SC-200 Respond to security incidents Practice Test 30 — 15 Questions

Question 1

After a security incident, the SOC team needs to preserve forensic evidence from a compromised Microsoft Entra ID joined Windows 10 device. The device is still online. Which tool should the team use to collect a forensic image of the hard drive?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Defender for Endpoint. Microsoft Defender for Endpoint can collect a full forensic image from the device via Live Response. Option A is wrong because BitLocker is encryption, not imaging. Option B is wrong because Microsoft Entra ID is an identity provider, not a tool for forensic imaging. Option C is wrong because Microsoft Intune does not support forensic imaging.

Answer

Microsoft BitLocker Administration and Monitoring

Answer

Microsoft Entra ID

Answer

Microsoft Intune

Question 2

A security analyst uses Microsoft Sentinel to investigate an incident involving data exfiltration from Azure Blob Storage. The analyst needs to determine which user accessed the storage account and from which IP address. Which data source should the analyst query?

Accepted Answer

Azure Activity logs. Azure Activity logs storage account management events, including access logs. Option A is wrong because Azure AD sign-in logs only show authentication to Azure AD, not storage access. Option C is wrong because Azure Monitor metrics are aggregated and don't show per-user access. Option D is wrong because Azure Security Center provides security recommendations, not access logs.

Answer

Azure AD sign-in logs

Answer

Azure Security Center alerts

Answer

Azure Monitor metrics

Question 3

During an incident response, a security engineer needs to block an attacker's IP address at the network level for all devices in the organization. The organization uses Microsoft Defender for Endpoint and Microsoft Intune for device management. What is the most efficient way to achieve this?

Accepted Answer

Create a custom indicator (IOC) for the IP address in Microsoft Defender for Endpoint. A custom indicator in Defender for Endpoint blocks the IP across all onboarded devices. Option B is wrong because blocking in Microsoft Sentinel only affects log ingestion, not network traffic. Option C is wrong because Intune policies are for configuration, not real-time blocking. Option D is wrong because Azure Firewall would need to be in the network path and is a separate product.

Answer

Add the IP address to a blocklist in Microsoft Sentinel

Answer

Create a device configuration policy in Microsoft Intune to block the IP

Answer

Configure Azure Firewall to block the IP

Question 4

A SOC analyst receives a phishing alert in Microsoft Defender for Office 365. The analyst needs to quickly determine if any users clicked the malicious link. Which action should the analyst take first?

Accepted Answer

Open the email entity page to view click details. The email entity page in Microsoft Defender for Office 365 provides detailed information about a specific email, including click verdicts for any URLs contained within. This allows the analyst to quickly see if any users clicked the malicious link. Option A (Threat Explorer) can also be used, but it requires more steps to filter for the specific email and then view click details. Option B (user entity page) shows user-specific activities and alerts, but not email-specific click details. Option D (hunting query in Microsoft Sentinel) is effective but slower than directly viewing the email entity page in Defender for Office 365.

Answer

Use Threat Explorer to search for the email subject

Answer

Open the user entity page for each recipient

Answer

Run a hunting query in Microsoft Sentinel

Question 5

Which TWO actions should a security analyst take to contain a ransomware outbreak on a Windows server that has Microsoft Defender for Endpoint installed?

Accepted Answer

Run a full scan with Microsoft Defender Antivirus. Options B and D are correct. B isolates the device to prevent lateral movement, and D runs a scan to remove the ransomware. Option A is wrong because resetting the password does not stop the ransomware. Option C is wrong because uninstalling would remove protection. Option E is wrong because a full restore might reintroduce the malware.

Answer

Reset the local administrator password

Answer

Uninstall Microsoft Defender for Endpoint and reinstall

Answer

Restore the system from a backup

Question 6

Which THREE data sources should be included in a Microsoft Sentinel workspace to comprehensively monitor for lateral movement within an Azure environment?

Accepted Answer

Azure AD sign-in logs. Options A, C, and E are correct because they cover identity (Azure AD sign-in logs), network (Azure Network Security Group flow logs), and compute/control plane (Azure Activity logs) aspects of lateral movement. Option B (Power BI audit logs) is irrelevant for infrastructure lateral movement, as Power BI is a business analytics service. Option D (Azure DevOps audit logs) pertains to development pipeline activities, not runtime lateral movement within an Azure environment.

Answer

Power BI audit logs

Answer

Azure DevOps audit logs

Question 7

Which TWO options are valid ways to create an incident in Microsoft Sentinel?

Accepted Answer

From an alert generated by an analytics rule. Options B and E are correct. Analytics rules generate alerts that become incidents automatically when configured. Microsoft Defender XDR incidents are synchronized to Sentinel by default (or via connector). Option A is wrong because workbooks are read-only visualizations, not incident creation tools. Option C is wrong because watchlists are used for enrichment and correlation, not to create incidents. Option D is wrong because hunting queries only surface results; incidents must be created manually from them.

