SC-200 Respond to security incidents Practice Test 3 — 15 Questions

Question 1

You are investigating a security incident in Microsoft Sentinel involving a series of failed logon attempts followed by a successful logon from a different geographic location. The user's account is a privileged administrator. The incident is assigned a medium severity. What should you do first to contain the potential breach?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Disable the user's account immediately. The correct first step is to disable the user's account immediately. This is the most effective containment action because it prevents any further unauthorized access using that account, even if an attacker has established a session. Resetting the password (option B) would not terminate existing authenticated sessions and is secondary. Reviewing audit logs (option C) is analysis, not containment, and creating a new analytics rule (option D) is a preventative measure that does not address the immediate threat.

Answer

Reset the user's password

Answer

Review the audit logs for the user's activity

Answer

Create a new analytics rule to detect similar attempts

Question 2

Your organization uses Microsoft Sentinel and Microsoft Defender for Identity. An incident is created for a user whose credentials were used from an unusual location to access sensitive HR data. The user's account is a domain admin. The security team needs to ensure the attacker cannot use the account again. What should you do first?

Accepted Answer

Reset the user's password and revoke the Kerberos TGT. Resetting the compromised domain admin's password is necessary but not sufficient by itself, because a Kerberos TGT already issued to the attacker remains valid (encrypted with the KDC's krbtgt key, not the user's password) until it expires — typically up to 10 hours, renewable up to 7 days. Microsoft does not provide a live 'revoke this one TGT' admin command; real-world options to force faster invalidation include disabling then re-enabling the account (which increments values Windows checks during the periodic account-revocation recheck), or in a severe compromise, resetting the krbtgt account password twice (which invalidates ALL TGTs domain-wide, not just this one — a drastic, disruptive step usually reserved for full domain-compromise scenarios like Golden Ticket recovery). The core lesson — a password reset alone doesn't kill an already-issued TGT — is valid; the named tool for doing so is not.

Answer

Remove the user from the Domain Admins group

Answer

Force the user to log out of all sessions

Answer

Disable the user's account in Active Directory

Question 3

Your organization uses Microsoft Defender for Cloud to protect Azure resources. A security alert indicates that a virtual machine (VM) is communicating with a known malicious IP. The analyst needs to isolate the VM from the network to prevent further data exfiltration. What should the analyst do?

Accepted Answer

Apply a Just-in-time VM access policy in Microsoft Defender for Cloud to deny all inbound and outbound traffic.. Applying a Just-in-time VM access policy in Microsoft Defender for Cloud denies all inbound and outbound traffic, effectively isolating the VM. Option A is incorrect because Azure Bastion provides RDP/SSH access, not isolation. Option B is incorrect because Azure Monitor creates alerts but does not directly isolate VMs. Option C is incorrect because an Azure Firewall rule blocks traffic for the entire network, not just the single VM.

Answer

Use Azure Bastion to connect to the VM and shut it down.

Answer

Use Azure Monitor to create an alert and then manually stop the VM.

Answer

Create an Azure Firewall rule to block traffic to the malicious IP.

Question 4

Refer to the exhibit. An analyst runs the query to identify the top 10 entities with the most malware alerts. However, the query returns no results. What is the most likely reason?

Accepted Answer

The AlertName field does not contain the substring 'Malware' (case-sensitive issue).. The query returns no results because none of the AlertName values in the SecurityAlert table for the queried period actually contain the term 'Malware' (e.g., alerts might instead be named 'Trojan Detected' or 'Virus Alert'). This is a value-matching mismatch, not a case-sensitivity issue — KQL's 'has' operator is case-insensitive by default, so 'malware', 'Malware', and 'MALWARE' would all match equally. The analyst should first run 'SecurityAlert | where TimeGenerated > ago(7d) | distinct AlertName' to see the actual alert name values before writing a term filter.

Answer

The SecurityAlert table does not contain the AlertName field.

Answer

The 'has' operator requires an exact match.

Answer

The 'take 10' operator returns no results because there are fewer than 10 alerts.

Question 5

You receive a Microsoft Defender for Identity alert for a suspicious Kerberos ticket request. What is the most likely intent of this attack?

Accepted Answer

Credential theft to gain persistent access.. Suspicious Kerberos ticket requests in Defender for Identity typically indicate credential theft techniques such as Kerberoasting or AS-REP roasting, where an attacker requests service tickets to crack service account passwords offline and gain persistent access. The alert is designed to surface abnormal ticket-request patterns that deviate from normal authentication behavior. Lateral movement and DoS are different attack phases and would trigger different Defender for Identity alerts.

