SC-200 Respond to security incidents Practice Test 30 — 15 Questions

Question 1

Refer to the exhibit. The KQL query runs in Microsoft Sentinel and returns no results. The analyst expects to see failed logon attempts. What is the most likely reason?

Accepted Answer

The ResultType field does not exist in IdentityLogonEvents.. The query filters on ResultType == 'Failed', but the field is likely named 'Result' or uses different values like 'Failure'. Also, the table 'IdentityLogonEvents' may not exist; it might be 'AADSignInEventsBeta' or similar. But the most common issue is incorrect field name for result type.

Answer

The Application filter is incorrect.

Answer

The summarize operator is misused.

Answer

The TimeRange variable is too short.

Question 2

A security operations center (SOC) analyst is investigating an incident involving a user who received a phishing email with a malicious macro. The analyst needs to determine if any other users received the same email. Which Microsoft 365 Defender feature should the analyst use?

Accepted Answer

Threat Explorer (Investigation). Threat Explorer in Microsoft 365 Defender allows hunting for email messages by sender, subject, or other attributes. Advanced Hunting is for raw queries; Email entity page shows one email; Alert queue filters by alert not email.

Answer

Advanced Hunting

Answer

Alert queue filtering

Answer

Email entity page

Question 3

An organization uses Microsoft Purview Communication Compliance to detect insider trading. An alert is generated for a user who sent a message containing sensitive financial data. The compliance officer needs to initiate a legal hold on the user's mailbox to preserve evidence. Which role must the officer have to perform this action?

Accepted Answer

eDiscovery Manager (Legal Hold). Legal hold requires the 'Legal Hold' role in Microsoft Purview (eDiscovery). Communication Compliance roles alone do not include hold capabilities. Exchange Online roles may not have cross-functional hold.

Answer

Communication Compliance admin

Answer

Compliance Administrator (Global)

Answer

Exchange Online Mailbox Search role

Question 4

Which TWO actions are appropriate when handling a confirmed ransomware incident in Microsoft 365?

Accepted Answer

Isolate affected devices from the network.. Option D is correct because isolating affected devices from the network is a standard containment step that prevents the ransomware from spreading laterally to other endpoints and limits further encryption or exfiltration within the Microsoft 365 environment. Option E is correct because changing passwords for all potentially compromised accounts revokes the attackers' access, invalidates stolen credentials, and is essential when identity compromise (e.g., via phishing or token theft) is a common ransomware entry vector in Microsoft 365. Option A is not appropriate as a primary incident response action because a full antivirus scan is a remediation/detection step that does not contain an active ransomware incident and may be ineffective against fileless or cloud-based attacks. Option B is wrong because restoring from backup immediately without investigation can reintroduce the threat or restore already-compromised data, and the root cause must be identified first. Option C is wrong because paying the ransom is discouraged by Microsoft and law enforcement, does not guarantee data recovery, and may fund further criminal activity.

Answer

Run a full antivirus scan on all devices.

Answer

Restore encrypted files from backup immediately without investigation.

Answer

Pay the ransom to regain access.

Question 5

You are investigating a security incident in Microsoft Sentinel where a user reported receiving a phishing email with a malicious attachment. You need to identify all users who received the same email within the last 24 hours. Which KQL query should you use?

Accepted Answer

EmailEvents | where SenderFromAddress == 'attacker@example.com' and Subject == 'Invoice' and Timestamp > ago(24h) | project RecipientEmailAddress. To find all users who received the same phishing email, you must pivot on the email's identifying attributes — sender and subject — rather than the reported recipient. Querying EmailEvents filtered by SenderFromAddress, Subject, and a 24-hour window, then projecting RecipientEmailAddress, returns every recipient of that campaign.

Answer

EmailEvents | where RecipientEmailAddress == 'user@contoso.com' and Timestamp > ago(24h) | project SenderFromAddress, Subject

Answer

EmailUrlInfo | where Url == 'http://malicious.com' | project RecipientEmailAddress

Answer

EmailAttachmentInfo | where FileName == 'malicious.doc' | project RecipientEmailAddress

Question 6

During a ransomware response in Microsoft Defender XDR, you identify that multiple devices are communicating with a known C2 server over port 443. You need to block this communication across all devices immediately. What is the most effective course of action?