Answer

By creating a workbook

Answer

By importing data from a watchlist

Answer

By running a hunting query

Question 8

Your organization has Microsoft Sentinel deployed in a central Log Analytics workspace. You have a custom analytics rule that detects brute-force attacks against Azure AD by counting failed sign-ins from the same IP address within 5 minutes. The rule currently generates an incident for every 10 failed attempts. During a recent incident, a single IP address generated over 200 failed sign-ins in 10 minutes, resulting in 20 separate incidents. The SOC team is overwhelmed and wants to reduce the number of incidents without lowering the detection threshold. You need to modify the rule to generate only one incident per IP address within a 1-hour window. What should you do?

Accepted Answer

Modify the analytics rule to group alerts by IP address with a 1-hour window. Grouping alerts by IP address with a 1-hour window consolidates all alerts from that IP into a single incident, reducing the number of incidents without lowering the detection threshold. Option A is wrong; alert suppression only suppresses alerts after an incident is created but does not group them. Option C is wrong; raising the threshold would still generate multiple incidents if exceeded multiple times. Option D is wrong; automation rules cannot retroactively group already-created incidents.

Answer

Enable alert suppression in the analytics rule for 1 hour

Answer

Create a new analytics rule that triggers only when failed sign-ins exceed 200 in 5 minutes

Answer

Create an automation rule that closes duplicate incidents from the same IP

Question 9

Your company uses Microsoft Defender for Endpoint (MDE) on all Windows 10 devices. You are investigating a machine that is suspected of being part of a botnet. The machine is communicating with a known C2 server at IP 203.0.113.55. You have confirmed that the IP is malicious. You need to block all outbound traffic from the machine to that IP immediately, and also ensure that no other devices in the organization can communicate with that IP. The solution must be implemented without deploying additional network appliances. What should you do?

Accepted Answer

Create a custom network indicator in Microsoft Defender for Endpoint with action 'Alert and block'. Custom network indicators in MDE can block IPs at the device level, and the action applies to all MDE-enrolled devices. Option A is wrong because MDE network protection does not support custom IP blocking via policy. Option C is wrong because the MDE portal does not have a global IP blocklist feature. Option D is wrong because Windows Defender Firewall rules would need to be deployed via GPO or Intune, which is slower and more complex.

Answer

Create a network protection policy in Microsoft Intune to block the IP

Answer

Use the Microsoft Defender for Endpoint portal to block the IP globally

Answer

Create a firewall rule in Windows Defender Firewall to block outbound traffic to the IP, and deploy via Group Policy

Question 10

Your organization uses Microsoft Sentinel for security operations. The SOC team receives an incident that was generated from a Microsoft Defender for Cloud Apps alert. The incident involves a user who is downloading a large number of files from SharePoint Online. The analyst needs to suspend the user's account immediately to stop the potential data exfiltration. The organization has a Microsoft Sentinel playbook that can suspend a user in Microsoft Entra ID. However, the playbook is not triggering automatically. You need to ensure that the playbook runs automatically whenever a Defender for Cloud Apps alert generates an incident in Sentinel. What should you configure?

Accepted Answer

Create an automation rule that triggers the playbook when an incident is created from Defender for Cloud Apps. An automation rule can be created to trigger a playbook on incident creation, specifically filtering for incidents from Defender for Cloud Apps. This enables automatic execution of the playbook to suspend the user. Option B is incorrect because a scheduled analytics rule is for generating alerts based on queries, not for triggering playbooks on existing incidents. Option C is incorrect because enabling the connector only syncs alerts, but does not automatically run playbooks; an automation rule is required. Option D is incorrect because the playbook's trigger is configured in the automation rule, not by modifying the playbook itself.

Answer

Create a scheduled analytics rule that detects large file downloads

Answer

Enable the Microsoft Defender for Cloud Apps connector to sync alerts

Answer

Modify the playbook to run on alert creation

Question 11

Your organization uses Microsoft Sentinel. An incident with severity Medium is created from an analytics rule that detects brute-force attempts against on-premises domain controllers. The incident contains alerts from multiple machines. You need to automatically run a playbook that collects evidence from affected machines and then changes the incident severity to High. What should you configure?

Accepted Answer

Create an automation rule that triggers on incident creation with severity Medium, runs the playbook, and then changes severity to High.. Automation rules in Microsoft Sentinel allow you to trigger playbooks automatically based on conditions. The automation rule can be set to trigger when an incident is created, check the severity condition, run a playbook, and then change the severity. Option A is correct because it enables a single automation rule to orchestrate both the playbook execution and severity change. Option B is wrong because incident creation settings (enrichment) can add context to incidents but cannot automatically run playbooks or change severity; automation rules are required to trigger playbooks on incident creation. Option C is wrong because playbooks cannot change severity directly without an automation rule. Option D is wrong because editing the playbook alone does not trigger it automatically; an automation rule is needed to invoke the playbook on incident creation.

