SC-200 Respond to security incidents Practice Test 29 — 15 Questions

Question 1

You are an incident responder for a company using Microsoft 365 Defender. A critical incident is assigned to you. What is the first action you should take according to best practices?

Accepted Answer

Triage the incident to determine the scope and severity.. The first and most critical step in incident response is to triage the incident. Triage involves assessing the incident's scope, severity, and potential impact to prioritize and guide subsequent actions. Without triage, you risk wasting resources on low-priority issues or taking inappropriate steps. Option A is correct because it enables informed decision-making. Option B (escalate) should come after triage if necessary. Option C (isolate devices) may be too hasty and could hinder investigation. Option D (collect memory dump) is premature before understanding the incident.

Answer

Escalate the incident to senior management.

Answer

Immediately isolate all affected devices.

Answer

Collect a full memory dump from the affected systems.

Question 2

Your organization uses Microsoft Sentinel. You have an incident that involves multiple alerts. You want to automatically assign the incident to the appropriate analyst based on the alert type. What should you use?

Accepted Answer

Create an automation rule with an 'Assign incident to owner' action.. Automation rules in Microsoft Sentinel can include actions like 'Assign incident to owner' that automatically assign incidents based on conditions such as alert type. Option A (playbooks) are typically used for complex, multi-step automation, not simple assignment. Option B (analytics rules) define alert conditions, not incident management. Option C (workbooks) are for visualization and filtering, not automated assignment.

Answer

Create a playbook that assigns the incident.

Answer

Configure the analytics rule to set the incident owner.

Answer

Use a workbook to filter incidents by alert type.

Question 3

Your company uses Microsoft Defender for Endpoint. A device shows signs of compromise with suspicious PowerShell execution. You need to collect forensic evidence before performing remediation. Which action should you use?

Accepted Answer

Collect investigation package.. 'Collect investigation package' in Microsoft Defender for Endpoint gathers a comprehensive set of forensic data from the device, including files, processes, registry keys, and network connections, which is essential for forensic evidence collection before remediation. Option A (Isolate device from the network) is a containment measure to prevent spread, not a forensic collection step. Option B (Run a full antivirus scan) is a remediation or detection step, not a forensic evidence collection action. Option D (Initiate a live response session) allows real-time investigation and remote commands but does not automatically collect a full forensic package; it is more suited for interactive analysis rather than gathering a predefined set of evidence.

Answer

Isolate the device from the network.

Answer

Run a full antivirus scan.

Answer

Initiate a live response session.

Question 4

Your organization uses Microsoft Sentinel. You receive an incident for a potential malware outbreak. You need to quickly see which entities are involved (e.g., IPs, hosts, accounts). Where should you look?

Accepted Answer

Entities tab. The Entities tab in a Microsoft Sentinel incident provides a consolidated view of all related entities such as IP addresses, hosts, user accounts, and other resources that were identified during the alert investigation. This allows you to quickly assess the scope of a potential malware outbreak by seeing which systems and identities are involved, without needing to navigate through raw alerts or timeline events.

Answer

Incident timeline

Answer

Comments section

Answer

Alerts tab

Question 5

Your organization is responding to a security incident in Microsoft Defender XDR. You need to contain a compromised on-premises Exchange server. Which TWO actions are appropriate? (Choose two.)

Accepted Answer

Disconnect the server from the network.. Options A and C are correct. Disconnecting the server from the network contains the threat by preventing further lateral movement. Blocking the compromised user account in Microsoft Entra ID prevents the attacker from using that account for further access. Option B (Collect an investigation package) is a forensic evidence collection step, not containment. Option D (Update antivirus definitions) is a remediation step but not immediate containment. Option E (Run a full antivirus scan) is also a remediation step, not containment.

Answer

Collect an investigation package from the server.

Answer

Update the antivirus definitions on the server.

Answer

Run a full antivirus scan on the server.

Question 6

Your organization uses Microsoft Sentinel. A security incident related to a compromised user account has been fully investigated and remediated. Which THREE steps should you take to close the incident properly? (Choose three.)

Accepted Answer

Verify that all related alerts are resolved or closed.. Options A, C, and D are correct. Verifying that all related alerts are resolved or closed (A) ensures no lingering issues. Changing the incident status to Closed with an appropriate classification (C) provides proper closure. Adding comments summarizing the investigation and remediation steps (D) documents the process. Option B (creating a new analytics rule) is not required for closing an incident. Option E (deleting the incident) is not recommended; incidents should be closed, not deleted.

