SC-200 Respond to security incidents Practice Test 31 — 15 Questions

Question 1

An organization uses Microsoft Sentinel for security operations. A security engineer needs to automatically disable a compromised user account in Microsoft Entra ID when a high-severity incident is created in Sentinel. Which feature should the engineer use?

Accepted Answer

Automation rule with a playbook. Option B is correct because automation rules in Sentinel trigger playbooks on incident creation. Option A is wrong because analytics rules only create alerts, not actions on users. Option C is wrong because workbooks are for visualization, not automation. Option D is wrong because hunting queries are manual.

Answer

Analytics rule

Answer

Workbook

Answer

Hunting query

Question 2

A security operations center (SOC) team uses Microsoft Defender XDR and Microsoft Sentinel. An incident is created in Defender XDR that involves a malicious email and a compromised device. The team wants the incident to automatically sync to Sentinel. What is the minimum configuration required?

Accepted Answer

Configure the Microsoft Defender XDR connector in Sentinel. Option A is correct because the connector for Microsoft Defender XDR automatically syncs incidents to Sentinel. Option B is wrong because the connector for Microsoft 365 Defender is the same. Option C is wrong because the connector for Microsoft Defender for Office 365 only syncs email-related alerts. Option D is wrong because the connector for Azure AD Identity Protection only syncs identity alerts.

Answer

Configure the Microsoft Defender for Office 365 connector in Sentinel

Answer

Configure the Azure AD Identity Protection connector in Sentinel

Answer

Configure the Microsoft 365 Defender connector in Sentinel

Question 3

Refer to the exhibit. A security analyst creates a scheduled analytics rule in Microsoft Sentinel based on the JSON shown. After enabling the rule, the analyst notices that the rule generates alerts every hour for the same user accounts even after the incidents are resolved. What is the most likely cause?

Accepted Answer

Suppression is disabled, so the rule fires every hour with overlapping results. Option C is correct because suppression is disabled, so the rule fires every hour regardless of previous alerts. Option A is wrong because the query period is 1 day, which is appropriate. Option B is wrong because severity is High, not causing duplicates. Option D is wrong because the trigger threshold is 10, which controls when an alert fires, not duplicate suppression.

Answer

The severity is set to High, causing multiple alerts

Answer

The query period is too short, causing the rule to refetch old data

Answer

The trigger threshold is too low, causing the rule to fire too often

Question 4

After a security incident, the SOC team needs to preserve forensic evidence from a compromised Microsoft Entra ID joined Windows 10 device. The device is still online. Which tool should the team use to collect a forensic image of the hard drive?

Accepted Answer

Microsoft Defender for Endpoint. Option D is correct because Microsoft Defender for Endpoint can collect a full forensic image from the device via Live Response. Option A is wrong because BitLocker is encryption, not imaging. Option B is wrong because Intune does not support forensic imaging. Option C is wrong because Azure AD is identity, not device management for imaging.

Answer

Microsoft BitLocker Administration and Monitoring

Answer

Microsoft Entra ID

Answer

Microsoft Intune

Question 5

A security analyst uses Microsoft Sentinel to investigate an incident involving data exfiltration from Azure Blob Storage. The analyst needs to determine which user accessed the storage account and from which IP address. Which data source should the analyst query?

Accepted Answer

Azure Activity logs. Option B is correct because Azure Activity logs storage account management events, including access logs. Option A is wrong because Azure AD sign-in logs only show authentication to Azure AD, not storage access. Option C is wrong because Azure Monitor metrics are aggregated and don't show per-user access. Option D is wrong because Azure Security Center provides security recommendations, not access logs.

Answer

Azure AD sign-in logs

Answer

Azure Security Center alerts

Answer

Azure Monitor metrics

Question 6

During an incident response, a security engineer needs to block an attacker's IP address at the network level for all devices in the organization. The organization uses Microsoft Defender for Endpoint and Microsoft Intune for device management. What is the most efficient way to achieve this?

Accepted Answer

Create a custom indicator (IOC) for the IP address in Microsoft Defender for Endpoint. Option A is correct because a custom indicator in Defender for Endpoint blocks the IP across all onboarded devices. Option B is wrong because blocking in Microsoft Sentinel only affects log ingestion, not network traffic. Option C is wrong because Intune policies are for configuration, not real-time blocking. Option D is wrong because Azure Firewall would need to be in the network path and is a separate product.

