SC-200 Respond to security incidents Practice Test 31 — 15 Questions

Question 1

Your organization uses Microsoft Sentinel. You are investigating an incident that involves multiple alerts. Which TWO actions can you perform from the incident details page to consolidate the investigation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a bookmark to capture relevant evidence.. From the incident details page, you can perform several actions to consolidate the investigation. Option A (Create a bookmark) is correct because bookmarks allow you to capture relevant evidence for later reference. Option C (Add additional alerts to the incident) is correct because you can add related alerts to the incident to see all related evidence together. Option B is incorrect because you cannot delete alerts from the incident page; alerts are removed by excluding them from the incident or by modifying the analytics rule. Option D is incorrect because you can run an existing playbook from the incident page, but you cannot create a new playbook from there. Option E is incorrect because analytics rules are modified in the Analytics blade, not from the incident page.

Answer

Delete alerts that are not relevant.

Answer

Create a new playbook from the incident page.

Answer

Modify the analytics rule that generated the incident.

Question 2

Your organization uses Microsoft Sentinel with Microsoft Defender XDR integration. You have a scheduled analytics rule that detects failed logon attempts across multiple on-premises domain controllers. The rule is configured to run every 5 minutes and create an incident when more than 10 failed attempts occur from a single IP address within 5 minutes. Recently, the SOC team noticed that the rule is generating a high volume of low-fidelity incidents, mostly from legitimate users mistyping passwords. You need to reduce the number of false positive incidents while still detecting real brute-force attacks. What should you do?

Accepted Answer

Modify the query to require at least 20 failed attempts from a single IP and include a condition that the attempts are against multiple user accounts.. To reduce false positives, you can increase the threshold to require more failed attempts or add additional conditions like failed attempts across multiple user accounts. Option B is correct because it increases the threshold to 20 and adds a condition for multiple users, which better indicates a brute-force attack. Option A is wrong because increasing the frequency would generate more incidents, not fewer. Option C is wrong because decreasing the threshold would increase incidents. Option D is wrong because disabling the rule would stop detection entirely.

Answer

Increase the query frequency to every 1 minute and reduce the threshold to 5.

Answer

Disable the rule and create a new rule based on successful logons followed by failed attempts.

Answer

Decrease the threshold to 5 and add a condition to exclude known good IP addresses.

Question 3

Your organization has a hybrid identity environment with Microsoft Entra ID (Azure AD) and on-premises Active Directory. You are using Microsoft Defender for Identity (MDI) integrated with Microsoft Defender XDR. An incident is raised indicating that a user account has been compromised because of an anomaly in Kerberos protocol activity. The incident severity is High. You need to contain the incident immediately by disabling the user account across both on-premises and cloud. However, you also want to preserve the account for forensic analysis. What is the recommended course of action?

Accepted Answer

From Microsoft Defender XDR incident, use the action to disable the user account in Microsoft Entra ID and also disable the on-premises account using a playbook that runs a PowerShell script.. To contain the incident while preserving the account for forensic analysis, you should disable the account rather than delete it. Option D is correct because it leverages Microsoft Defender XDR to disable the account in Entra ID and uses a playbook with PowerShell to disable the on-premises AD account, stopping access without destroying evidence. Option A is wrong because deleting would remove forensic artifacts. Option B is wrong because password reset doesn't block existing Kerberos tickets. Option C is wrong because MFA doesn't block on-premises Kerberos logins.

Answer

Delete the user account from Microsoft Entra ID and on-premises AD immediately.

Answer

Reset the user's password in Microsoft Entra ID and force a password change at next logon on-premises.

Answer

Enable conditional access policy to require MFA for the user and revoke all refresh tokens.

Question 4

Your organization uses Microsoft Sentinel and Microsoft 365 Defender. You have a playbook that automatically isolates a device when a malware incident is confirmed. The playbook uses the Microsoft Defender for Endpoint connector. During a recent incident, the playbook failed to isolate a device because the device was not found in Defender for Endpoint. Upon investigation, you find that the device is onboarded to Microsoft Defender for Endpoint but the playbook is using an incorrect device ID format. What should you do to ensure the playbook works correctly?

