SC-200 Respond to security incidents Practice Test 28 — 15 Questions

Question 1

You are investigating a security incident in Microsoft Defender XDR where a user received a phishing email that bypassed Exchange Online Protection. The email contained a link to a credential harvesting page. After the user entered credentials, the attacker used them to sign in from an unusual location. You need to recommend an automated response to prevent further credential theft from similar emails. What should you implement?

Accepted Answer

Create an Attack Simulation Training campaign in Microsoft Defender for Office 365.. Option A is correct because Attack Simulation Training in Microsoft Defender for Office 365 can create and automate phishing campaigns to train users, reducing the risk of credential theft. Option B is wrong because Safe Links protects against malicious links in real time but does not train users. Option C is wrong because Conditional Access policies require an identity provider and are not an automated response to emails. Option D is wrong because Cloud App Security is for shadow IT discovery, not email-based phishing prevention.

Answer

Enable Cloud App Security to detect and block malicious cloud apps.

Answer

Enable Safe Links policy for all users.

Answer

Configure a Conditional Access policy to block sign-ins from unusual locations.

Question 2

You run the above KQL query in Microsoft Sentinel to detect potential brute-force attacks on Microsoft Teams. After reviewing the results, you notice that some entries have a high LogonCount but are missing from the output. What is the most likely reason?

Accepted Answer

The inner join excludes entries that do not have a corresponding risky sign-in event.. Option D is correct because the join is an inner join, which only returns rows that have matching AccountUpn and IPAddress in both tables. If high LogonCount entries do not have a corresponding risky sign-in event (RiskLevelDuringSignIn medium or high), they will be excluded. Option A is wrong because the query uses RiskLevelDuringSignIn, not RiskLevelDuringSignIn. Option B is wrong because the query filters by Application == 'Microsoft Teams', so it only considers Teams logons. Option C is wrong because the join keys are AccountUpn and IPAddress, not AccountUpn alone.

Answer

The RiskLevelDuringSignIn field is misspelled as RiskLevelDuringSignIn.

Answer

The query only considers logons to Microsoft Teams, but the high LogonCount may be from other applications.

Answer

The join condition does not include AccountUpn, so it fails to match.

Question 3

During a security incident response, you need to collect forensic evidence from a Windows 10 device that is suspected to be compromised. The device is not domain-joined and is located in a remote office. You have remote administrative access. Which Microsoft 365 tool should you use to acquire a memory dump of the device?

Accepted Answer

Microsoft Defender for Endpoint. Option C is correct because Microsoft Defender for Endpoint (MDE) includes live response capabilities that allow you to collect memory dumps from remote devices. Option A is wrong because Microsoft Intune is for device management, not forensic collection. Option B is wrong because Microsoft Purview eDiscovery is for content searches and legal holds, not live memory acquisition. Option D is wrong because Microsoft Sentinel is a SIEM, not a tool for direct forensic collection from endpoints.

Answer

Microsoft Sentinel

Answer

Microsoft Purview eDiscovery

Answer

Microsoft Intune

Question 4

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You receive an alert about a suspicious sign-in from an IP address associated with a known malicious actor. The sign-in was for a privileged account. You need to immediately contain the incident. What should you do first?

Accepted Answer

Disable the user account in Microsoft Entra ID.. Option B is correct because disabling the user account immediately stops the attacker from using the compromised credentials. Option A is wrong because resetting the password might not be fast enough if the attacker has an active session. Option C is wrong because blocking the IP in the firewall is reactive and may not be effective if the attacker uses a different IP. Option D is wrong because creating an analytics rule does not contain the incident immediately.

Answer

Reset the user's password.

Answer

Create a custom analytics rule in Sentinel to detect similar sign-ins.

Answer

Block the IP address in the firewall.

Question 5

You deploy the above ASR rule in Microsoft Defender for Endpoint. After deployment, you notice that .exe files are still being executed from Outlook attachments. What is the most likely reason?

Accepted Answer

The ASR rule is configured in audit mode instead of block mode.. Option B is correct because ASR rules require the block action to be set to 'block' or 'audit' mode via the tenant's security settings; the policyContent snippet shows the rule definition but does not specify the enforcement mode. The default mode is audit, so the rule only logs events without blocking. Option A is wrong because the rule targets file extensions, not script files. Option C is wrong because the rule targets initiating process outlook.exe, not all processes. Option D is wrong because the rule is correctly formatted for ASR.

