SC-200 Respond to security incidents Practice Test 3 — 15 Questions

Question 1

Your organization uses Microsoft Defender for Cloud Apps. A security analyst receives an alert for a suspicious sign-in from an IP address in a sanctioned app. The analyst needs to immediately block the user from accessing the app. Which action should the analyst take?

Accepted Answer

Suspend the user account in Microsoft Entra ID.. Option C is correct because suspending the user in Microsoft Entra ID is the fastest way to block access across all apps. Option A is wrong because creating a block policy takes time. Option B is wrong because blocking the IP may affect other users. Option D is wrong because revoking session tokens may not prevent new sign-ins immediately.

Answer

Add the IP address to the blocked IP list in Defender for Cloud Apps.

Answer

Create a new access policy in Defender for Cloud Apps to block the user.

Answer

Revoke the user's session tokens in Microsoft Entra ID.

Question 2

You are investigating a ransomware incident in Microsoft Sentinel. The incident contains multiple alerts from Microsoft Defender for Endpoint, Microsoft Defender for Office 365, and Microsoft Defender for Identity. You need to correlate the alerts and identify the initial entry point. Which KQL function should you use to combine the alerts?

Accepted Answer

make_set(). Option D is correct because the make_set function creates an array of unique values from an expression, which is useful for aggregating alert titles. Option A is wrong because materialize is for caching query results. Option B is wrong because the mv-expand operator expands multi-value arrays. Option C is wrong because the union operator combines tables, not useful for correlating within a single table.

Answer

materialize()

Answer

union

Answer

mv-expand

Question 3

A security analyst receives a Microsoft Defender for Cloud Apps alert about a user performing unusual file downloads from SharePoint. The analyst needs to investigate the user's activity in the last 24 hours. Which log source should the analyst query first?

Accepted Answer

Cloud App Security logs in Microsoft Sentinel. Option A is correct because Defender for Cloud Apps logs user activity in the cloud app activities log. Option B is wrong because Azure AD sign-in logs show authentication events, not file downloads. Option C is wrong because Office 365 audit logs include SharePoint file activities, but Defender for Cloud Apps provides a more consolidated view. Option D is wrong because Microsoft Intune logs focus on device management.

Answer

Microsoft Entra ID sign-in logs

Answer

Microsoft Intune device logs

Answer

Office 365 audit logs

Question 4

Your organization has Microsoft Defender XDR enabled. An incident is generated for a user who clicked a phishing link in an email. The analyst needs to automatically disable the user's mailbox for suspicious activity. Which automated action should the analyst configure in a Microsoft Sentinel automation rule?

Accepted Answer

Run a playbook that uses the Microsoft 365 Defender connector to disable the mailbox.. Option A is correct because disabling the mailbox is a remediation action available in Microsoft 365 Defender. Option B is wrong because deleting the email does not prevent future access. Option C is wrong because blocking the sender IP is not a direct action from Sentinel. Option D is wrong because resetting password is a different action.

Answer

Run a playbook that deletes the phishing email from the user's inbox.

Answer

Configure an automation rule to block the sender IP address in Defender for Cloud Apps.

Answer

Run a playbook that resets the user's password.

Question 5

You are responding to a data exfiltration incident in Microsoft Sentinel. The attacker used a PowerShell script to upload data to an external storage account. You need to identify the specific storage account used. Which KQL query should you use in the AzureActivity table?

Accepted Answer

OperationName == 'Storage Blob Upload'. Option C is correct because Storage Blob Upload is the operation for uploading data. Option A is wrong because List Storage Keys is for managing storage account keys. Option B is wrong because Create or Update Storage Account is for provisioning. Option D is wrong because Get Storage Account Properties is read-only.

Answer

OperationName == 'Get Storage Account Properties'

Answer

OperationName == 'Create or Update Storage Account'

Answer

OperationName == 'List Storage Account Keys'

Question 6

A security analyst needs to contain a compromised device that is spreading malware in the network. The device is enrolled in Microsoft Intune and managed by Microsoft Defender for Endpoint. What is the fastest way to isolate the device from the network?

Accepted Answer

Use Microsoft Defender for Endpoint to initiate device isolation.. Option A is correct because Defender for Endpoint supports device isolation action. Option B is wrong because disabling the device in Intune only prevents new management commands. Option C is wrong because wiping the device is destructive and may not be fastest. Option D is wrong because blocking the user's account does not isolate the device.

Answer

Disable the device in Microsoft Intune.

Answer

Perform a remote wipe of the device from Microsoft Intune.

Answer

Block the user's account in Microsoft Entra ID.

Question 7

During an incident investigation, you discover that an attacker used a legitimate account to access sensitive data in Microsoft Purview Information Protection. You need to identify what data was accessed and by whom. Which log source should you query?

Accepted Answer

Microsoft Purview data access logs. Option D is correct because Purview logs track access to sensitive data. Option A is wrong because Azure AD sign-in logs show authentication only. Option B is wrong because Office 365 audit logs may not include Purview data access. Option C is wrong because Microsoft 365 Defender alerts are for detections, not detailed access logs.