Accepted Answer

Modify the playbook to use the device ID from the incident's entities instead of a manually entered ID.. The playbook failed due to an incorrect device ID format. By modifying the playbook to retrieve the device ID from the incident's entities, you ensure the ID matches the format expected by Microsoft Defender for Endpoint. Option A is incorrect because the device is already onboarded; the issue is the ID format, not onboarding. Option B is irrelevant as the connector API version is not related to device ID format. Option D is incorrect because using the device name does not resolve the ID format issue; the playbook requires the correct device ID.

Answer

Ensure the device is properly onboarded to Microsoft Defender for Endpoint by running the onboarding script again.

Answer

Reconfigure the Microsoft Defender for Endpoint connector in Sentinel to use a different API version.

Answer

Use the device name instead of the device ID in the playbook.

Question 5

Your company uses Microsoft Sentinel and Microsoft Defender for Cloud Apps (MCAS). A security analyst detects that a user is accessing a sanctioned cloud app from an unusual location. The analyst creates an incident in Sentinel. You need to automatically apply a session policy in MCAS to block downloads from that user for the next hour. You have an existing playbook that can apply session policies. What is the most efficient way to automate this response?

Accepted Answer

Create an automation rule in Sentinel that triggers when an incident is created with the relevant conditions and runs the playbook.. To automate the response, you can create an automation rule that triggers on incident creation and runs the playbook. Option A is correct. Option B is wrong because manual actions are not automated. Option C is wrong because the incident creation rule in MCAS is not used for automated response in Sentinel; an automation rule in Sentinel is needed. Option D is wrong because analytics rules do not run playbooks directly; they trigger alerts which create incidents, and then automation rules run the playbook.

Answer

Instruct the analyst to run the playbook manually from the incident page each time.

Answer

Configure the incident creation rule in MCAS to automatically run the playbook.

Answer

Modify the analytics rule that detected the anomaly to run the playbook as an automated response.

Question 6

Your organization uses Microsoft Sentinel. You are investigating an incident that involves multiple alerts. Which TWO actions can you perform from the incident details page to consolidate the investigation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Microsoft Defender XDR connector has a filter that only syncs incidents with severity High or Medium, and the missing incidents are Low severity.. Incidents from Defender XDR are synchronized to Sentinel based on the connector's filtering settings. Option A is correct because the connector might be configured to only sync incidents of certain severities. Option B is wrong because alert grouping is not a connector setting. Option C is wrong because the data connector is for incidents, not raw data. Option D is wrong because diagnostic settings are for logs, not incidents.

Answer

The Microsoft Defender XDR connector is configured to group alerts by entity, which prevents individual incidents from being created.

Answer

The diagnostic settings in Microsoft Defender XDR are not configured to send incidents to Sentinel.

Answer

The data connector is set to ingestion mode 'Raw data' instead of 'Incidents'.

Question 7

Your organization uses Microsoft Sentinel. You are investigating an incident that involves multiple alerts. Which TWO actions can you perform from the incident details page to consolidate the investigation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an automation rule that triggers when an incident is created with severity High and runs the playbook.. Automation rules in Sentinel can automatically trigger playbooks based on incident conditions. Option A is correct. Option B is wrong because automation rules are created in the Automation blade. Option C is wrong because the analytics rule does not directly run playbooks. Option D is wrong because the playbook trigger is not configured in Logic Apps designer.

Answer

Edit the analytics rule that generates the incident to include the playbook as an automated response.

Answer

Modify the playbook to add a trigger of 'When an incident is created' and set the severity condition.

Answer

Configure the playbook's Logic Apps designer to use an HTTP trigger that polls Sentinel for new incidents.

Question 8

Your organization uses Microsoft Sentinel and has several analytics rules that generate incidents from various data sources. The SOC team is overwhelmed by the number of incidents. You need to implement a triage system that automatically assigns incidents to different analysts based on the incident's tactics and severity. You also want to send a notification to the assigned analyst via Teams. What should you do?

Accepted Answer

Create multiple automation rules that trigger on incident creation, each with conditions for specific tactics and severity, and then run a playbook that assigns the incident to an analyst and sends a Teams notification.. Automation rules are the correct mechanism to conditionally trigger playbooks on incident creation. Option A is correct because multiple automation rules can filter by tactics and severity, each running a playbook that assigns the incident to the appropriate analyst and sends a Teams notification. Option B is wrong because using a workbook for a triage dashboard requires manual intervention, which does not meet the automation requirement. Option C is wrong because custom details fields in analytics rules cannot dynamically assign analysts based on incident properties; they are static and not suitable for conditional assignment. Option D is wrong because a single playbook cannot be triggered automatically on all new incidents without an automation rule; also, a single playbook would need to replicate condition logic that is better handled by multiple automation rules.