Accepted Answer

Create an indicator of compromise (IoC) in Microsoft Defender for Endpoint with action 'Block'. Creating an indicator of compromise in Microsoft Defender for Endpoint with action 'Block' is the most effective immediate action. The indicator is enforced by the Defender for Endpoint sensor and blocks the known C2 IP or domain across all onboarded devices, regardless of network location. Option A applies only to email and collaboration content. Option B only blocks traffic that passes through the firewall and may miss remote devices or non-firewall paths. Option D applies only to cloud app sessions, not general C2 network traffic.

Answer

Add the C2 server domain to the Microsoft Defender for Office 365 Tenant Allow/Block List

Answer

Create a firewall rule to block outbound traffic to the C2 server IP address

Answer

Add the C2 server URL to the custom indicator list in Microsoft Defender for Cloud Apps

Question 7

You receive an alert in Microsoft Sentinel indicating a potential privilege escalation using the 'AzureHound' tool. You need to determine if the alert is a true positive. What is the first step you should take?

Accepted Answer

Check the user's recent activity and the targeted resource in Microsoft Entra ID audit logs. To determine whether an AzureHound privilege-escalation alert is a true positive, you must validate the underlying identity activity — specifically what the user did and which resource was targeted — using Microsoft Entra ID audit logs. AzureHound enumerates Microsoft Entra ID/Entra ID objects and permissions, so the audit trail of directory reads, role assignments, or consent grants is the authoritative evidence. This confirms or refutes the alert before taking disruptive action.

Answer

Review the Microsoft Defender for Cloud recommendation for the resource

Answer

Block the user account immediately

Answer

Run a full antivirus scan on all devices

Question 8

Which TWO remediation actions are available in Microsoft Defender for Endpoint when responding to a malware infection?

Accepted Answer

Run a full antivirus scan. Option A (Run a full antivirus scan) is correct because Microsoft Defender for Endpoint's device response actions include initiating a full Microsoft Defender Antivirus scan on the endpoint to detect and remediate residual malware artifacts beyond what was already found. Option E (Isolate the device from the network) is correct because device isolation is a core Defender for Endpoint live response action that cuts the endpoint off from the network (while optionally allowing Outlook/Teams communication) to contain the infection and prevent lateral movement. Option B is not a Defender for Endpoint remediation action; disabling user accounts is handled through identity services such as Active Directory or Entra ID, not the MDE device response console. Option C is not offered as an MDE response action; factory reset is a device-management operation (e.g., Intune), not a Defender for Endpoint remediation. Option D is incorrect because blocking an application in Defender for Cloud Apps is a Cloud App Security (CASB) control for cloud app sessions, not a Defender for Endpoint endpoint remediation action.

Answer

Disable the user account

Answer

Reset the device to factory settings

Answer

Block the application in Defender for Cloud Apps

Question 9

A user reports that they cannot access their Microsoft 365 apps after clicking a link in an email. You suspect token theft. In Microsoft Defender XDR, which incident investigation action should you take first to verify the scope?

Accepted Answer

Review the user's sign-in logs in Microsoft Entra ID for anomalous locations. When token theft is suspected, the first investigative step is to determine scope by reviewing the user's sign-in logs in Microsoft Entra ID for anomalous locations, IPs, or impossible-travel patterns. This confirms whether the token was used from an unexpected location and helps identify other affected accounts before taking containment actions. Verifying scope precedes remediation.

Answer

Isolate the user's device from the network

Answer

Check the user's device for malware using Microsoft Defender for Endpoint

Answer

Investigate the email in Microsoft Defender for Office 365

Question 10

Which TWO data sources should you enable in Microsoft Sentinel to improve detection of credential theft attacks?

Accepted Answer

Windows Security Events (via AMA). Option A, Windows Security Events (via AMA), is correct because it collects the Security event log through the Azure Monitor Agent and surfaces the exact events credential-theft detection relies on, such as 4624/4625 logons, 4648 explicit-credential use, 4672 special privileges, and 4768/4769 Kerberos TGT/TGS requests used to spot pass-the-hash, pass-the-ticket, and Kerberoasting. Option C, Microsoft Entra ID Sign-in logs, is correct because it captures Entra ID authentication telemetry — sign-in results, conditional access outcomes, MFA details, and risk detections — which Sentinel uses to detect password spray, brute force, impossible travel, and token/session theft against cloud identities. Option B, DNS logs, is not required here since DNS telemetry supports exfiltration, C2, and DGA detection rather than credential theft. Option D, Windows Firewall logs, records allowed/blocked network connections and is irrelevant to authentication abuse. Option E, Performance counters, provides host resource metrics and has no bearing on detecting stolen credentials.

