SC-200 Respond to security incidents Practice Test 30 — 15 Questions

Question 1

You are investigating a phishing incident in Microsoft Defender XDR. The user reported receiving an email with a malicious link. You need to identify all users who received the same email. Which feature should you use?

Accepted Answer

Threat Explorer. Option A is correct because Threat Explorer in Microsoft Defender for Office 365 allows you to search and filter email messages by various attributes, including subject, sender, and recipients, to identify all users who received a specific email. Option B (Hunting) is for proactive threat hunting, not for investigating a known email. Option C (Incidents) shows aggregated alerts but not detailed email tracking. Option D (Automation) is for automated investigation and response.

Answer

Automation & investigations

Answer

Incidents view

Answer

Advanced Hunting

Question 2

Your organization uses Microsoft Sentinel. You receive an incident for a potential data exfiltration involving a sensitive blob storage container. You need to determine if the data was accessed from an unusual IP address. What should you do?

Accepted Answer

Use the Incident details pane to review the entity timeline.. Option C is correct because the Incident details pane in Microsoft Sentinel includes entity timelines, which show activities related to the entities involved, such as IP addresses accessing the storage. Option A is wrong because the workbook may not have the specific query. Option B is wrong because playbooks are for automated response, not investigation. Option D is wrong because analytics rules define alert conditions, not provide investigation details.

Answer

Modify the analytics rule that triggered the incident.

Answer

Run a playbook to collect IP information.

Answer

Open the Sentinel workbook for storage monitoring.

Question 3

Your company uses Microsoft Defender for Cloud Apps. You discover that a user's account is compromised and used to access a sensitive SharePoint site from an unfamiliar IP. You need to immediately revoke the user's session and force them to re-authenticate. Which action should you take?

Accepted Answer

Apply a policy with the 'Revoke session' action.. Option B is correct because the 'Revoke session' policy action in Defender for Cloud Apps terminates the user's current session and forces re-authentication. Option A (Suspend user) is too drastic and may disrupt legitimate access. Option C (Block IP) would block all users from that IP, which may not be desired. Option D (Notify user) is not immediate and does not stop the session.

Answer

Add the IP to the blocked IP addresses list.

Answer

Create a governance action to suspend the user.

Answer

Send a notification to the user to change their password.

Question 4

You are an incident responder for a company using Microsoft 365 Defender. A critical incident is assigned to you. What is the first action you should take according to best practices?

Accepted Answer

Triage the incident to determine the scope and severity.. Option C is correct because the first step in incident response is to triage the incident to understand its scope and severity before taking any action. Option A is wrong because isolating the device should only be done after assessing the impact. Option B is wrong because you need to investigate before collecting data. Option D is wrong because escalation should occur after initial triage if needed.

Answer

Escalate the incident to senior management.

Answer

Immediately isolate all affected devices.

Answer

Collect a full memory dump from the affected systems.

Question 5

Your organization uses Microsoft Sentinel. You have an incident that involves multiple alerts. You want to automatically assign the incident to the appropriate analyst based on the alert type. What should you use?

Accepted Answer

Create an automation rule with an 'Assign incident to owner' action.. Option A is correct because automation rules in Microsoft Sentinel can perform actions like assigning incidents to specific owners based on conditions. Option B (Playbooks) are for complex automation but not ideal for simple assignment. Option C (Workbooks) are for visualization. Option D (Analytics rules) define alert conditions, not incident management.

Answer

Create a playbook that assigns the incident.

Answer

Configure the analytics rule to set the incident owner.

Answer

Use a workbook to filter incidents by alert type.

Question 6

Your company uses Microsoft Defender for Endpoint. A device shows signs of compromise with suspicious PowerShell execution. You need to collect forensic evidence before performing remediation. Which action should you use?

Accepted Answer

Collect investigation package.. Option B is correct because 'Collect investigation package' gathers a comprehensive set of forensic data from the device, including files, processes, and registry. Option A (Run antivirus scan) is a remediation step. Option C (Initiate live response) allows real-time investigation but does not collect a full package. Option D (Isolate device) is a containment measure.

Answer

Isolate the device from the network.

Answer

Run a full antivirus scan.

Answer

Initiate a live response session.

Question 7

Your organization uses Microsoft Sentinel. You receive an incident for a potential malware outbreak. You need to quickly see which entities are involved (e.g., IPs, hosts, accounts). Where should you look?

Accepted Answer

Entities tab. Option D is correct because the Entities tab in an incident shows all related entities. Option A (Timeline) shows events over time. Option B (Alerts) lists individual alerts. Option C (Comments) is for collaboration.

Answer

Incident timeline

Answer

Comments section

Answer

Alerts tab

Question 8

Your organization is responding to a security incident in Microsoft Defender XDR. You need to contain a compromised on-premises Exchange server. Which TWO actions are appropriate? (Choose two.)

Accepted Answer

Disconnect the server from the network.. Options A and C are correct. Blocking the compromised account prevents further access, and disconnecting the server from the network contains the threat. Option B (Running full scan) is a remediation step, not containment. Option D (Collecting investigation package) is evidence collection. Option E (Updating antivirus) is not immediate containment.

Answer

Collect an investigation package from the server.

Answer

Update the antivirus definitions on the server.

Answer

Run a full antivirus scan on the server.

Question 9

Your organization uses Microsoft Sentinel. A security incident related to a compromised user account has been fully investigated and remediated. Which THREE steps should you take to close the incident properly? (Choose three.)

Accepted Answer

Verify that all related alerts are resolved or closed.. Options A, B, and D are correct. Adding comments documents the investigation, changing status to Closed with classification provides closure, and ensuring no related alerts remain prevents lingering issues. Option C (Deleting the incident) is not recommended. Option E (Creating detection rule) is not necessary for closure.

