SC-200 Respond to security incidents Practice Test 29 — 15 Questions

Question 1

You are investigating a potential ransomware incident detected by Microsoft Defender XDR. The incident shows multiple machines with suspicious encryption activity. You need to contain the threat immediately. What should you do first?

Accepted Answer

Initiate device isolation on affected machines from Microsoft Defender XDR. Option A is correct because isolating devices from the network stops the spread of ransomware immediately. Option B is wrong because running antivirus scan is reactive and may not stop encryption in progress. Option C is wrong because disabling user accounts does not stop the malware on endpoints. Option D is wrong because resetting passwords does not contain the active infection.

Answer

Reset the passwords of all users on the affected machines

Answer

Run a full antivirus scan on all endpoints

Answer

Disable the user accounts associated with the affected machines

Question 2

During a security incident, the Microsoft Sentinel workspace is receiving high volume of low-severity alerts causing analyst fatigue. You need to reduce noise while ensuring critical alerts are not missed. What should you configure?

Accepted Answer

Modify the incident creation rule to only create incidents for alerts with severity High or Medium. Option C is correct because incident creation rules can filter by alert severity to only create incidents for high and medium severity, reducing noise. Option A is wrong because disabling analytics rules would stop all alerts. Option B is wrong because automation rules trigger after incident creation, not before. Option D is wrong because setting severity to Informational would not help filter.

Answer

Disable analytics rules for low-severity alerts

Answer

Change the severity of low-severity alerts to Informational in the analytics rule

Answer

Create an automation rule to close low-severity incidents automatically

Question 3

You receive a Microsoft Defender XDR incident alert about a suspicious sign-in from an unfamiliar location. The user confirms they did not perform the sign-in. What should you do to immediately secure the account?

Accepted Answer

Disable the user account in Microsoft Entra ID. Option B is correct because disabling the user account in Microsoft Entra ID immediately prevents further use. Option A is wrong because resetting password alone does not block active sessions. Option C is wrong because MFA registration does not stop ongoing compromise. Option D is wrong because blocking the IP may not be effective if the attacker uses multiple IPs.

Answer

Reset the user's password

Answer

Block the IP address used for the suspicious sign-in

Answer

Require the user to register for Microsoft Entra Multi-Factor Authentication

Question 4

You are investigating an incident in Microsoft Sentinel where a PowerShell script was executed on multiple servers with suspicious parameters. The incident is high severity. You need to determine if the script is malicious and if lateral movement occurred. What should you do?

Accepted Answer

Run a custom KQL hunting query to find similar script executions on other machines. Option D is correct because hunting queries can search for related activities across time and entities, revealing lateral movement. Option A is wrong because restarting machines destroys evidence. Option B is wrong because the incident timeline shows events in one workspace but may not show lateral movement across resources. Option C is wrong because live response is for immediate containment, not investigation.

Answer

Use Microsoft Defender for Endpoint live response to collect forensic data

Answer

Restart the affected servers to stop the script

Answer

Review the incident timeline in Microsoft Sentinel

Question 5

Your organization uses Microsoft Sentinel. An incident is created from an Azure Active Directory (now Microsoft Entra ID) sign-in alert. You need to determine if the sign-in was from a compromised token. What data source should you examine?

Accepted Answer

Sign-in logs in Microsoft Entra ID. Option D is correct because sign-in logs show token details such as token issuer and session info. Option A is wrong because audit logs track changes, not sign-in details. Option B is wrong because Azure activity logs are for resource operations. Option C is wrong because Microsoft Defender for Cloud Apps logs are for cloud app sessions, not token details.

Answer

Audit logs in Microsoft Entra ID

Answer

Azure Activity Log

Answer

Microsoft Defender for Cloud Apps logs

Question 6

A Microsoft Defender XDR incident shows that a user's device has been communicating with a known malicious C2 server. The device is online and the user is actively working. You need to contain the threat with minimal business disruption. What should you do?

Accepted Answer

Initiate device isolation from Microsoft Defender XDR. Option A is correct because isolating the device stops communication while allowing the user to continue work if they switch to another device. Option B is wrong because shutting down the device causes immediate disruption. Option C is wrong because removing network connectivity may not be possible remotely. Option D is wrong because running antivirus scan does not stop ongoing C2 communication.

Answer

Remove the device from the network by disabling the switch port

Answer

Shut down the device remotely

Answer

Run a full antivirus scan on the device

Question 7

You are investigating a Microsoft Sentinel incident involving a user who clicked a phishing link. The incident includes alerts from Microsoft Defender for Office 365. You need to identify if any other users received the same phishing email. What should you do?

Accepted Answer

Use the Threat Explorer in Microsoft Defender for Office 365. Option C is correct because the Threat Explorer in Microsoft Defender for Office 365 can search for emails by subject, sender, or URL. Option A is wrong because the incident graph shows only linked entities. Option B is wrong because the timeline shows events for the current incident only. Option D is wrong because Advanced Hunting is more complex and not the quickest method.

Answer

Check the incident timeline for related alerts

Answer

Review the incident graph in Microsoft Sentinel

Answer

Run a KQL query in Advanced Hunting

Question 8

During a ransomware incident, you need to prevent the encryption of files in SharePoint Online and OneDrive for Business. You have already identified the compromised user account. What should you do?

Accepted Answer

Lock the compromised user account in Microsoft Entra ID. Option B is correct because locking the account stops the attacker from accessing files. Option A is wrong because deleting files does not prevent encryption. Option C is wrong because applying a retention policy does not block access. Option D is wrong because disabling external sharing does not stop internal encryption.

