to security incidents Practice Test 27 — 15 Questions

Question 1

During a security incident response, you need to collect forensic evidence from a Windows 10 device that is suspected to be compromised. The device is not domain-joined and is located in a remote office. You have remote administrative access. Which Microsoft 365 tool should you use to acquire a memory dump of the device?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Defender for Endpoint. Microsoft Defender for Endpoint (MDE) includes Live Response capabilities that allow authorized administrators to remotely connect to a Windows 10 device and collect forensic data, including memory dumps. Option A is incorrect because Microsoft Sentinel is a SIEM and SOAR platform, not a tool for direct endpoint forensic collection. Option B is incorrect because Microsoft Purview eDiscovery is designed for content searches and legal holds in Microsoft 365, not live memory acquisition. Option C is incorrect because Microsoft Intune focuses on device management, policy enforcement, and application deployment, not live forensic evidence collection.

Answer

Microsoft Sentinel

Answer

Microsoft Purview eDiscovery

Answer

Microsoft Intune

Question 2

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You receive an alert about a suspicious sign-in from an IP address associated with a known malicious actor. The sign-in was for a privileged account. You need to immediately contain the incident. What should you do first?

Accepted Answer

Disable the user account in Microsoft Entra ID.. Disabling the user account in Microsoft Entra ID immediately stops the attacker from using the compromised credentials. Option A is wrong because resetting the password might not be fast enough if the attacker has an active session. Option C is wrong because creating an analytics rule does not contain the incident immediately; it only helps detect similar sign-ins in the future. Option D is wrong because blocking the IP address in the firewall is reactive and may not be effective if the attacker uses a different IP.

Answer

Reset the user's password.

Answer

Create a custom analytics rule in Sentinel to detect similar sign-ins.

Answer

Block the IP address in the firewall.

Question 3

You deploy the above ASR rule in Microsoft Defender for Endpoint. After deployment, you notice that .exe files are still being executed from Outlook attachments. What is the most likely reason?

Accepted Answer

The ASR rule is configured in audit mode instead of block mode.. Attack Surface Reduction (ASR) rules in Microsoft Defender for Endpoint can operate in either block mode or audit mode. By default, when a rule is defined without specifying the enforcement mode, it may default to audit mode. In audit mode, the rule generates logs but does not actually block the execution. Therefore, even though the rule is deployed, .exe files from Outlook attachments can still be executed if the rule is not set to block mode. Option A is incorrect because the rule is designed to block executable files from email attachments regardless of the initiating process, as long as the rule is properly configured. Option B is incorrect because the issue is with .exe files, not .vbs files; the rule could block .vbs if configured, but that does not explain why .exe files are not blocked. Option D is incorrect because fileExtension is a supported field in ASR rules; the rule syntax shown is valid.

Answer

The rule only applies when the initiating process is outlook.exe, but the attachment may be launched from another process.

Answer

The rule does not block .vbs files, which are also commonly used in attacks.

Answer

The rule is not applied because fileExtension is not a supported field in ASR rules.

Question 4

You are responding to a security incident involving a user who clicked on a malicious link in an email. The link led to a website that downloaded a file to the user's device. Microsoft Defender for Endpoint (MDE) detected the file as malware and blocked it. However, the user reports that the device is running slowly. You need to verify if there are any remnants of the malware. Which action should you take?

Accepted Answer

Initiate a live response session and run a PowerShell script to check for persistence mechanisms.. Initiating a live response session allows you to run a PowerShell script to check for persistence mechanisms, which is necessary to verify if any malware remnants remain on the device. Option A is wrong because the device is already onboarded to MDE. Option B is wrong because a full antivirus scan may not detect sophisticated remnants or persistence mechanisms. Option D is wrong because a full OS reinstall is too drastic and not necessary given that the malware was already blocked.

Answer

Re-onboard the device to MDE to ensure it's fully managed.

Answer

Run a full antivirus scan using Microsoft Defender Antivirus.

Answer

Perform a full OS reinstall to ensure the device is clean.

Question 5

Your organization uses Microsoft Sentinel and has enabled User and Entity Behavior Analytics (UEBA). During an incident investigation, you identify that a user account has been exhibiting anomalous behavior, such as logging in from multiple countries within a short time. You need to determine if the account is compromised and take appropriate action. What should you do first?

Accepted Answer

Review the UEBA insights for the user to understand the anomaly.. Reviewing UEBA insights is the first step in an investigation. UEBA provides risk scores, peer comparisons, and historical behavior patterns to assess whether the anomalous login activity indicates a compromise. Option A is incorrect because disabling the account without investigation can disrupt legitimate access if the behavior is not malicious. Option C is incorrect because creating an automation rule is a response action that should follow a confirmed compromise, not the initial step. Option D is incorrect because resetting the password is also a remediation step; it should be done after investigation to avoid unnecessary changes.

