SC-200 Respond to security incidents Practice Test 28 — 15 Questions

Question 1

You receive a Microsoft Defender XDR incident alert about a suspicious sign-in from an unfamiliar location. The user confirms they did not perform the sign-in. What should you do to immediately secure the account?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Disable the user account in Microsoft Entra ID. Disabling the user account in Microsoft Entra ID immediately prevents any further sign-ins, including any active sessions that may have been established. Resetting the password (option B) alone does not terminate sessions if the attacker has already obtained tokens. Blocking the IP address (option C) is not effective because the attacker could use multiple IPs or proxy services. Requiring MFA registration (option D) does not stop the current compromise since the attacker may have already authenticated. Therefore, disabling the account is the most effective immediate step.

Answer

Reset the user's password

Answer

Block the IP address used for the suspicious sign-in

Answer

Require the user to register for Microsoft Entra Multi-Factor Authentication

Question 2

You are investigating an incident in Microsoft Sentinel where a PowerShell script was executed on multiple servers with suspicious parameters. The incident is high severity. You need to determine if the script is malicious and if lateral movement occurred. What should you do?

Accepted Answer

Run a custom KQL hunting query to find similar script executions on other machines. Custom KQL hunting queries can search across multiple workspaces and time ranges to find similar script executions on other machines, which helps identify lateral movement. Option A is incorrect because Microsoft Defender for Endpoint live response collects forensic data from individual machines but is not efficient for broad hunting across many servers. Option B is incorrect because restarting the servers would stop the script but destroy volatile evidence, hindering the investigation. Option C is incorrect because the incident timeline in Microsoft Sentinel shows only events related to the specific incident, not a custom search for similar executions across all machines.

Answer

Use Microsoft Defender for Endpoint live response to collect forensic data

Answer

Restart the affected servers to stop the script

Answer

Review the incident timeline in Microsoft Sentinel

Question 3

Your organization uses Microsoft Sentinel. An incident is created from an Azure Active Directory (now Microsoft Entra ID) sign-in alert. You need to determine if the sign-in was from a compromised token. What data source should you examine?

Accepted Answer

Sign-in logs in Microsoft Entra ID. Sign-in logs in Microsoft Entra ID contain detailed token information such as token issuer, session ID, and device details, which are essential for determining if a token was compromised. Option A is incorrect because audit logs track changes to directory objects, not sign-in details. Option B is incorrect because Azure Activity Log monitors Azure resource operations, not sign-in events. Option D is incorrect because Microsoft Defender for Cloud Apps logs focus on cloud application sessions and anomalies, but do not provide the granular sign-in token details found in sign-in logs.

Answer

Audit logs in Microsoft Entra ID

Answer

Azure Activity Log

Answer

Microsoft Defender for Cloud Apps logs

Question 4

A Microsoft Defender XDR incident shows that a user's device has been communicating with a known malicious C2 server. The device is online and the user is actively working. You need to contain the threat with minimal business disruption. What should you do?

Accepted Answer

Initiate device isolation from Microsoft Defender XDR. Initiating device isolation in Microsoft Defender XDR stops all network communication to and from the device while allowing the user to continue working locally, thus containing the threat with minimal business disruption. Option A is incorrect because disabling the switch port would require physical access to the network infrastructure and may not be feasible remotely. Option B is incorrect because shutting down the device remotely causes immediate disruption and loss of user productivity. Option C is incorrect because a full antivirus scan does not stop ongoing C2 communication and may allow the threat to continue spreading.

Answer

Remove the device from the network by disabling the switch port

Answer

Shut down the device remotely

Answer

Run a full antivirus scan on the device

Question 5

You are investigating a Microsoft Sentinel incident involving a user who clicked a phishing link. The incident includes alerts from Microsoft Defender for Office 365. You need to identify if any other users received the same phishing email. What should you do?

Accepted Answer

Use the Threat Explorer in Microsoft Defender for Office 365. The Threat Explorer in Microsoft Defender for Office 365 is a dedicated tool for investigating email threats, including phishing campaigns. It allows you to search for emails by subject, sender, or URL, enabling you to identify all recipients of a specific phishing email. Option A is incorrect because the incident graph in Microsoft Sentinel visualizes relationships between entities but does not provide email search capabilities. Option B is incorrect because the incident timeline shows events for the current incident only and cannot search for other recipients. Option C is incorrect because Advanced Hunting in Microsoft 365 Defender can be used but is more complex and less direct than Threat Explorer for this specific task.

Answer

Check the incident timeline for related alerts

Answer

Review the incident graph in Microsoft Sentinel

Answer

Run a KQL query in Advanced Hunting

Question 6

During a ransomware incident, you need to prevent the encryption of files in SharePoint Online and OneDrive for Business. You have already identified the compromised user account. What should you do?