Answer

Lateral movement using compromised service accounts.

Answer

Denial of service on domain controllers.

Answer

Data exfiltration from SharePoint.

Question 6

Refer to the exhibit. You are investigating a malware outbreak in Microsoft Sentinel. The KQL query returns no results. What is the most likely reason?

Accepted Answer

The alert name in the query does not match the actual alert name.. The KQL query returns no results most likely because the alert name specified in the query does not match the actual alert name in the Sentinel incidents. Alert names are case-sensitive and must match exactly. Therefore, the most likely reason is a mismatch in the alert name.

Answer

The time range is too restrictive.

Answer

No alerts were generated in the last hour.

Answer

The query syntax is incorrect.

Question 7

Which TWO actions can you perform in Microsoft Defender XDR's automated investigation and response (AIR) to contain a threat? (Select TWO.)

Accepted Answer

Isolate a device from the network.. Option A is correct because Microsoft Defender XDR's AIR can automatically or manually isolate a device from the network, cutting off lateral movement and command-and-control traffic while preserving the machine for investigation. Option E is correct because AIR supports soft-deleting email messages (moving them to the Recoverable Items folder) to remove malicious or phishing content from mailboxes without permanent data loss. Firewall rule creation to block an IP (B) is not an AIR containment action in Defender XDR, and disabling an account (C) or resetting a password (D) are identity remediation actions handled through Microsoft Entra ID, not AIR containment tasks.

Answer

Add a firewall rule to block an IP.

Answer

Disable a user account.

Answer

Reset a user's password.

Question 8

Which TWO are valid methods to submit a file for analysis in Microsoft Defender for Endpoint? (Select TWO.)

Accepted Answer

Submit a file using the Microsoft 365 Defender API.. Option B is correct because Microsoft Defender for Endpoint exposes the Microsoft 365 Defender API, including the 'Submit or Update Indicators' and file submission endpoints (e.g., POST to /api/machines/{machineId}/files or the /api/advancedhunting file submission routes), allowing programmatic submission of files for deep analysis. Option E is correct because the Microsoft 365 Defender portal (security.microsoft.com) provides a built-in 'Submit file' action under Email & collaboration > Submissions or via the file entity page, which sends the file to Microsoft for automated analysis. Option A is not a valid submission method: live response is used to run commands and collect forensic artifacts on a device, not to submit files for cloud analysis. Option C is incorrect because Microsoft Sentinel is a SIEM/SOAR platform that ingests and queries Defender data; it does not provide a native file-submission mechanism to Defender for Endpoint. Option D is incorrect because Microsoft Intune is a device management service and does not include a file submission feature for Defender for Endpoint analysis.

Answer

Submit a file via live response.

Answer

Submit a file through Microsoft Sentinel.

Answer

Submit a file via Microsoft Intune.

Question 9

Refer to the exhibit. You are creating an automation rule in Microsoft Sentinel to trigger a playbook when an alert is created. However, the playbook does not run. What is the most likely cause?

Accepted Answer

The automation rule lacks permissions to the playbook.. When a Microsoft Sentinel automation rule triggers a playbook, the rule executes under a specific Microsoft Entra ID (Azure AD) service principal or managed identity context. That identity must be granted the 'Microsoft Logic Apps Workflow Operator' (or Contributor) role on the playbook's resource group or the Logic App resource itself. Without this permission, the automation rule cannot invoke the playbook, so the playbook silently fails to run even though the rule itself is valid.

Answer

The JSON syntax is invalid.

Answer

The playbook's resource ID is incorrect.

Answer

The displayName is not unique.

Question 10

After containing a security incident, what is the most important next step in the incident response process?

Accepted Answer

Eradicate the threat from all systems.. After containing a security incident, the next critical step is to conduct a post-incident review (also known as lessons learned). This phase helps the organization understand what went wrong, improve incident response processes, and prevent future incidents. Option A (monitor for signs of recurrence) is an ongoing activity but not the immediate next step after containment. Option B (recover systems to normal operation) should occur after eradication, not immediately after containment. Option C (eradicate the threat) is actually the step that comes directly after containment, but the question asks for the most important next step, emphasizing the value of reviewing and improving response procedures.

Answer

Monitor for signs of recurrence.

Answer

Recover systems to normal operation.

Answer

Conduct a post-incident review.