Answer

The rule only applies when the initiating process is outlook.exe, but the attachment may be launched from another process.

Answer

The rule does not block .vbs files, which are also commonly used in attacks.

Answer

The rule is not applied because fileExtension is not a supported field in ASR rules.

Question 6

You are responding to a security incident involving a user who clicked on a malicious link in an email. The link led to a website that downloaded a file to the user's device. Microsoft Defender for Endpoint (MDE) detected the file as malware and blocked it. However, the user reports that the device is running slowly. You need to verify if there are any remnants of the malware. Which action should you take?

Accepted Answer

Initiate a live response session and run a PowerShell script to check for persistence mechanisms.. Option A is correct because MDE's live response allows you to run commands and scripts on the device to check for remnants. Option B is wrong because the malware was already blocked, so an antivirus scan may not find anything new. Option C is wrong because the device is already onboarded to MDE. Option D is wrong because a full OS reinstall is too drastic and not necessary.

Answer

Re-onboard the device to MDE to ensure it's fully managed.

Answer

Run a full antivirus scan using Microsoft Defender Antivirus.

Answer

Perform a full OS reinstall to ensure the device is clean.

Question 7

Your organization uses Microsoft Sentinel and has enabled User and Entity Behavior Analytics (UEBA). During an incident investigation, you identify that a user account has been exhibiting anomalous behavior, such as logging in from multiple countries within a short time. You need to determine if the account is compromised and take appropriate action. What should you do first?

Accepted Answer

Review the UEBA insights for the user to understand the anomaly.. Option C is correct because UEBA provides risk scores and peer comparisons that can help determine if the behavior is truly anomalous. Option A is wrong because resetting the password without investigation may not be necessary if the behavior is legitimate. Option B is wrong because disabling the account is premature. Option D is wrong because creating an automation rule is a response step, not an investigation step.

Answer

Disable the user account in Microsoft Entra ID.

Answer

Create a custom automation rule in Sentinel to disable the account on similar alerts.

Answer

Reset the user's password immediately.

Question 8

You run the above KQL query in Microsoft Sentinel to detect encoded PowerShell commands. The query returns no results, even though you know that some devices have executed encoded PowerShell commands. What is the most likely reason?

Accepted Answer

The query only looks for 'powershell.exe', but the command might have been run using 'pwsh.exe' or 'powershell_ise.exe'.. Option B is correct because the query filters where FileName == 'powershell.exe' exactly, but the process might be named 'powershell_ise.exe' or 'pwsh.exe' (PowerShell Core). Option A is wrong because base64_decode_tostring should decode properly if the command is base64-encoded. Option C is wrong because the query does not filter by -EncodedCommand; it uses contains to check if the decoded command contains '-EncodedCommand', which is incorrect logic. Option D is wrong because the query uses the DeviceProcessEvents table, which should capture process events.

Answer

The DecodedCommand column is empty because the ProcessCommandLine does not contain an encoded command.

Answer

The base64_decode_tostring function cannot decode PowerShell encoded commands.

Answer

The DeviceProcessEvents table does not contain PowerShell process events.

Question 9

You are investigating an incident where a user reported receiving a suspicious email with an attachment. The attachment is a .docm file that contains macros. The email was not blocked by Exchange Online Protection. You need to ensure that similar emails are blocked in the future. What should you configure?

Accepted Answer

Create a Safe Attachments policy that blocks .docm files.. Option A is correct because a Safe Attachments policy in Microsoft Defender for Office 365 will scan attachments and block malicious ones. Option B is wrong because Safe Links scans URLs, not attachments. Option C is wrong because anti-phishing policies protect against impersonation, not malicious attachments. Option D is wrong because anti-malware policies in Exchange Online Protection are basic and may not detect macro-based malware effectively.

Answer

Create a Safe Links policy to block links in the email.

Answer

Create an anti-phishing policy to block the sender's domain.

Answer

Create a transport rule to block emails with .docm attachments.

Question 10

During a security incident response, you need to collect forensic data from multiple endpoints. Which TWO tools can be used to remotely collect forensic data from Windows devices in a Microsoft Defender for Endpoint environment? (Choose two.)