Answer

Disable the user account in Microsoft Entra ID.

Answer

Create a custom automation rule in Sentinel to disable the account on similar alerts.

Answer

Reset the user's password immediately.

Question 6

You run the above KQL query in Microsoft Sentinel to detect encoded PowerShell commands. The query returns no results, even though you know that some devices have executed encoded PowerShell commands. What is the most likely reason?

Accepted Answer

The query only looks for 'powershell.exe', but the command might have been run using 'pwsh.exe' or 'powershell_ise.exe'.. The query filters where FileName == 'powershell.exe', but encoded PowerShell commands can also be run using 'pwsh.exe' (PowerShell Core) or 'powershell_ise.exe'. If the process name is different, the query will not return results. Option A is incorrect because the DecodedCommand column could be empty if the query's logic is flawed, but the main issue is the process name filter. Option B is incorrect because base64_decode_tostring can decode PowerShell encoded commands. Option D is incorrect because DeviceProcessEvents does capture PowerShell process events.

Answer

The DecodedCommand column is empty because the ProcessCommandLine does not contain an encoded command.

Answer

The base64_decode_tostring function cannot decode PowerShell encoded commands.

Answer

The DeviceProcessEvents table does not contain PowerShell process events.

Question 7

You are investigating an incident where a user reported receiving a suspicious email with an attachment. The attachment is a .docm file that contains macros. The email was not blocked by Exchange Online Protection. You need to ensure that similar emails are blocked in the future. What should you configure?

Accepted Answer

Create a Safe Attachments policy that blocks .docm files.. A Safe Attachments policy in Microsoft Defender for Office 365 will scan attachments and block malicious ones, including .docm files with macros. Option A is wrong because Safe Links scans URLs, not attachments. Option C is wrong because anti-phishing policies protect against impersonation, not malicious attachments. Option D is wrong because transport rules can block attachments but are less effective than Safe Attachments for macro-based malware.

Answer

Create a Safe Links policy to block links in the email.

Answer

Create an anti-phishing policy to block the sender's domain.

Answer

Create a transport rule to block emails with .docm attachments.

Question 8

During a security incident response, you need to collect forensic data from multiple endpoints. Which TWO tools can be used to remotely collect forensic data from Windows devices in a Microsoft Defender for Endpoint environment? (Choose two.)

Accepted Answer

Microsoft Defender for Endpoint live response. Microsoft Defender for Endpoint live response (B) provides remote forensic data collection capabilities through its live response session. The Microsoft 365 Defender portal (C) aggregates alerts and incidents from Defender for Endpoint and allows access to live response from within the portal. Microsoft Sentinel UEBA (A) is for user and entity behavioral analytics, not data collection from endpoints. Microsoft Intune (D) is for device management and compliance. Microsoft Purview eDiscovery (E) is for legal discovery, not real-time forensic data collection from endpoints.

Answer

Microsoft Sentinel UEBA

Answer

Microsoft Intune

Answer

Microsoft Purview eDiscovery

Question 9

Your organization uses Microsoft Sentinel and has configured analytics rules for detecting ransomware. You receive an alert indicating possible ransomware activity on a server. Which THREE actions should you take to contain and investigate the incident? (Choose three.)

Accepted Answer

Initiate a live response session to collect forensic artifacts.. The correct actions to contain and investigate the incident are B, C, and E. Isolating the server (E) prevents further spread of ransomware. Reviewing the incident timeline in Microsoft 365 Defender (C) helps understand the attack sequence and affected assets. Initiating a live response session (B) allows collection of forensic artifacts for deeper investigation. Option A (create a new analytics rule) is for improving future detection, not for immediate containment. Option D (resetting the password) may be necessary later but is not a primary containment step and may not be sufficient if the attacker has local access.

Answer

Create a new analytics rule to detect similar behavior.

Answer

Reset the password of the account that showed anomalous behavior.

Question 10

You are investigating a security incident involving a compromised user account. The attacker used the account to access sensitive data in SharePoint Online. Which TWO actions should you take to remediate the incident? (Choose two.)

Accepted Answer

Revoke all refresh tokens for the user.. Revoking all refresh tokens immediately terminates the attacker's active sessions. Disabling the user account in Microsoft Entra ID prevents any further logins. Together, these actions stop the ongoing breach and secure the account.

Answer

Reset the user's password.

Answer

Review the sign-in logs to determine the extent of the breach.