Accepted Answer

Lock the compromised user account in Microsoft Entra ID. Locking the compromised user account in Microsoft Entra ID immediately revokes the attacker's access to SharePoint Online and OneDrive for Business, preventing further file encryption. Option A is incorrect because disabling external sharing does not stop an already authenticated user from encrypting files. Option C is incorrect because deleting the user's OneDrive files does not prevent the attacker from encrypting other files. Option D is incorrect because a retention policy only protects against deletion or modification, not encryption.

Answer

Disable external sharing for SharePoint Online

Answer

Delete the compromised user's OneDrive files

Answer

Apply a retention policy to all SharePoint sites

Question 7

Which TWO actions should you take when responding to a confirmed data exfiltration incident involving Microsoft 365? (Choose two.)

Accepted Answer

Revoke user sessions in Microsoft Entra ID. Options B and C are correct. When responding to a confirmed data exfiltration incident involving Microsoft 365, you should contain the threat by revoking user sessions in Microsoft Entra ID (option B) to prevent further unauthorized access, and investigate by reviewing audit logs in the Microsoft Purview compliance portal (option C) to determine the scope and impact of the exfiltration. Option A (resetting passwords for all users) is excessive and disruptive; instead, focus on resetting passwords for compromised accounts only. Option D (disabling all external sharing in SharePoint) is too broad and may disrupt legitimate business operations. Option E (blocking all access to the tenant) is premature and would cause significant operational disruption.

Answer

Reset passwords for all users

Answer

Disable all external sharing in SharePoint

Answer

Block all access to the tenant

Question 8

Which TWO are immediate containment actions in Microsoft Sentinel for a compromised Azure VM? (Choose two.)

Accepted Answer

Apply an NSG to block all inbound and outbound traffic. The correct answers are B (Apply an NSG to block all inbound and outbound traffic) and E (Stop the VM using an automation rule). Both are immediate containment actions to isolate the compromised VM. B restricts network access to prevent further data exfiltration or lateral movement. E stops the VM, halting any ongoing malicious processes. Option A (install anti-malware extension) is a remediation step, not immediate containment. Option C (reset password) does not stop active attacks and may interfere with investigation. Option D (initiate VM backup) is not containment and could preserve compromised data.

Answer

Install anti-malware extension

Answer

Reset the VM administrator password

Answer

Initiate a VM backup

Question 9

Which THREE resources can be used as data sources for Microsoft Sentinel to detect security incidents? (Choose three.)

Accepted Answer

Microsoft 365 Defender. Options A, B, and C are correct. Microsoft 365 Defender provides integrated threat signals across endpoints, email, and identities. Microsoft Defender for Cloud delivers security alerts and posture assessments for cloud workloads. Azure Activity Log captures subscription-level operational events, which can be streamed to Sentinel. Option D is incorrect because Azure Cost Management focuses on cost tracking and budgeting, not security events. Option E is incorrect because Azure Advisor provides optimization recommendations, not security incident data.

Answer

Azure Cost Management

Answer

Azure Advisor

Question 10

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. A critical incident has been generated from Microsoft Defender for Cloud indicating that a Linux VM in Azure is running a cryptocurrency miner. The VM is part of a production application and cannot be shut down immediately. The incident severity is High. You need to contain the threat while maintaining application availability, investigate the root cause, and prevent recurrence. The environment includes Azure Policy, Microsoft Defender for Endpoint on the VM, and a Log Analytics workspace. You must minimize manual steps. What course of action should you take?

Accepted Answer

Use Microsoft Sentinel automation to apply a block rule on the VM's network security group (NSG) to block outbound traffic to known mining pools, initiate Live Response to collect evidence, and create an Azure Policy to automatically deploy Microsoft Defender for Endpoint on all VMs. It uses Microsoft Sentinel automation to apply a network security group (NSG) rule to block outbound traffic to known mining pools, which contains the threat without disrupting the VM's availability for production traffic. Initiating Live Response on the VM allows collection of forensic evidence for investigation. Creating an Azure Policy to enforce Microsoft Defender for Endpoint deployment on all VMs helps prevent recurrence by ensuring all VMs have endpoint detection and response (EDR) capabilities. Option A is incorrect because remotely connecting and killing the process is a manual step that does not block the miner from restarting or communicating outbound, and it may not be immediately effective. Option B is incorrect because removing the VM from the load balancer alone does not stop the miner from running locally or potentially communicating via other routes, and Azure Policy for antivirus is insufficient for modern threats like miners. Option C is incorrect because stopping the VM immediately would disrupt production, and taking a snapshot then redeploying from backup does not address the immediate containment of the threat on the current VM.