Answer

Use a workbook to create a triage dashboard and instruct analysts to manually claim incidents from the dashboard.

Answer

Modify each analytics rule to include a custom details field that specifies the analyst, and use a playbook to send Teams notification based on that field.

Answer

Create a single playbook that checks the incident's tactics and severity, assigns it to the appropriate analyst, and sends a Teams notification, then configure that playbook to run automatically on all new incidents.

Question 9

Your organization uses Microsoft Defender for Endpoint (MDE) and Microsoft Sentinel. You receive an alert in MDE about a suspicious PowerShell command executed on a device. You create an incident in Sentinel from this alert. You need to automatically collect a memory dump from the affected device for further analysis. You have a playbook that can initiate a memory dump collection via the MDE API. What is the best way to automate this?

Accepted Answer

Create an automation rule that triggers when an incident is created from a MDE alert and runs the playbook to collect the memory dump.. Automation rules in Microsoft Sentinel can trigger playbooks when an incident is created. Option B is correct because it creates an automation rule that triggers on incident creation from a Microsoft Defender for Endpoint alert and runs the playbook to collect the memory dump automatically. Option A is incorrect because alert details enrichment only adds enrichment details, it does not run playbooks. Option C is incorrect because entity behavior analytics does not directly trigger playbooks on incident creation. Option D is incorrect because the requirement is automation, not manual action.

Answer

Configure the alert details enrichment in Sentinel to automatically add the memory dump to the incident.

Answer

Use entity behavior analytics in Sentinel to trigger the playbook when suspicious behavior is detected.

Answer

Have the analyst manually run the playbook from the incident page.

Question 10

A security analyst detects a suspicious login from an unusual location for a user in Microsoft Defender XDR. The analyst needs to investigate and contain the incident. Which TWO actions should be taken?

Accepted Answer

Disable the user account from Microsoft Entra ID.. Disabling the user account (A) immediately stops further access. Reviewing sign-in logs and risk level in Microsoft Entra ID Identity Protection (C) provides additional context for the investigation. Run an automated investigation playbook (D) is not for immediate containment but for automated response actions. Resetting the password (E) is less immediate than disabling and may not stop ongoing session. Creating a custom hunting query (B) is for proactive threat hunting, not immediate containment.

Answer

Create a custom hunting query in Microsoft 365 Defender advanced hunting.

Answer

Run an automated investigation playbook.

Answer

Reset the user's password.

Question 11

An incident in Microsoft Sentinel involves multiple alerts indicating a potential data exfiltration via SharePoint Online. You need to respond and remediate. Which THREE actions should be taken?

Accepted Answer

Remove external sharing permissions on SharePoint sites.. Removing external sharing permissions on SharePoint sites (A) prevents further data leaks via sharing. Blocking the user account in Microsoft Entra ID (B) stops further access immediately. Isolating the user's device using Microsoft Defender for Endpoint (D) contains the threat by preventing lateral movement. Resetting the user's password and enforcing MFA (C) is a good follow-up but less immediate than blocking the account. Creating a custom detection rule (E) is proactive but not a direct response to the current incident.

Answer

Reset the user's password and enforce MFA.

Answer

Create a custom detection rule for similar activity.

Question 12

Your organization uses Microsoft Sentinel as its SIEM and Microsoft Defender XDR for endpoint detection. A critical incident has been generated: 'Possible ransomware activity detected on multiple endpoints.' The incident includes alerts from Microsoft Defender for Endpoint (MDE) about file encryption behaviors and from Microsoft Defender for Identity (MDI) about anomalous service account logins. You have been assigned the incident and need to contain the threat effectively. You have Microsoft Sentinel automation rules that can trigger playbooks, and you have Microsoft Defender XDR actions available. The environment includes 500 Windows 10 devices managed by Microsoft Intune, and 50 servers on-premises. Some servers are domain controllers. Which of the following is the BEST first course of action?