Answer

Create a Conditional Access policy to require MFA for the user.

Question 11

Your Microsoft Sentinel workspace ingests logs from Microsoft Defender for Cloud and Microsoft 365 Defender. You need to create an incident response playbook that automatically responds to high-severity incidents. Which THREE components are required? (Choose three.)

Accepted Answer

An analytics rule that generates the incident. The correct components are: an analytics rule to generate the incident (B), an automation rule to trigger the playbook (C), and a Logic Apps workflow with Microsoft Sentinel trigger to define the automated response actions (E). Option A (workbook) is for visualization, not automation. Option D (hunting query) is for proactive threat hunting, not automatic incident response.

Answer

A workbook to visualize the incident data

Answer

A hunting query to search for similar activity

Question 12

You are investigating a potential data exfiltration incident in Microsoft Purview. A user has been downloading large amounts of data from a SharePoint site to an unmanaged device. Which TWO actions should you take to contain the exfiltration? (Choose two.)

Accepted Answer

Remove the user's permissions to the SharePoint site.. Removing the user's permissions immediately stops their access to the SharePoint site, preventing further data downloads. Option C is correct because creating a DLP policy that blocks downloads from unmanaged devices prevents the user from exfiltrating data to unauthorized devices. Option B is incorrect because applying a sensitivity label does not inherently restrict access; it may only apply classification and protection settings, but does not block downloads. Option D is incorrect because disabling the user's device in Intune does not stop the user from accessing data from another device or via a web browser. Option E is incorrect because retention policies are designed to preserve data for compliance, not to block downloads or contain exfiltration.

Answer

Apply a sensitivity label to the SharePoint site to restrict access.

Answer

Disable the user's device in Microsoft Intune.

Answer

Create a retention policy for the SharePoint site.

Question 13

Your organization uses Microsoft Defender for Office 365. A user reports receiving a phishing email that was not blocked by the service. You need to improve detection of similar phishing emails. Which TWO actions should you take? (Choose two.)

Accepted Answer

Submit the email to Microsoft for analysis using the Submissions page in Microsoft 365 Defender.. Submitting the email for analysis via the Submissions page helps Microsoft improve detection of similar phishing emails. Option E is correct because configuring an anti-phishing policy to protect against user impersonation can block similar phishing attempts. Option A is incorrect because Attack Simulation Training educates users but does not directly improve detection. Option B is incorrect because Safe Links is a feature for blocking malicious URLs in emails, not for detecting phishing emails based on content. Option D is incorrect because creating a mailbox rule is a client-side action and does not improve service-wide detection.

Answer

Create an Attack Simulation Training campaign.

Answer

Enable Safe Links for all users to block malicious URLs.

Answer

Create a mailbox rule to move similar emails to the Junk folder.

Question 14

You are investigating a potential ransomware incident detected by Microsoft Defender XDR. The incident shows multiple machines with suspicious encryption activity. You need to contain the threat immediately. What should you do first?

Accepted Answer

Initiate device isolation on affected machines from Microsoft Defender XDR. In a ransomware incident, immediate containment is critical. Device isolation from Microsoft Defender XDR disconnects the affected machines from the network, preventing the ransomware from spreading to other systems and stopping further encryption. This is the most effective first step. Running a full antivirus scan (B) is reactive and may not halt active encryption. Resetting passwords (A) or disabling user accounts (D) does not stop malware already executing on the endpoints. Therefore, initiating device isolation (C) is the correct initial action.

Answer

Reset the passwords of all users on the affected machines

Answer

Run a full antivirus scan on all endpoints

Answer

Disable the user accounts associated with the affected machines

Question 15

During a security incident, the Microsoft Sentinel workspace is receiving high volume of low-severity alerts causing analyst fatigue. You need to reduce noise while ensuring critical alerts are not missed. What should you configure?

Accepted Answer

Modify the incident creation rule to only create incidents for alerts with severity High or Medium. Incident creation rules can be configured to only create incidents for alerts with severity High or Medium, effectively filtering out low-severity noise while ensuring critical alerts are captured. Option A is wrong because disabling analytics rules would stop all alerts, including critical ones. Option B is wrong because changing severity to Informational would still create incidents if the rule is set to create incidents for all severities, and it does not reduce noise in the incident queue. Option C is wrong because automation rules trigger after incident creation, so they would not prevent the initial incident from being created, and automatically closing incidents can lead to missed critical alerts if not carefully scoped.

Answer

Disable analytics rules for low-severity alerts

Answer

Change the severity of low-severity alerts to Informational in the analytics rule

Answer

Create an automation rule to close low-severity incidents automatically