Answer

Disable external sharing for SharePoint Online

Answer

Delete the compromised user's OneDrive files

Answer

Apply a retention policy to all SharePoint sites

Question 9

Which TWO actions should you take when responding to a confirmed data exfiltration incident involving Microsoft 365? (Choose two.)

Accepted Answer

Revoke user sessions in Microsoft Entra ID. Option A is correct: Contain the activity by revoking user sessions. Option D is correct: Investigate by reviewing audit logs to determine scope. Option B is wrong because resetting password for all users is excessive. Option C is wrong because disabling all external sharing is too broad. Option E is wrong because blocking tenant access is disruptive and premature.

Answer

Reset passwords for all users

Answer

Disable all external sharing in SharePoint

Answer

Block all access to the tenant

Question 10

Which THREE are valid methods to collect forensic evidence from a compromised Windows machine during incident response in Microsoft Defender XDR? (Choose three.)

Accepted Answer

Collect a memory dump from the device using Live Response. Option A, B, and D are correct: Live Response allows script execution and file collection; collecting memory dump captures volatile evidence; exporting event logs provides timeline. Option C is wrong because full disk imaging is not natively supported in Microsoft Defender XDR. Option E is wrong because resetting the device destroys evidence.

Answer

Reset the device to a clean state

Answer

Perform a full disk image using Microsoft Defender for Endpoint

Question 11

Which TWO are immediate containment actions in Microsoft Sentinel for a compromised Azure VM? (Choose two.)

Accepted Answer

Apply an NSG to block all inbound and outbound traffic. Option A is correct: Applying a network security group (NSG) to block traffic can be automated via playbook. Option C is correct: Stopping the VM prevents further malicious activity. Option B is wrong because VM extensions may not stop the attack. Option D is wrong because resetting password does not stop processes. Option E is wrong because initiating backup is not containment.

Answer

Install anti-malware extension

Answer

Reset the VM administrator password

Answer

Initiate a VM backup

Question 12

Which THREE resources can be used as data sources for Microsoft Sentinel to detect security incidents? (Choose three.)

Accepted Answer

Microsoft 365 Defender. Option A, C, and D are correct: Azure Activity Log provides subscription-level events; Microsoft Defender for Cloud provides security alerts; Microsoft 365 Defender provides integrated signals. Option B is wrong because Azure Advisor provides recommendations, not security events. Option E is wrong because Azure Cost Management is cost-related.

Answer

Azure Cost Management

Answer

Azure Advisor

Question 13

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. A critical incident has been generated from Microsoft Defender for Cloud indicating that a Linux VM in Azure is running a cryptocurrency miner. The VM is part of a production application and cannot be shut down immediately. The incident severity is High. You need to contain the threat while maintaining application availability, investigate the root cause, and prevent recurrence. The environment includes Azure Policy, Microsoft Defender for Endpoint on the VM, and a Log Analytics workspace. You must minimize manual steps. What course of action should you take?

Accepted Answer

Use Microsoft Sentinel automation to apply a block rule on the VM's network security group (NSG) to block outbound traffic to known mining pools, initiate Live Response to collect evidence, and create an Azure Policy to automatically deploy Microsoft Defender for Endpoint on all VMs. Option C is correct because it uses automation to block the miner's network traffic (containment), collects forensic data via Live Response (investigation), and configures Azure Policy to enforce remediation (prevention). Option A is wrong because stopping the VM disrupts production. Option B is wrong because only running a script does not block network communication. Option D is wrong because removing the VM from the load balancer still allows the miner to run locally and potentially communicate.

Answer

Remotely connect to the VM and run a script to kill the miner process, then update antivirus definitions

Answer

Remove the VM from the load balancer, then use Azure Policy to enforce that all VMs have antivirus enabled

Answer

Stop the VM immediately, take a snapshot for forensic analysis, and then redeploy a clean VM from a backup

Question 14

Your organization uses Microsoft Sentinel. A security analyst reports that an incident was created for a sign-in from an unfamiliar location, but after investigation, it was determined to be a false positive. You need to ensure that similar sign-ins do not generate incidents in the future. What should you do?

Accepted Answer

Create a custom analytics rule with an alert suppression condition matching the sign-in attributes.. Option B is correct because creating a custom analytics rule with an alert suppression condition based on the specific location or user attributes will prevent future alerts for similar events. Option A is wrong because closing the incident does not suppress future alerts. Option C is wrong because modifying the built-in rule's query is not recommended and may affect other detections. Option D is wrong because automation rules handle response actions, not alert suppression.

Answer

Modify the built-in Microsoft analytics rule to exclude the sign-in location.

Answer

Close the incident with a classification of False Positive.

Answer

Create an automation rule that automatically closes similar incidents.

Question 15

Your company uses Microsoft Defender XDR. During a ransomware incident, you need to isolate a compromised Windows 10 device from the network while allowing connectivity to the Microsoft Defender for Endpoint service. Which action should you take?

Accepted Answer

Initiate a Full isolation from the device's action menu.. Option D is correct because the Full isolation type in Microsoft Defender for Endpoint blocks all network traffic except to the Defender service. Option A (Selective isolation) is not a valid isolation type. Option B (Contain) is not an isolation action. Option C (Block all traffic) would prevent the device from receiving updates and reporting to Defender.

Answer

Contain the device from the Microsoft Defender XDR portal.

Answer

Apply a firewall rule to block all outbound traffic.

Answer

Run a selective isolation to block only external connections.