Answer

Create a new analytics rule to detect similar activity.

Answer

Delete the incident to clean up the workspace.

Question 7

Your organization uses Microsoft Defender for Office 365. A user reports receiving a phishing email. You need to investigate the email and take action. Which TWO actions can you perform? (Choose two.)

Accepted Answer

Use the email entity page to take action like 'Soft delete'.. Options A and B are correct. The email entity page in Microsoft Defender for Office 365 allows you to take actions like soft delete on a specific email. Threat Explorer (now part of the Microsoft 365 Defender portal) enables you to search for emails and take actions such as deleting them. Option C is incorrect because creating a mail flow rule is a longer-term preventive measure, not an immediate investigative action. Option D is incorrect because submitting the email to Microsoft is for analysis, not for taking direct action on the email. Option E is incorrect because blocking the sender is possible but not a direct action from the incident investigation; it is a separate action.

Answer

Create a mail flow rule to block similar emails.

Answer

Submit the email to Microsoft for analysis.

Answer

Block the sender's email address.

Question 8

You are a security analyst at Contoso. Microsoft Sentinel is deployed with the Microsoft Defender for Cloud Apps connector. An incident is generated for a high-risk sign-in from a user named JaneDoe@contoso.com. The incident severity is Medium. The incident details show that the sign-in originated from an IP address in a country where Contoso has no business presence, and the user recently changed their password. You suspect account compromise. You need to take immediate action to contain the threat and prevent further unauthorized access. The user is currently active in Microsoft Entra ID. You have the following options: A) Force the user to re-authenticate by revoking their sessions in Microsoft Entra ID. B) Disable the user account in Microsoft Entra ID. C) Block the IP address in Microsoft Defender for Cloud Apps. D) Create a Sentinel automation rule to automatically disable accounts on similar alerts. Which action should you take first to contain the current incident?

Accepted Answer

Disable the user account in Microsoft Entra ID.. Disabling the user account immediately stops any further access using that account, which is the most direct containment action. Option A (Revoke sessions) would end current sessions but the user could still authenticate again if credentials are compromised. Option C (Block IP) is less effective as the attacker may use other IPs. Option D (Create automation rule) is a long-term solution, not immediate containment.

Answer

Force the user to re-authenticate by revoking their sessions.

Answer

Block the IP address in Microsoft Defender for Cloud Apps.

Answer

Create a Sentinel automation rule to automatically disable accounts on similar alerts.

Question 9

Your organization uses Microsoft Defender XDR. You are investigating an incident that involves a malware infection on a Windows 10 device. The device is currently isolated from the network. The incident shows that the malware attempted to communicate with a command-and-control (C2) server. You have collected an investigation package. Now you need to remediate the device and bring it back to a clean state. The device has critical data that must not be lost. Which remediation action should you take? A) Run a full antivirus scan and remove threats. B) Perform a factory reset of the device. C) Reimage the device from a clean backup. D) Initiate a live response to manually remove the malware. Which option best balances thorough remediation with data preservation?

Accepted Answer

Reimage the device from a clean backup.. Reimaging from a clean backup ensures the malware is completely removed while preserving data from the backup. Option A (Full scan) may not detect all malware. Option B (Factory reset) loses all data. Option D (Live response) may miss persistent threats and is not as thorough as reimaging.

Answer

Initiate a live response to manually remove the malware.

Answer

Run a full antivirus scan and remove threats.

Answer

Perform a factory reset of the device.

Question 10

Your organization uses Microsoft Sentinel and Microsoft Defender for Identity. An incident is generated for a potential lateral movement attack. The incident is linked to multiple alerts involving a domain controller and several workstations. You need to understand the attack path and identify the initial compromised account. Which feature should you use to visualize the attack chain? A) The incident graph in Microsoft Sentinel. B) The entity timeline in Microsoft Defender for Identity. C) The Microsoft 365 Defender attack story. D) The Microsoft Purview compliance portal. Which option provides the best visual representation of the attack path?

Accepted Answer

The incident graph in Microsoft Sentinel.. The Microsoft Sentinel incident graph provides a visual representation of entities and their relationships, showing the attack path. Option B (Entity timeline) is linear and not a graph. Option C (Attack story) is in Defender XDR but focuses on alerts. Option D (Purview) is for compliance, not security incidents.

Answer

The Microsoft Purview compliance portal.

Answer

The entity timeline in Microsoft Defender for Identity.

Answer

The Microsoft 365 Defender attack story.