Accepted Answer

Microsoft Defender for Endpoint live response. Option A and Option D are correct. Microsoft Defender for Endpoint live response allows remote collection of forensic data. Microsoft Sentinel's UEBA does not collect data; it analyzes behavior. Microsoft Intune is for management. Microsoft 365 Defender portal provides incident management but not direct forensic collection from endpoints.

Answer

Microsoft Sentinel UEBA

Answer

Microsoft Intune

Answer

Microsoft Purview eDiscovery

Question 11

Your organization uses Microsoft Sentinel and has configured analytics rules for detecting ransomware. You receive an alert indicating possible ransomware activity on a server. Which THREE actions should you take to contain and investigate the incident? (Choose three.)

Accepted Answer

Initiate a live response session to collect forensic artifacts.. Option A, B, and D are correct. Isolating the server prevents further spread. Reviewing the timeline helps understand the attack. Running a live response to collect artifacts aids investigation. Option C is wrong because resetting the password of a compromised account may not be effective if the attacker has local access. Option E is wrong because creating a new rule is for detection, not containment.

Answer

Create a new analytics rule to detect similar behavior.

Answer

Reset the password of the account that showed anomalous behavior.

Question 12

You are investigating a security incident involving a compromised user account. The attacker used the account to access sensitive data in SharePoint Online. Which TWO actions should you take to remediate the incident? (Choose two.)

Accepted Answer

Revoke all refresh tokens for the user.. Option A and D are correct. Disabling the account immediately stops further access. Revoking sessions ensures the attacker's current sessions are terminated. Option B is wrong because reviewing sign-in logs is investigation, not remediation. Option C is wrong because resetting the password is good but may not kill active sessions without revocation. Option E is wrong because creating a Conditional Access policy is a long-term preventive measure, not immediate remediation.

Answer

Reset the user's password.

Answer

Review the sign-in logs to determine the extent of the breach.

Answer

Create a Conditional Access policy to require MFA for the user.

Question 13

Your Microsoft Sentinel workspace ingests logs from Microsoft Defender for Cloud and Microsoft 365 Defender. You need to create an incident response playbook that automatically responds to high-severity incidents. Which THREE components are required? (Choose three.)

Accepted Answer

An analytics rule that generates the incident. Option A, B, and C are correct. An automation rule triggers the playbook. A Logic Apps workflow defines the playbook actions. A Microsoft Sentinel analytics rule generates the incident. Option D is wrong because a workbook is for visualization, not automation. Option E is wrong because a hunting query is for proactive search, not automated response.

Answer

A workbook to visualize the incident data

Answer

A hunting query to search for similar activity

Question 14

You are investigating a potential data exfiltration incident in Microsoft Purview. A user has been downloading large amounts of data from a SharePoint site to an unmanaged device. Which TWO actions should you take to contain the exfiltration? (Choose two.)

Accepted Answer

Remove the user's permissions to the SharePoint site.. Option A and D are correct. Blocking downloads from unmanaged devices using Conditional Access or DLP policies prevents further exfiltration. Removing the user's access to the site stops immediate access. Option B is wrong because creating a sensitivity label may not apply retroactively. Option C is wrong because disabling the device may not stop the user from accessing data from another device. Option E is wrong because creating a retention policy is for data preservation, not containment.

Answer

Apply a sensitivity label to the SharePoint site to restrict access.

Answer

Disable the user's device in Microsoft Intune.

Answer

Create a retention policy for the SharePoint site.

Question 15

Your organization uses Microsoft Defender for Office 365. A user reports receiving a phishing email that was not blocked by the service. You need to improve detection of similar phishing emails. Which TWO actions should you take? (Choose two.)

Accepted Answer

Submit the email to Microsoft for analysis using the Submissions page in Microsoft 365 Defender.. Option A and B are correct. Submitting the email for analysis helps improve detection. Configuring anti-phishing policies for user impersonation protection can block similar emails. Option C is wrong because Safe Links is for URLs, not for detecting phishing emails based on content. Option D is wrong because creating a mailbox rule is a client-side action, not a service-wide improvement. Option E is wrong because Attack Simulation Training educates users but does not improve detection.

Answer

Create an Attack Simulation Training campaign.

Answer

Enable Safe Links for all users to block malicious URLs.

Answer

Create a mailbox rule to move similar emails to the Junk folder.