SC-200 Respond to security incidents Practice Test 29 — 15 Questions

Question 1

Your security operations center (SOC) uses Microsoft Sentinel. An incident is created from a fusion alert. What does Fusion technology do?

Accepted Answer

Correlates alerts from different products to detect multi-stage attacks. Microsoft Sentinel's Fusion technology is a correlation engine that stitches together low-fidelity alerts and signals from multiple sources (Microsoft and third-party products) into high-fidelity incidents representing multi-stage attacks. It uses machine learning models built on attack kill-chain patterns to detect sequences like a suspicious sign-in followed by anomalous resource creation. This is why Fusion incidents are typically high severity and span multiple products.

Answer

Uses machine learning to detect suspicious user behavior

Answer

Runs queries at scheduled intervals to detect threats

Answer

Detects unusual patterns in Azure activity logs

Question 2

Your SOC uses Microsoft Defender for Cloud Apps. An alert indicates that a user is downloading a large number of files from SharePoint. Which action should you take to investigate and potentially block the activity?

Accepted Answer

Suspend the user in Defender for Cloud Apps. In Microsoft Defender for Cloud Apps, suspending a user is a direct response action that blocks the user from accessing cloud apps and can be used during investigation of suspicious activity like mass file downloads. This is the native remediation action within the CASB solution, allowing the SOC to contain the threat without disabling the identity across all of Microsoft Entra ID.

Answer

Create a Conditional Access policy to block the user

Answer

Block the IP address in Azure Firewall

Answer

Use Microsoft Intune to wipe the user's device

Question 3

Which THREE of the following are key steps when containing a ransomware incident in Microsoft Defender XDR? (Select THREE.)

Accepted Answer

Block known malicious file hashes via Indicators of compromise. Blocking malicious file hashes via indicators of compromise (B), disabling compromised user accounts (C), and isolating compromised devices (E) are key steps in containing a ransomware incident. Restoring from backup (A) is part of recovery, and analyzing root cause (D) is part of investigation, both of which occur after containment.

Answer

Restore encrypted files from backup

Answer

Analyze the root cause of the outbreak

Question 4

Which TWO of the following are valid data connectors for Microsoft Sentinel? (Select TWO.)

Accepted Answer

Azure Firewall. Azure Firewall and Microsoft Entra ID are both supported data connectors in Microsoft Sentinel. Azure Firewall can be connected via the Azure Firewall connector, and Microsoft Entra ID (formerly Azure Active Directory) has built-in connectors for auditing and sign-in logs. Docker containers (A) are not a native data source for Sentinel; they would require a custom solution. Amazon RDS (B) is not directly supported; you would need to ingest via AWS CloudTrail or similar. Google Cloud Storage (D) also requires custom ingestion methods.

Answer

Docker containers

Answer

Amazon RDS

Answer

Google Cloud Storage

Question 5

An analyst runs this advanced hunting query to investigate suspicious command-line activity. Which type of activity is this query most likely detecting?

Accepted Answer

Execution of obfuscated scripts via encoded commands. The query likely searches for command lines containing encoded or obfuscated script indicators, such as 'powershell -enc' or Base64-encoded commands, which are common in malicious script execution. Advanced hunting in Microsoft 365 Defender uses Kusto Query Language (KQL) to query device process events. Detecting encoded commands is a typical technique to identify obfuscated scripts that evade detection.

Answer

Data exfiltration to external IPs

Answer

Privilege escalation attempts

Answer

Port scanning activity

Question 6

Based on the ARM template snippet, what is the purpose of this analytics rule?

Accepted Answer

To detect brute force attacks on user accounts. The query counts failed logon events (EventID 4625) and triggers when the count exceeds a threshold (e.g., 5) within a time window, indicating multiple failed attempts. Option B is correct because a high count of failed logon attempts from the same account or IP is a classic sign of a brute force attack. Option C is incorrect because EventID 4625 is a failed logon, not a successful login. Option D is incorrect because the query does not include EventID 4740 (account lockout) and does not check for lockouts.

Answer

To detect multiple failed logon attempts within a time window

Answer

To detect successful logins by account

Answer

To detect account lockouts

Question 7

Your organization uses Microsoft Sentinel. A security analyst receives an alert from a custom analytics rule that triggers on a specific sequence of failed logon attempts followed by a successful logon from an unusual location. The incident is generated but the analyst is not sure if the activity is malicious or a user error. What should the analyst do first to quickly gather additional context?

Accepted Answer

Use the Investigation graph to explore related entities and events. The Investigation graph in Microsoft Sentinel is designed to let analysts visually explore an incident's related entities (users, hosts, IPs) and their connections, quickly surfacing additional context such as other alerts, sign-ins, and events tied to the same entities. It is the fastest first step to determine whether the activity is malicious or benign without writing queries.

Answer

Run a KQL query across the entire workspace to find all related events

Answer

Create a new analytics rule to detect similar patterns

Answer

Modify the existing analytics rule to add more conditions

Question 8

Your company uses Microsoft Defender XDR. A critical server is exhibiting signs of a potential ransomware attack, with files being encrypted and a ransom note appearing. The incident has been escalated to the security operations center (SOC). What is the most immediate action to contain the threat and prevent further spread?