Question 11

Your organization uses Microsoft Defender for Cloud Apps. A security analyst receives an alert about suspicious activity from a user account indicating a potential ransomware attack. The analyst needs to quickly isolate the user's device and revoke the user's access to all cloud apps. What is the most efficient way to achieve this?

Accepted Answer

Create a Microsoft 365 Defender incident response playbook that triggers on the alert and runs automated actions.. Microsoft 365 Defender incident response playbooks (built on Logic Apps) can be triggered automatically by alerts and execute multi-step actions across Defender for Cloud Apps, Defender for Endpoint, and Entra ID — including device isolation and user session revocation — in a single automated flow. This is the most efficient way to achieve both isolation and access revocation simultaneously without manual steps.

Answer

Use Microsoft Defender for Cloud Apps Governance log to apply a user quarantine policy.

Answer

Disable the Microsoft Defender for Cloud Apps app connector for the affected cloud app.

Answer

Manually disable the user account in Microsoft Entra ID.

Question 12

During a security incident, your team needs to preserve evidence from a Microsoft Defender for Endpoint onboarded device for forensic analysis. The device is still running and connected to the network. Which action should be taken to collect a forensic image while minimizing disruption?

Accepted Answer

Use the Microsoft Defender for Endpoint Live Response capability to acquire a disk image.. Live response allows collection of a forensic image (via disk acquisition) without shutting down the device, preserving volatile data. Option A is wrong because collecting from Microsoft Sentinel is not a forensic imaging method. Option C is wrong because isolating the device stops communication but does not collect an image. Option D is wrong because it is not a built-in feature of Microsoft Purview.

Answer

Enable Microsoft Purview eDiscovery to preserve the device content.

Answer

Isolate the device from the network using Microsoft Defender for Endpoint.

Answer

Initiate a Microsoft Sentinel data collection rule to export the device logs.

Question 13

Your Microsoft Sentinel workspace ingests logs from multiple sources. During an incident, you need to quickly identify all user accounts that have been compromised based on a known malicious IP address. Which KQL operator is most efficient for this?

Accepted Answer

lookup. The `lookup` operator is the most efficient for this scenario because it performs a hash-based join that only returns rows from the left table that match the right table, without requiring the full shuffle and sort operations of a traditional join. This makes it ideal for quickly filtering a large set of user accounts against a known malicious IP address, as it minimizes resource usage and latency.

Answer

summarize

Answer

where

Answer

join kind=inner

Question 14

Refer to the exhibit. You are configuring an automation rule in Microsoft Sentinel. The rule triggers when an incident is created, changes its status to 'Active', assigns it to 'tier2', and runs a playbook. However, you notice that the playbook is not executing for incidents with severity 'Low'. What is the most likely reason?

Accepted Answer

The severityFilter excludes incidents with severity 'Low'.. The playbook is not executing for incidents with severity 'Low' because the automation rule has a severityFilter that excludes 'Low' severity incidents. Automation rules in Microsoft Sentinel can include conditions to filter incidents based on severity, status, etc. If the severityFilter is set to exclude 'Low', the rule will not trigger for those incidents, and thus the playbook will not run.

Answer

The triggers array is empty, so no incidents trigger the rule.

Answer

The rule has a condition that filters out Low severity incidents.

Answer

The playbook is disabled in Microsoft Sentinel.

Question 15

Your team uses Microsoft Defender for Endpoint. An incident involving a device is identified as a high-severity malware infection. Which THREE remediation actions can be performed directly from the incident in Microsoft 365 Defender?

Accepted Answer

Collect an investigation package from the device.. Option B is correct because from the incident's device page in Microsoft 365 Defender, responders can trigger 'Collect investigation package' to gather forensic artifacts (such as autoruns, running processes, network connections, and event logs) into a downloadable ZIP for offline analysis. Option C is correct because 'Isolate device' is a standard remediation action that restricts the device to only the Defender for Endpoint service connection, blocking lateral movement and command-and-control traffic while allowing investigation. Option D is correct because 'Run antivirus scan' (quick or full) can be initiated directly from the incident to detect and remediate additional malicious artifacts on the device. Option A is not correct because wiping a device is an Intune/device-management action, not a remediation action exposed directly from a Defender for Endpoint incident. Option E is not correct because resetting a local administrator password is not a Defender for Endpoint incident remediation action; it is handled through device management or local account tools.

Answer

Wipe the device remotely.

Answer

Reset the device's local administrator password.