SC-200 Respond to security incidents Practice Test 28 — 15 Questions

Question 1

Refer to the exhibit. You have created an automation rule in Microsoft Sentinel with the above configuration. The playbook isolates the device and disables the user account. After enabling the rule, you notice that a low-severity incident containing an alert titled 'Ransomware Behavior' did NOT trigger the automation. What is the most likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The incident severity is Low, but the rule only triggers on High severity. Microsoft Sentinel automation rules have a condition set that includes severity; if the rule is configured to trigger only on High-severity incidents, a Low-severity incident will never fire the rule regardless of the alert title. The exhibit shows the rule's conditions, and the most likely mismatch is the severity filter. The playbook itself is not the issue because the rule simply never evaluated to true for this incident.

Answer

The 'ContainsAny' operator does not match single values

Answer

The automation rule does not have permission to run the playbook

Answer

The playbook ID is invalid

Question 2

Which TWO are recommended first steps when responding to a confirmed ransomware incident in Microsoft Defender XDR?

Accepted Answer

Isolate affected devices using Microsoft Defender for Endpoint. The correct answers are D and E. Isolating affected devices using Microsoft Defender for Endpoint (D) and revoking user sessions to require reauthentication (E) are immediate containment steps to prevent further spread. Assessing financial impact (A) is part of investigation, not first response. Disabling all user accounts (B) is too disruptive and not recommended as a first step. Running a full antivirus scan (C) may alert the attacker and is not a containment measure.

Answer

Assess the financial impact of the incident

Answer

Disable all user accounts

Answer

Run a full antivirus scan on all devices

Question 3

Refer to the exhibit. You are configuring a Microsoft Sentinel scheduled analytics rule with the above incident creation settings. What is the effect of setting 'groupingConfiguration.enabled' to false?

Accepted Answer

Each alert will generate a separate incident. When groupingConfiguration.enabled is set to false in a Microsoft Sentinel scheduled analytics rule, the alert-grouping logic is disabled entirely. This means Sentinel will not bundle multiple alerts from a single rule run into one incident; instead, every individual alert generated by the query produces its own distinct incident. This is useful when each alert requires separate triage or when alerts represent unrelated events that should not be merged.

Answer

Alerts will be suppressed for 5 minutes

Answer

The rule will run every 5 minutes

Answer

No incidents will be created

Question 4

You are investigating an incident in Microsoft Defender XDR that involves a user who clicked a link in a phishing email. The email was detected and blocked by Microsoft Defender for Office 365, but the user still clicked the link before it was blocked. The incident includes an alert for 'Malicious URL click'. What additional information should you check to determine if the user's credentials were compromised?

Accepted Answer

Check for sign-in events from unusual locations or anonymous IP addresses after the click. The 'Malicious URL click' alert confirms the user interacted with the phishing link, but it does not confirm credential theft. The definitive indicator of compromise is a subsequent successful authentication using those credentials from an anomalous source. Checking Microsoft Entra ID sign-in logs (via Defender XDR's Advanced Hunting with AADSignInEventsBeta or the Entra sign-in log) for sign-ins from unusual geolocations, anonymous proxies (e.g., Tor exit nodes), or unfamiliar IPs immediately after the click timestamp reveals whether the attacker actually used the harvested credentials.

Answer

Check if the link was blocked by the time the user clicked

Answer

Check if the user has recently changed their password

Answer

Check if the email had any attachments

Question 5

Refer to the exhibit. You run this KQL query in Microsoft 365 Defender advanced hunting to investigate an incident involving IP address 203.0.113.1. The query returns results, but you need to also see which devices communicated with this IP. How should you modify the query?

Accepted Answer

Join with DeviceNetworkEvents on DeviceId where RemoteIP == "203.0.113.1". The goal is to find which devices communicated with the suspicious IP 203.0.113.1. DeviceNetworkEvents is the advanced hunting table that records network connections from devices, including the RemoteIP field. Joining on DeviceId and filtering where RemoteIP equals the target IP directly surfaces the devices that contacted it.