Answer

Microsoft 365 Defender alerts

Answer

Microsoft Entra ID sign-in logs

Answer

Office 365 audit logs (unified audit log)

Question 8

Your organization uses Microsoft Sentinel with Fusion and Microsoft Security incident creation rules. You receive a high-severity incident from Microsoft Defender for Cloud Apps. The incident has a low confidence score. What should you do first?

Accepted Answer

Validate the alert by correlating with other logs.. Option B is correct because validating the alert ensures that the incident is actionable before escalating. Option A is wrong because escalating without validation may waste resources. Option C is wrong because dismissing without investigation may miss a real threat. Option D is wrong because suppressing low confidence alerts may cause missed detections.

Answer

Dismiss the incident as a false positive due to low confidence.

Answer

Suppress all future alerts from Defender for Cloud Apps with low confidence.

Answer

Escalate the incident to the SOC manager immediately.

Question 9

You are investigating a brute force attack on a user account in Microsoft Entra ID. The sign-in logs show multiple failed attempts from different IP addresses. Which property in the sign-in logs indicates the type of authentication used?

Accepted Answer

authenticationRequirement. Option C is correct because authenticationRequirement indicates the type of authentication (e.g., multi-factor authentication). Option A is wrong because conditionalAccessStatus is for policy evaluation. Option B is wrong because riskEventTypes is for risk detection. Option D is wrong because clientAppUsed indicates the application, not authentication type.

Answer

riskEventTypes

Answer

conditionalAccessStatus

Answer

clientAppUsed

Question 10

Which TWO actions are valid for containing a compromised user account in Microsoft 365 Defender? (Choose two.)

Accepted Answer

Disable the user account in Microsoft Entra ID.. A and D are correct. Disabling the user account immediately blocks access. Resetting the password forces the user to change credentials. B is wrong because deleting the mailbox is destructive and may be unnecessary. C is wrong because blocking the user's IP may affect other users. E is wrong because revoking session tokens does not prevent new sign-ins with valid credentials.

Answer

Block the user's IP address in Defender for Cloud Apps.

Answer

Revoke the user's session tokens.

Answer

Delete the user's mailbox in Exchange Online.

Question 11

Which THREE data sources in Microsoft Sentinel can be used to detect lateral movement in a network? (Choose three.)

Accepted Answer

Microsoft Defender for Endpoint (device events). A, B, and D are correct. Windows Security Events (Event ID 4624) show logon attempts. Windows Event Logs (Event ID 5140) show network share accesses. Microsoft Defender for Endpoint provides process and network connections. C is wrong because Azure AD sign-in logs are for cloud authentication, not lateral movement. E is wrong because DNS logs may show network resolution but not direct lateral movement evidence.

Answer

DNS logs

Answer

Microsoft Entra ID sign-in logs

Question 12

Which TWO Microsoft 365 Defender portals provide automated investigation and response capabilities? (Choose two.)

Accepted Answer

Microsoft Defender for Endpoint (security.microsoft.com). A and D are correct. Microsoft 365 Defender (https://security.microsoft.com) provides automated investigation for incidents. Microsoft Defender for Endpoint has its own AIR capabilities. B is wrong because Microsoft Sentinel is a SIEM, not a portal for automated response. C is wrong because Microsoft Purview is for compliance. E is wrong because Microsoft Intune is for device management.

Answer

Microsoft Purview compliance portal

Answer

Microsoft Sentinel (portal.azure.com)

Answer

Microsoft Intune admin center

Question 13

Your organization uses Microsoft Sentinel. A security analyst reports that an incident was automatically closed without investigation. You need to identify why the incident was closed automatically. Which Sentinel feature should you review?

Accepted Answer

Automation rules. Automation rules can be configured to automatically close incidents based on conditions. Playbooks require manual triggering or automation rules. Analytics rules create incidents, not close them. Workbooks and watchlists do not close incidents.

Answer

Analytics rules

Answer

Playbooks

Answer

Workbooks

Answer

Watchlists

Question 14

During an incident response, you need to collect a memory dump from a compromised Windows 10 device managed by Microsoft Defender for Endpoint. Which action should you take in the Microsoft Defender XDR portal?

Accepted Answer

Initiate a Live Response session and run the 'memdump' command. Live Response allows executing commands like collecting memory dumps. Running a PowerShell script or initiating a scan does not collect a memory dump. The other options are not available actions.

Answer

Run a custom detection script

Answer

Execute a Power Automate flow to collect memory

Answer

Start a full antivirus scan

Answer

Submit the device for automated investigation

Question 15

An incident in Microsoft Sentinel was assigned to you. After investigation, you determine it is a false positive. What should you do to resolve the incident?

Accepted Answer

Close the incident with classification 'FalsePositive'. The correct action is to close the incident with a classification of 'FalsePositive'. Changing status or adding comments does not resolve it properly. Deleting is not recommended.

Answer

Add a comment and leave it open

Answer

Delete the incident

Answer

Reassign to another analyst

Answer

Change the status to 'Active'