Answer

Add the IP address to a blocklist in Microsoft Sentinel

Answer

Create a device configuration policy in Microsoft Intune to block the IP

Answer

Configure Azure Firewall to block the IP

Question 7

A SOC analyst receives a phishing alert in Microsoft Defender for Office 365. The analyst needs to quickly determine if any users clicked the malicious link. Which action should the analyst take first?

Accepted Answer

Open the email entity page to view click details. Option B is correct because the email entity page in Defender for Office 365 shows click verdicts. Option A is wrong because the user entity page does not show email-specific actions. Option C is wrong because Threat Explorer is useful but slower. Option D is wrong because a hunting query is manual and slower.

Answer

Use Threat Explorer to search for the email subject

Answer

Open the user entity page for each recipient

Answer

Run a hunting query in Microsoft Sentinel

Question 8

Which TWO actions should a security analyst take to contain a ransomware outbreak on a Windows server that has Microsoft Defender for Endpoint installed?

Accepted Answer

Run a full scan with Microsoft Defender Antivirus. Options B and D are correct. B isolates the device to prevent lateral movement, and D runs a scan to remove the ransomware. Option A is wrong because resetting the password does not stop the ransomware. Option C is wrong because uninstalling would remove protection. Option E is wrong because a full restore might reintroduce the malware.

Answer

Reset the local administrator password

Answer

Uninstall Microsoft Defender for Endpoint and reinstall

Answer

Restore the system from a backup

Question 9

Which THREE data sources should be included in a Microsoft Sentinel workspace to comprehensively monitor for lateral movement within an Azure environment?

Accepted Answer

Azure AD sign-in logs. Options A, B, and C are correct because they cover compute, network, and identity aspects of lateral movement. Option D is wrong because Azure DevOps is for development, not runtime. Option E is wrong because Power BI is not involved in lateral movement.

Answer

Power BI audit logs

Answer

Azure DevOps audit logs

Question 10

Which TWO options are valid ways to create an incident in Microsoft Sentinel?

Accepted Answer

From an alert generated by an analytics rule. Options A and B are correct. Analytics rules generate alerts that become incidents, and Microsoft Defender XDR incidents are synchronized. Option C is wrong because workbooks are read-only. Option D is wrong because watchlists are for enrichment. Option E is wrong because hunting queries require manual creation of incidents.

Answer

By creating a workbook

Answer

By importing data from a watchlist

Answer

By running a hunting query

Question 11

Your organization has Microsoft Sentinel deployed in a central Log Analytics workspace. You have a custom analytics rule that detects brute-force attacks against Azure AD by counting failed sign-ins from the same IP address within 5 minutes. The rule currently generates an incident for every 10 failed attempts. During a recent incident, a single IP address generated over 200 failed sign-ins in 10 minutes, resulting in 20 separate incidents. The SOC team is overwhelmed and wants to reduce the number of incidents without lowering the detection threshold. You need to modify the rule to generate only one incident per IP address within a 1-hour window. What should you do?

Accepted Answer

Modify the analytics rule to group alerts by IP address with a 1-hour window. Option A is correct because grouping alerts by IP address and setting a 1-hour window will consolidate all alerts from that IP into one incident. Option B is wrong because suppression only suppresses alerts after an incident is created, it doesn't group them. Option C is wrong because a separate analytics rule would still generate multiple incidents. Option D is wrong because an automation rule cannot change incident grouping after alerts are created.

Answer

Enable alert suppression in the analytics rule for 1 hour

Answer

Create a new analytics rule that triggers only when failed sign-ins exceed 200 in 5 minutes

Answer

Create an automation rule that closes duplicate incidents from the same IP

Question 12

Your company uses Microsoft Defender for Endpoint (MDE) on all Windows 10 devices. You are investigating a machine that is suspected of being part of a botnet. The machine is communicating with a known C2 server at IP 203.0.113.55. You have confirmed that the IP is malicious. You need to block all outbound traffic from the machine to that IP immediately, and also ensure that no other devices in the organization can communicate with that IP. The solution must be implemented without deploying additional network appliances. What should you do?