Answer

Join with IdentityLogonEvents on AccountUpn

Answer

Join with DeviceInfo on DeviceId

Answer

Join with EmailEvents on AlertId

Question 6

A SOC analyst is reviewing an incident in Microsoft Sentinel that involves a user receiving a phishing email with a malicious attachment. The attachment was opened on a device managed by Microsoft Intune. Which Microsoft Defender XDR component would have provided the earliest detection of the malicious file?

Accepted Answer

Microsoft Defender for Endpoint. Microsoft Defender for Endpoint (MDE) provides the earliest detection of malicious files at the endpoint level. When the user opens the malicious attachment on an Intune-managed device, MDE's real-time protection (antivirus and behavior monitoring) scans the file immediately upon execution or write, blocking the threat before it can execute further. This is faster than cloud-based or email-level detections because the file is already on the device.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Office 365

Answer

Microsoft Purview Data Loss Prevention

Question 7

An organization uses Microsoft Sentinel and Microsoft Defender XDR. A critical incident is created when a user is detected as compromised. The incident severity is set to High. The SOC manager wants to ensure that all incidents with severity High or above are automatically assigned to the senior analyst tier. What should the analyst configure?

Accepted Answer

Define an automation rule to assign incidents based on severity.. Microsoft Sentinel automation rules are designed to trigger on incident creation and perform actions such as assigning owners, changing severity, adding tags, or running playbooks. To automatically assign all High-or-above incidents to the senior analyst tier, an automation rule with a severity condition and an 'Assign owner' action is the correct mechanism.

Answer

Set a playbook to run when an incident is created.

Answer

Create an analytics rule with a custom severity.

Answer

Configure an alert tuning rule.

Question 8

A company uses Microsoft Defender XDR and has enabled automatic attack disruption for human-operated ransomware. During an incident, the system automatically contains a compromised account. However, the SOC team wants to ensure that the containment action is reversible and that the account can be restored after investigation. What should the team do before restoring the account?

Accepted Answer

Change the account's password and enable multi-factor authentication.. After automatic containment disables a compromised account, the SOC team must change its password and enable multi-factor authentication before restoring it. This ensures the attacker cannot regain access with stolen credentials. Option B is a good practice but not a prerequisite for restoring this specific account. Option C is unnecessary if the account was not an administrator. Option D is irrelevant because containment applies to the account, not devices.

Answer

Verify that no other accounts were compromised.

Answer

Remove the account from all administrative roles.

Answer

Run a full antivirus scan on the account's devices.

Question 9

A SOC analyst is using Microsoft Sentinel to investigate an incident involving a user who accessed a sensitive database from an unusual location. The analyst wants to find all activities performed by this user within the last 24 hours from multiple data sources. Which KQL operator should the analyst use to combine the results of two queries that return different schemas?

Accepted Answer

union. The union operator in KQL combines the results of two or more queries that may have different schemas, appending rows and filling missing columns with nulls. This is exactly what the analyst needs to pull user activity from multiple data sources (e.g., SigninLogs, AuditLogs, OfficeActivity) into a single result set for the last 24 hours. join, by contrast, requires matching columns and merges rows horizontally.

Answer

summarize

Answer

join

Answer

where

Question 10

Which TWO actions should a SOC analyst take immediately after confirming a ransomware incident in Microsoft Defender XDR?

Accepted Answer

Isolate affected devices from the network.. Option A is correct because isolating affected devices in Microsoft Defender XDR (via the device isolation action) immediately stops lateral movement, command-and-control communication, and further encryption by cutting the host off from the network while preserving the ability to investigate remotely. Option D is correct because ransomware actors commonly obtain and reuse compromised credentials, so resetting passwords for affected accounts and enforcing MFA revokes the attacker's access and prevents re-entry or persistence through valid accounts. Option B is not an immediate containment action; restoring from backups should occur only after the threat is contained and the environment is verified clean, otherwise restored data can be re-encrypted. Option C is too broad and destructive — disabling all mailboxes organization-wide is not a proportionate or standard ransomware response and would disrupt business without addressing the root compromise. Option E, collecting a full memory dump, is a forensic step that may be valuable later but is not one of the two immediate containment and credential-remediation actions required upon confirmation.