Accepted Answer

Initiate the 'Contain device' action from Microsoft Defender XDR. Initiate the 'Contain device' action from Microsoft Defender XDR. This action immediately isolates the compromised device from the network, preventing the ransomware from spreading to other systems. Option A is incorrect because collecting an investigation package is for forensic analysis, not containment. Option B is incorrect because disabling the user account does not stop the ransomware process that is already running on the server. Option D is incorrect because running a full antivirus scan takes time and does not contain the threat; containment must happen first.

Answer

Collect an investigation package for analysis

Answer

Disable the user account that was logged on

Answer

Run a full antivirus scan on the server

Question 9

A company uses Microsoft Sentinel as its SIEM. The security team is investigating an incident that involves multiple alerts from different data sources. The team wants to see a timeline of all related activities across all data sources in one view. Which Microsoft Sentinel feature should they use?

Accepted Answer

Incident timeline. The Incident timeline in Microsoft Sentinel provides a unified chronological view of all alerts and events related to an incident. Option A is wrong because Workbooks are for custom dashboards and reporting, not for viewing incident timelines. Option C is wrong because the Investigation graph focuses on entity relationships, not a chronological timeline. Option D is wrong because the Hunting page is for proactive threat hunting, not incident investigation.

Answer

Workbooks

Answer

Investigation graph

Answer

Hunting page

Question 10

Your company uses Microsoft Sentinel. A security analyst receives an incident that includes a large number of alerts from a single data source. The analyst needs to identify which alerts are duplicates or related so they can focus on unique threats. Which feature should the analyst use?

Accepted Answer

Alert grouping. Alert grouping in Microsoft Sentinel automatically combines related alerts into a single incident, reducing noise so analysts can focus on unique threats. It uses machine learning to correlate alerts that share entities, timing, or patterns, directly addressing the need to identify duplicates or related alerts.

Answer

Investigation graph

Answer

Entity mapping

Answer

Automation rules

Question 11

An organization uses Microsoft Defender XDR. During an incident investigation, the security team needs to determine if a specific file was executed on any devices in the organization over the past 30 days. They have the file hash. What is the most efficient way to get this information?

Accepted Answer

Use advanced hunting to query for file execution events. Advanced hunting in Microsoft Defender XDR provides a Kusto Query Language (KQL) interface to query raw event data across all workloads, including DeviceProcessEvents, DeviceFileEvents, and DeviceEvents. By querying for the specific file hash (e.g., SHA256) in process creation events over the past 30 days, the team can efficiently determine if and where the file executed. This is the most direct and scalable method for historical, organization-wide file execution searches.

Answer

Use the action center to search for the file

Answer

Review the incident timeline for the file

Answer

Check the device inventory for the file

Question 12

A security analyst is investigating a phishing incident in Microsoft Defender XDR. The analyst wants to see the full email content and attachments. Where should the analyst look?

Accepted Answer

The email entity page. The Email entity page in Microsoft Defender XDR provides detailed information about an email, including content and attachments. Option A is wrong because the incident timeline shows events related to the incident, not full email content. Option B is wrong because the action center is for managing response actions, not viewing email details. Option D is wrong because the user entity page shows user information, not email content.

Answer

The incident timeline

Answer

The action center

Answer

The user entity page

Question 13

Which THREE actions are appropriate when investigating a potential data exfiltration incident in Microsoft Defender for Cloud Apps?

Accepted Answer

Use the app dashboard to view unusual behavior alerts. Options B, D, and E are correct. Option B: Using the app dashboard to view unusual behavior alerts provides context about potential exfiltration. Option D: Checking file policy matches helps identify which files were flagged as suspicious. Option E: Reviewing the user's activity log in Defender for Cloud Apps helps determine the scope of the exfiltration. Option A is incorrect because checking device inventory is not a cloud app investigation action—it applies to endpoint devices. Option C is incorrect because suspending the user's account is a containment action, not an investigative step.

Answer

Check the device inventory for suspicious applications

Answer

Suspend the user's account immediately

Question 14

Refer to the exhibit. An automation rule is configured as shown. When will the playbook be triggered?

Accepted Answer

When a new incident is created with severity High, from Microsoft Defender for Endpoint, and with 'Malware' in the title. In Microsoft Sentinel automation rules, all configured conditions are evaluated with AND logic — every condition must be true for the rule to fire. The exhibit shows three conditions: incident severity = High, the incident must be created (not updated), and the title must contain 'Malware'. Additionally, the rule is scoped to incidents originating from Microsoft Defender for Endpoint. Therefore, the playbook triggers only when a new incident is created that is High severity, sourced from Defender for Endpoint, and has 'Malware' in the title.

Answer

When any incident is created from Microsoft Defender for Endpoint

Answer

When a new incident with any severity contains 'Malware' in the title

Answer

When an incident is updated to High severity

Question 15

An incident in Microsoft Defender XDR shows a device with high severity alert: 'Suspicious PowerShell command line.' The device is currently isolated from the network. What is the best next step to investigate the alert?

Accepted Answer

Run a live response session on the device.. Running a live response session on the isolated device lets the analyst execute commands, collect forensic artifacts (process list, network connections, file hashes), and investigate the suspicious PowerShell activity without restoring network connectivity. This is the recommended next step in Microsoft Defender XDR when a device is already isolated, because live response provides direct, interactive access for evidence gathering. It preserves containment while enabling deeper investigation.

Answer

Review the device timeline for related alerts.

Answer

Restore network connectivity to allow the device to communicate with the cloud for analysis.

Answer

Initiate a full antivirus scan on the device.