Answer

DNS logs

Answer

Windows Firewall logs

Answer

Performance counters

Question 11

Which THREE steps are part of the containment phase of incident response in a hybrid environment using Microsoft Defender XDR?

Accepted Answer

Disable compromised user accounts in Microsoft Entra ID. Option C is correct because disabling compromised user accounts in Microsoft Entra ID is a classic containment action that stops an attacker from continuing to use stolen credentials for lateral movement or further access. Option D is correct because isolating affected devices via Microsoft Defender for Endpoint cuts off the endpoint's network communication while preserving it for investigation, which is a core containment step in a hybrid environment. Option E is correct because blocking malicious IP addresses at the firewall prevents ongoing command-and-control or exfiltration traffic to known-bad infrastructure, containing the spread of the incident. Options A and B are not containment: removing malware is part of eradication, and restoring data from backups belongs to the recovery phase, which occurs after the threat has been fully eliminated.

Answer

Remove malware from affected systems

Answer

Restore data from backups

Question 12

You are testing this analytics rule. It should detect encoded PowerShell commands not from System32, but it is generating false positives. What is the most likely cause?

Accepted Answer

The rule does not exclude other legitimate paths like SysWOW64. The rule is designed to detect encoded PowerShell commands not originating from System32, but it is generating false positives. The most likely cause is that the rule does not exclude other legitimate paths such as SysWOW64, which also contains legitimate PowerShell executables on 64-bit Windows. Adding an exclusion for SysWOW64 (and possibly other trusted paths) would reduce false positives while maintaining detection of suspicious executions.

Answer

The severity should be Informational

Answer

The rule should also include System32

Answer

The query syntax is incorrect

Question 13

You are handling an incident where a user's account was used to access sensitive data from an unusual location. Microsoft Entra ID Identity Protection flagged the sign-in as risky. You need to determine if the account is compromised. Which investigation step should you perform first?

Accepted Answer

Review the sign-in details and compare with the user's typical behavior. Before taking any remediation action, you should first review the sign-in details and compare them with the user's typical behavior to determine if the account is actually compromised. This investigation step provides context and helps avoid unnecessary disruptions. Only after confirming a compromise should you proceed with actions like blocking or password reset.

Answer

Block the user from signing in

Answer

Force a password reset for the user

Answer

Check if the device used is managed by Intune

Question 14

After a security incident, you need to preserve evidence from a compromised Microsoft 365 tenant. What is the best method to preserve data?

Accepted Answer

Place the user's mailbox and OneDrive on litigation hold. Placing the user's mailbox and OneDrive on litigation hold is the best method for preserving evidence because it preserves all data in its original state, preventing deletion or modification. Option A (backup of entire tenant) is excessive and not immediate. Option B (eDiscovery) is for search and export, not preservation. Option C (export to PST and delete) destroys the original evidence, which is inadvisable.

Answer

Take a backup of the entire tenant

Answer

Use Microsoft Purview eDiscovery to search and export

Answer

Export the data to a PST file and delete the original

Question 15

During a security incident response, you need to collect forensic evidence from a Windows 10 device that is suspected to be compromised. The device is not domain-joined and is located in a remote office. You have remote administrative access. Which Microsoft 365 tool should you use to acquire a memory dump of the device?

Accepted Answer

Microsoft Defender for Endpoint. Microsoft Defender for Endpoint includes live response and the ability to collect forensic artifacts, including memory dumps, from onboarded devices. It supports remote acquisition from non-domain-joined Windows 10 devices as long as they are onboarded and you have the appropriate permissions. Sentinel, Purview eDiscovery, and Intune do not provide memory dump acquisition.

Answer

Microsoft Sentinel

Answer

Microsoft Purview eDiscovery

Answer

Microsoft Intune