Accepted Answer

Create a custom network indicator in Microsoft Defender for Endpoint with action 'Alert and block'. Option B is correct because custom network indicators in MDE can block IPs at the device level, and the action applies to all MDE-enrolled devices. Option A is wrong because MDE network protection does not support custom IP blocking via policy. Option C is wrong because Windows Defender Firewall rules would need to be deployed via GPO or Intune, which is slower and more complex. Option D is wrong because the MDE portal does not have a global IP blocklist feature.

Answer

Create a network protection policy in Microsoft Intune to block the IP

Answer

Use the Microsoft Defender for Endpoint portal to block the IP globally

Answer

Create a firewall rule in Windows Defender Firewall to block outbound traffic to the IP, and deploy via Group Policy

Question 13

Your organization uses Microsoft Sentinel for security operations. The SOC team receives an incident that was generated from a Microsoft Defender for Cloud Apps alert. The incident involves a user who is downloading a large number of files from SharePoint Online. The analyst needs to suspend the user's account immediately to stop the potential data exfiltration. The organization has a Microsoft Sentinel playbook that can suspend a user in Microsoft Entra ID. However, the playbook is not triggering automatically. You need to ensure that the playbook runs automatically whenever a Defender for Cloud Apps alert generates an incident in Sentinel. What should you configure?

Accepted Answer

Create an automation rule that triggers the playbook when an incident is created from Defender for Cloud Apps. Option C is correct because an automation rule can be created to trigger a playbook on incident creation, specifically for incidents from Defender for Cloud Apps. Option A is wrong because analytics rules are for scheduled queries, not for alerts from other services. Option B is wrong because the playbook itself doesn't determine triggering; it's the automation rule. Option D is wrong because the connector syncs alerts, but automation is needed to run the playbook.

Answer

Create a scheduled analytics rule that detects large file downloads

Answer

Enable the Microsoft Defender for Cloud Apps connector to sync alerts

Answer

Modify the playbook to run on alert creation

Question 14

Your organization uses Microsoft Sentinel. An incident with severity Medium is created from an analytics rule that detects brute-force attempts against on-premises domain controllers. The incident contains alerts from multiple machines. You need to automatically run a playbook that collects evidence from affected machines and then changes the incident severity to High. What should you configure?

Accepted Answer

Create an automation rule that triggers on incident creation with severity Medium, runs the playbook, and then changes severity to High.. Automation rules in Microsoft Sentinel allow you to trigger playbooks automatically based on conditions. The automation rule can be set to trigger when an incident is created, check the severity condition, run a playbook, and then change the severity. Option A is correct because it enables a single automation rule to orchestrate both the playbook execution and severity change. Option B is wrong because analytics rules only trigger alert creation, not incident-level actions. Option C is wrong because playbooks cannot change severity directly without an automation rule. Option D is wrong because the alert details enrichment is for adding context, not running playbooks or changing severity.

Answer

Configure the incident creation settings to enrich the incident with the playbook output.

Answer

Modify the analytics rule to include the playbook as an automated response.

Answer

Edit the playbook to include a step that changes incident severity after collecting evidence.

Question 15

A security analyst in your company uses Microsoft Defender XDR to investigate an incident involving a user who received a malicious email. The analyst needs to block the sender's email address across all tenants in the organization. What is the most efficient way to achieve this?

Accepted Answer

In the Microsoft 365 Defender portal, use the action center to block the sender's email address across all tenants.. Microsoft Defender XDR allows you to take action on entities like email senders. Using the action center, you can block the sender's email address globally, which applies to all tenants. Option C is correct. Option A is wrong because Exchange admin center works per tenant and is not as efficient for cross-tenant blocking. Option B is wrong because Microsoft Entra ID admin center manages identities, not email blocking. Option D is wrong because Microsoft Purview is for compliance, not email threat protection.

Answer

From the Microsoft 365 Defender portal, go to Email & collaboration > Exchange admin center and block the sender.

Answer

In Microsoft Purview, create a data loss prevention policy to block the sender.

Answer

In Microsoft Entra ID admin center, create a conditional access policy to block the sender.