Answer

Remotely connect to the VM and run a script to kill the miner process, then update antivirus definitions

Answer

Remove the VM from the load balancer, then use Azure Policy to enforce that all VMs have antivirus enabled

Answer

Stop the VM immediately, take a snapshot for forensic analysis, and then redeploy a clean VM from a backup

Question 11

Your organization uses Microsoft Sentinel. A security analyst reports that an incident was created for a sign-in from an unfamiliar location, but after investigation, it was determined to be a false positive. You need to ensure that similar sign-ins do not generate incidents in the future. What should you do?

Accepted Answer

Create a custom analytics rule with an alert suppression condition matching the sign-in attributes.. Creating a custom analytics rule with an alert suppression condition allows you to match specific sign-in attributes (e.g., location, IP) and suppress future alerts for similar events, preventing false positives from generating incidents. Option A is wrong because modifying a built-in Microsoft analytics rule is not recommended and could impact other detections; instead, you should create a custom rule or use alert suppression. Option B is wrong because closing an incident with a classification of False Positive only logs the outcome and does not prevent future similar alerts from generating incidents. Option C is wrong because automation rules handle automated responses (e.g., closing incidents) but do not suppress alert generation; suppression must be configured within the analytics rule itself.

Answer

Modify the built-in Microsoft analytics rule to exclude the sign-in location.

Answer

Close the incident with a classification of False Positive.

Answer

Create an automation rule that automatically closes similar incidents.

Question 12

Your company uses Microsoft Defender XDR. During a ransomware incident, you need to isolate a compromised Windows 10 device from the network while allowing connectivity to the Microsoft Defender for Endpoint service. Which action should you take?

Accepted Answer

Initiate a Full isolation from the device's action menu.. The correct action is to Initiate a Full isolation from the device's action menu. Full isolation blocks all network traffic except to the Microsoft Defender for Endpoint service, allowing the device to still communicate with Defender for reporting and updates. Option B (Contain the device) is not an isolation action; it prevents the device from communicating with other devices but allows some network traffic. Option C (Apply a firewall rule) would block all outbound traffic, preventing the device from reaching Defender services. Option D (Selective isolation) is not a valid isolation type in Microsoft Defender for Endpoint; only Full isolation is available.

Answer

Contain the device from the Microsoft Defender XDR portal.

Answer

Apply a firewall rule to block all outbound traffic.

Answer

Run a selective isolation to block only external connections.

Question 13

You are investigating a phishing incident in Microsoft Defender XDR. The user reported receiving an email with a malicious link. You need to identify all users who received the same email. Which feature should you use?

Accepted Answer

Threat Explorer. Threat Explorer in Microsoft Defender for Office 365 allows you to search and filter email messages by various attributes, including subject, sender, and recipients, to identify all users who received a specific email. Option B (Hunting) is for proactive threat hunting, not for investigating a known email. Option C (Incidents) shows aggregated alerts but not detailed email tracking. Option D (Automation) is for automated investigation and response.

Answer

Automation & investigations

Answer

Incidents view

Answer

Advanced Hunting

Question 14

Your organization uses Microsoft Sentinel. You receive an incident for a potential data exfiltration involving a sensitive blob storage container. You need to determine if the data was accessed from an unusual IP address. What should you do?

Accepted Answer

Use the Incident details pane to review the entity timeline.. The Incident details pane in Microsoft Sentinel includes entity timelines, which show activities related to the entities involved, such as IP addresses accessing the storage. Option A is wrong because modifying the analytics rule would change how future alerts are generated, not help with the current investigation. Option B is wrong because playbooks are for automated response, not for collecting information during investigation. Option C is wrong because workbooks are for custom dashboards and may not have the specific query needed for this incident.

Answer

Modify the analytics rule that triggered the incident.

Answer

Run a playbook to collect IP information.

Answer

Open the Sentinel workbook for storage monitoring.

Question 15

Your company uses Microsoft Defender for Cloud Apps. You discover that a user's account is compromised and used to access a sensitive SharePoint site from an unfamiliar IP. You need to immediately revoke the user's session and force them to re-authenticate. Which action should you take?

Accepted Answer

Apply a policy with the 'Revoke session' action.. The 'Revoke session' policy action in Defender for Cloud Apps terminates the user's current session and forces re-authentication. Option A (Suspend user) is too drastic and may disrupt legitimate access. Option C (Block IP) would block all users from that IP, which may not be desired. Option D (Notify user) is not immediate and does not stop the session.

Answer

Add the IP to the blocked IP addresses list.

Answer

Create a governance action to suspend the user.

Answer

Send a notification to the user to change their password.