Answer

Create a new analytics rule to detect similar activity.

Answer

Delete the incident to clean up the workspace.

Question 10

Your organization uses Microsoft Defender for Office 365. A user reports receiving a phishing email. You need to investigate the email and take action. Which TWO actions can you perform? (Choose two.)

Accepted Answer

Use the email entity page to take action like 'Soft delete'.. Options B and D are correct. Threat Explorer allows you to find the email and take actions like delete or soft delete. Option A (Submitting to Microsoft) is for analysis, not direct action. Option C (Creating a mail flow rule) is not immediate. Option E (Blocking sender) is possible but not directly from the incident investigation.

Answer

Create a mail flow rule to block similar emails.

Answer

Submit the email to Microsoft for analysis.

Answer

Block the sender's email address.

Question 11

You are a security analyst at Contoso. Microsoft Sentinel is deployed with the Microsoft Defender for Cloud Apps connector. An incident is generated for a high-risk sign-in from a user named JaneDoe@contoso.com. The incident severity is Medium. The incident details show that the sign-in originated from an IP address in a country where Contoso has no business presence, and the user recently changed their password. You suspect account compromise. You need to take immediate action to contain the threat and prevent further unauthorized access. The user is currently active in Microsoft Entra ID. You have the following options: A) Force the user to re-authenticate by revoking their sessions in Microsoft Entra ID. B) Disable the user account in Microsoft Entra ID. C) Block the IP address in Microsoft Defender for Cloud Apps. D) Create a Sentinel automation rule to automatically disable accounts on similar alerts. Which action should you take first to contain the current incident?

Accepted Answer

Disable the user account in Microsoft Entra ID.. Option B is correct because disabling the user account immediately stops any further access using that account, which is the most direct containment action. Option A (Revoke sessions) would end current sessions but the user could still authenticate again if credentials are compromised. Option C (Block IP) is less effective as the attacker may use other IPs. Option D (Create automation rule) is a long-term solution, not immediate containment.

Answer

Force the user to re-authenticate by revoking their sessions.

Answer

Block the IP address in Microsoft Defender for Cloud Apps.

Answer

Create a Sentinel automation rule to automatically disable accounts on similar alerts.

Question 12

Your organization uses Microsoft Defender XDR. You are investigating an incident that involves a malware infection on a Windows 10 device. The device is currently isolated from the network. The incident shows that the malware attempted to communicate with a command-and-control (C2) server. You have collected an investigation package. Now you need to remediate the device and bring it back to a clean state. The device has critical data that must not be lost. Which remediation action should you take? A) Run a full antivirus scan and remove threats. B) Perform a factory reset of the device. C) Reimage the device from a clean backup. D) Initiate a live response to manually remove the malware. Which option best balances thorough remediation with data preservation?

Accepted Answer

Reimage the device from a clean backup.. Option C is correct because reimaging from a clean backup ensures the malware is completely removed while preserving data from the backup. Option A (Full scan) may not detect all malware. Option B (Factory reset) loses all data. Option D (Live response) may miss persistent threats and is not as thorough as reimaging.

Answer

Initiate a live response to manually remove the malware.

Answer

Run a full antivirus scan and remove threats.

Answer

Perform a factory reset of the device.

Question 13

Your organization uses Microsoft Sentinel and Microsoft Defender for Identity. An incident is generated for a potential lateral movement attack. The incident is linked to multiple alerts involving a domain controller and several workstations. You need to understand the attack path and identify the initial compromised account. Which feature should you use to visualize the attack chain? A) The incident graph in Microsoft Sentinel. B) The entity timeline in Microsoft Defender for Identity. C) The Microsoft 365 Defender attack story. D) The Microsoft Purview compliance portal. Which option provides the best visual representation of the attack path?

Accepted Answer

The incident graph in Microsoft Sentinel.. Option A is correct because the Microsoft Sentinel incident graph provides a visual representation of entities and their relationships, showing the attack path. Option B (Entity timeline) is linear and not a graph. Option C (Attack story) is in Defender XDR but focuses on alerts. Option D (Purview) is for compliance, not security incidents.

Answer

The Microsoft Purview compliance portal.

Answer

The entity timeline in Microsoft Defender for Identity.

Answer

The Microsoft 365 Defender attack story.

Question 14

A security analyst receives an alert in Microsoft Defender XDR indicating that a user account was compromised. The analyst needs to isolate the affected device to prevent lateral movement. Which action should the analyst take first?

Accepted Answer

Initiate device isolation from Microsoft Defender for Endpoint. Option C is correct because initiating device isolation in Microsoft Defender for Endpoint is the quickest way to contain a compromised device. Option A is wrong because resetting the password alone does not isolate the device. Option B is wrong because a full scan is slow and may not stop ongoing activity. Option D is wrong because creating a detection rule does not take immediate action.

Answer

Run a full antimalware scan on the device

Answer

Reset the user's password in Microsoft Entra ID

Answer

Create a custom detection rule in Microsoft Sentinel

Question 15

During an incident response, a forensic investigator needs to collect a memory dump from a compromised Windows server that is still running. The server has Microsoft Defender for Endpoint installed but is not connected to the internet. Which method should the investigator use?

Accepted Answer

Use Live Response to run a memory dump collector on the device. Option D is correct because Live Response allows a live memory dump from an offline device via a connected channel. Option A is wrong because the device is offline, so the portal cannot initiate a dump. Option B is wrong because snapshot collection requires the device to be online. Option C is wrong because Sysinternals is not part of Microsoft's recommended forensic toolkit for this scenario.

Answer

Collect a system memory snapshot from the Microsoft 365 Defender portal

Answer

Initiate a memory dump from the Microsoft Defender for Endpoint portal

Answer

Use Sysinternals Suite to capture a memory dump locally