Answer

Begin restoring data from backups.

Answer

Disable all mailboxes in the organization.

Answer

Collect a full memory dump from each affected device.

Question 11

Refer to the exhibit. A SOC analyst runs this Advanced Hunting query in Microsoft Defender XDR to detect potential living-off-the-land (LotL) attacks. An alert is triggered when a device shows multiple occurrences of 'mshta.exe' executing with a remote script. Which additional data source should the analyst check to confirm the attack?

Accepted Answer

DeviceNetworkEvents. DeviceNetworkEvents would show network connections made by mshta.exe to remote hosts, confirming the LotL attack. The other options are not directly relevant or are redundant.

Answer

DeviceFileEvents

Answer

DeviceLogonEvents

Answer

DeviceRegistryEvents

Question 12

An organization uses Microsoft Defender for Cloud Apps to detect anomalous behavior. An alert indicates that a user has signed in from an impossible travel scenario. The SOC analyst confirms the alert is a false positive due to a VPN. What should the analyst do to prevent future false positives for this user?

Accepted Answer

Add the VPN IP range to the trusted IP addresses in Defender for Cloud Apps.. The correct action is to add the VPN IP range to the trusted IP addresses in Defender for Cloud Apps (D). Trusted IP addresses are excluded from impossible travel and other anomalous location detections, so legitimate VPN egress IPs will not trigger false positives. This is a targeted, user-impacting fix that preserves detection for other scenarios. Changing Entra ID location or disabling the rule are not appropriate.

Answer

Change the user's location in Microsoft Entra ID.

Answer

Ignore the alert and continue monitoring.

Answer

Disable the impossible travel detection rule.

Question 13

A SOC team uses Microsoft Sentinel and wants to automatically enrich incidents with threat intelligence from a third-party feed. Which feature should they configure to ingest the threat intelligence and correlate it with alerts?

Accepted Answer

Threat intelligence connectors. Threat intelligence connectors in Microsoft Sentinel allow ingestion of TI feeds and enable correlation with alerts. The other options do not provide this capability.

Answer

Analytics rules

Answer

Data connectors

Answer

Watchlists

Question 14

During an incident response, your team identifies a suspicious PowerShell command executed on multiple devices. Which Microsoft Defender XDR feature should you use to block the command across all endpoints immediately?

Accepted Answer

Indicators of compromise (IoC). Microsoft Defender XDR's Indicators of compromise (IoC) allow creating custom indicators to block file hashes, IPs, URLs, or commands across endpoints. Option A is wrong because Potentially Unwanted Application (PUA) protection targets unwanted software, not specific commands. Option C is wrong because Attack Surface Reduction (ASR) rules are designed to block common attack patterns, not ad-hoc commands. Option D is wrong because Device Control policies manage peripheral devices like USB drives.

Answer

Potentially Unwanted Application (PUA) protection

Answer

Attack Surface Reduction (ASR) rules

Answer

Device Control policies

Question 15

Your Microsoft Sentinel workspace is receiving a high volume of false positive alerts from a specific analytics rule. You need to suppress these alerts without disabling the rule. Which feature should you use?

Accepted Answer

Configure alert suppression in the analytics rule. Alert suppression in a Microsoft Sentinel analytics rule lets you define conditions (such as matching entity, IP address, or account) under which subsequent matching alerts are suppressed for a configurable time window. This stops the false-positive noise without turning off the rule, so genuine detections from other entities or conditions still fire. It is configured directly on the analytics rule's 'Incident settings' / suppression section, making it the precise tool for this requirement.

Answer

Create an automation rule to close incidents

Answer

Adjust the alert threshold in the analytics rule

Answer

Disable incident creation for the rule