Accepted Answer

Isolate the affected devices using Microsoft Defender for Endpoint device isolation.. Isolating the affected devices using Microsoft Defender for Endpoint immediately stops the ransomware from encrypting further files and prevents lateral movement, while preserving forensic data for investigation. Option A is wrong because disabling compromised service accounts does not halt the encryption already in progress on the endpoints. Option B is wrong because resetting domain admin passwords and enforcing MFA is a longer-term security measure that does not address the active encryption. Option C is wrong because collecting forensic evidence is important but should occur after containment to avoid further damage.

Answer

Disable all compromised service accounts in Microsoft Entra ID and reset their passwords.

Answer

Reset passwords for all domain administrator accounts and enforce MFA.

Answer

Trigger a Microsoft Sentinel playbook to collect forensic evidence from affected endpoints before remediation.

Question 13

Contoso uses Microsoft Sentinel with Microsoft Defender XDR connector. You receive an incident titled 'Malware detected on endpoint' from Microsoft Defender for Endpoint. The incident includes a detailed timeline showing that the malware was downloaded from a malicious URL. You need to respond to the incident using Microsoft Sentinel and Microsoft Defender XDR capabilities. The affected device is a Windows 10 workstation used by a standard user. You have been asked to contain the threat and prevent recurrence. The organization has a policy to preserve evidence for 90 days. Which action should you take FIRST?

Accepted Answer

Isolate the device using Microsoft Defender for Endpoint device isolation.. Isolating the device using Microsoft Defender for Endpoint immediately contains the threat by disconnecting the device from the network, preventing the malware from spreading or communicating with command-and-control servers. This is the priority first step in incident response. Option A is incorrect because resetting the password does not remove malware from the device. Option B is incorrect creating a custom detection rule is a proactive step but not an immediate containment action. Option C is incorrect because blocking the URL at the firewall prevents further downloads but does not contain the already infected device.

Answer

Reset the user's password and revoke sessions in Microsoft Entra ID.

Answer

Create a custom detection rule in Microsoft Sentinel for the malicious URL.

Answer

Block the malicious URL at the firewall using Microsoft Defender for Cloud Apps.

Question 14

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. An incident is generated for a user who received a phishing email that bypassed Exchange Online Protection. The user clicked the link and entered credentials on a fake login page. The incident includes alerts from Microsoft Defender for Office 365 and Microsoft Entra ID. You need to respond to the incident. The affected user has administrative privileges. Which of the following should you do FIRST?

Accepted Answer

Reset the user's password and revoke sessions in Microsoft Entra ID.. Resetting the user's password and revoking sessions immediately prevents attacker use of stolen credentials, especially given the user has administrative privileges. Option B is wrong because reporting the email is not the highest priority. Option C is wrong because creating a transport rule is a longer-term action. Option D is wrong because deleting the email does not address the compromised credentials.

Answer

Report the phishing email to Microsoft for analysis.

Answer

Create a transport rule to block similar phishing emails.

Answer

Delete the phishing email from the user's mailbox.

Question 15

Fabrikam has a hybrid environment with on-premises Active Directory synced to Microsoft Entra ID. They use Microsoft Sentinel and Microsoft Defender XDR. A critical incident is opened: 'Credential theft detected - domain admin account compromised.' The incident includes alerts from Microsoft Defender for Identity (MDI) showing anomalous Kerberos ticket requests and from Microsoft Defender for Endpoint showing a process dump on a domain controller. You need to contain the incident immediately. The organization has a strict policy of not disabling the domain admin account without approval due to critical dependencies. Which of the following is the BEST course of action?

Accepted Answer

Reset the krbtgt account password twice to force Kerberos ticket invalidation.. The best course of action because resetting the krbtgt account password twice invalidates all existing Kerberos tickets, including those issued to the compromised domain admin account. This effectively revokes the attacker's access without disabling the domain admin account, which aligns with the policy of not disabling it without approval. Option A is incorrect because resetting the domain admin password alone does not invalidate Kerberos tickets already issued; the attacker could still use existing tickets. Option B is incorrect because disabling the domain admin account violates the stated policy. Option C is incorrect because isolating the domain controller would disrupt critical services and does not directly address the credential theft or invalidate tickets.

Answer

Reset the domain admin password and revoke sessions in Microsoft Entra ID.

Answer

Disable the domain admin account temporarily.

Answer

Isolate the domain controller using Microsoft Defender for Endpoint.