Answer

Configure the incident creation settings to enrich the incident with the playbook output.

Answer

Modify the analytics rule to include the playbook as an automated response.

Answer

Edit the playbook to include a step that changes incident severity after collecting evidence.

Question 12

A security analyst in your company uses Microsoft Defender XDR to investigate an incident involving a user who received a malicious email. The analyst needs to block the sender's email address across all tenants in the organization. What is the most efficient way to achieve this?

Accepted Answer

In the Microsoft 365 Defender portal, use the action center to block the sender's email address across all tenants.. Microsoft Defender XDR allows you to take action on entities like email senders. Using the action center, you can block the sender's email address globally, which applies to all tenants. Option C is correct. Option A is wrong because Exchange admin center works per tenant and is not as efficient for cross-tenant blocking. Option B is wrong because Microsoft Entra ID admin center manages identities, not email blocking. Option D is wrong because Microsoft Purview is for compliance, not email threat protection.

Answer

From the Microsoft 365 Defender portal, go to Email & collaboration > Exchange admin center and block the sender.

Answer

In Microsoft Purview, create a data loss prevention policy to block the sender.

Answer

In Microsoft Entra ID admin center, create a conditional access policy to block the sender.

Question 13

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. An incident in Microsoft Defender XDR is automatically synchronized to Microsoft Sentinel. The incident in Sentinel is closed by the SOC team, but the corresponding incident in Defender remains open. What should you do to ensure that closing an incident in Sentinel also closes its linked incident in Defender?

Accepted Answer

Configure an automation rule in Microsoft Sentinel that triggers on incident closure and runs a playbook that closes the corresponding incident in Microsoft Defender XDR.. Microsoft Sentinel can be configured to sync incident status back to Microsoft Defender XDR using automation rules. Option B is correct. Option A is wrong because the bi-directional sync is not automatic and requires configuration. Option C is wrong because the Defender portal does not automatically sync with Sentinel. Option D is wrong because the integration settings in Defender do not control Sentinel's incident closure.

Answer

In the Microsoft Defender XDR portal, enable the setting to automatically close incidents when the linked Sentinel incident is closed.

Answer

Use the Microsoft Defender XDR API to set up a webhook that listens for Sentinel incident closure.

Answer

Enable the bi-directional sync in the Microsoft Sentinel data connector for Microsoft Defender XDR.

Question 14

Your organization uses Microsoft Sentinel. You need to design a solution that automatically responds to incidents with severity High and enriches them with threat intelligence from Microsoft Defender Threat Intelligence. Which TWO actions should you include?

Accepted Answer

Create an automation rule that triggers when an incident is created with severity High and runs a playbook to enrich the incident with threat intelligence.. To automatically respond to incidents, you use automation rules. Option A is correct because automation rules can be set to trigger on incident creation with severity High and run a playbook that enriches the incident with threat intelligence. Option E is correct because you can add an action in the automation rule to change the incident severity after enrichment if needed. Option B is incorrect because automation rules do not modify analytics rule queries; they trigger on incidents. Option C is incorrect because you cannot run a playbook directly from the analytics rule; it must be triggered by an automation rule. Option D is incorrect because the analytics rule's incident configuration does not automatically run playbooks without an automation rule.

Answer

Set the automation rule to modify the analytics rule's query to include threat intelligence.

Answer

Configure the playbook to run directly from the analytics rule that generates the incident.

Answer

Use the analytics rule's incident configuration to automatically run the playbook.

Question 15

A SOC analyst in your organization is investigating an incident in Microsoft Defender XDR that involves a compromised user account. The analyst needs to gather more information about the user's recent activities. Which THREE actions can the analyst take directly from the incident page?

Accepted Answer

Run an advanced hunting query related to the user.. From the Microsoft Defender XDR incident page, the analyst can perform several investigative actions directly. Option A is correct because the incident page provides an 'Advanced hunting' button that pre-fills a query related to the user. Option B is correct because the analyst can trigger an automated investigation playbook directly from the incident page to gather more information. Option C is correct because the incident page allows viewing the user's timeline of recent activities. Option D is incorrect because deleting a user account is not a standard action available from the incident page; account management is done via Microsoft Entra ID. Option E is incorrect because resetting a user's password is not directly available from the incident page; it must be done through Microsoft Entra ID admin center.

Answer

Delete the user account.

Answer

Reset the user's password directly from the incident.