Question 11

A security analyst receives an alert in Microsoft Defender XDR indicating that a user account was compromised. The analyst needs to isolate the affected device to prevent lateral movement. Which action should the analyst take first?

Accepted Answer

Initiate device isolation from Microsoft Defender for Endpoint. Initiating device isolation in Microsoft Defender for Endpoint immediately contains the compromised device, preventing lateral movement. Option A is wrong because a full antimalware scan does not isolate the device and may not stop ongoing malicious activity. Option C is wrong because resetting the user's password does not isolate the device; it only revokes access to cloud resources. Option D is wrong because creating a custom detection rule in Microsoft Sentinel does not take immediate action to contain the threat.

Answer

Run a full antimalware scan on the device

Answer

Reset the user's password in Microsoft Entra ID

Answer

Create a custom detection rule in Microsoft Sentinel

Question 12

During an incident response, a forensic investigator needs to collect a memory dump from a compromised Windows server that is still running. The server has Microsoft Defender for Endpoint installed but is not connected to the internet. Which method should the investigator use?

Accepted Answer

Use Sysinternals Suite to capture a memory dump locally. Sysinternals Suite (e.g., using procdump or livekd) can capture a memory dump locally without requiring network connectivity. This is appropriate for an offline, compromised Windows server. Option A is incorrect because the Microsoft 365 Defender portal requires the device to be online. Option B is incorrect because Live Response requires an active connection to the device and is not available for offline devices. Option C is incorrect because the Microsoft Defender for Endpoint portal also requires the device to be online.

Answer

Collect a system memory snapshot from the Microsoft 365 Defender portal

Answer

Use Live Response to run a memory dump collector on the device

Answer

Initiate a memory dump from the Microsoft Defender for Endpoint portal

Question 13

An organization uses Microsoft Sentinel for security operations. A security engineer needs to automatically disable a compromised user account in Microsoft Entra ID when a high-severity incident is created in Sentinel. Which feature should the engineer use?

Accepted Answer

Automation rule with a playbook. Automation rules in Sentinel can trigger a playbook on incident creation, and a playbook can automate actions like disabling a user in Microsoft Entra ID. Option A is wrong because analytics rules create alerts, not directly act on incidents to trigger playbooks. Option B is wrong because workbooks are for visualization, not automation. Option D is wrong because hunting queries are manual searches, not automatic.

Answer

Analytics rule

Answer

Workbook

Answer

Hunting query

Question 14

A security operations center (SOC) team uses Microsoft Defender XDR and Microsoft Sentinel. An incident is created in Defender XDR that involves a malicious email and a compromised device. The team wants the incident to automatically sync to Sentinel. What is the minimum configuration required?

Accepted Answer

Configure the Microsoft Defender XDR connector in Sentinel. The Microsoft Defender XDR connector in Microsoft Sentinel automatically imports incidents from Microsoft Defender XDR, including those involving malicious emails and compromised devices. Option A is wrong because the Microsoft Defender for Office 365 connector only syncs email-related alerts, not full incidents. Option B is wrong because the Azure AD Identity Protection connector only syncs identity alerts. Option D is wrong because the Microsoft 365 Defender connector is the previous name, but the current connector is named Microsoft Defender XDR; however, functionally they are the same, but the correct name is as in Option C.

Answer

Configure the Microsoft Defender for Office 365 connector in Sentinel

Answer

Configure the Azure AD Identity Protection connector in Sentinel

Answer

Configure the Microsoft 365 Defender connector in Sentinel

Question 15

Refer to the exhibit. A security analyst creates a scheduled analytics rule in Microsoft Sentinel based on the JSON shown. After enabling the rule, the analyst notices that the rule generates alerts every hour for the same user accounts even after the incidents are resolved. What is the most likely cause?

Accepted Answer

Suppression is disabled, so the rule fires every hour with overlapping results. Suppression is disabled, so the rule fires every hour regardless of previous alerts. Option A is wrong because severity being set to High does not cause multiple alerts; it only affects the severity level of the generated alert. Option B is wrong because the query period is 1 day, which is appropriate and does not cause the rule to refetch old data every hour; the issue is with suppression, not query period. Option D is wrong because the trigger threshold of 10 controls when an alert is generated, but it does not prevent duplicate alerts from being created for the same resolved incidents; suppression is needed for that.

Answer

The severity is set to High, causing multiple alerts

Answer

The query period is too short, causing the rule to refetch old data

Answer

The trigger threshold is too low, causing the rule to fire too often