SC-200 Respond to security incidents Practice Test 31 — 15 Questions

Question 1

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You receive an alert about a suspicious sign-in from an IP address associated with a known malicious actor. The sign-in was for a privileged account. You need to immediately contain the incident. What should you do first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Disable the user account in Microsoft Entra ID.. Disabling the user account in Microsoft Entra ID immediately stops the attacker from using the compromised credentials. Option A is wrong because resetting the password might not be fast enough if the attacker has an active session. Option C is wrong because creating an analytics rule does not contain the incident immediately; it only helps detect similar sign-ins in the future. Option D is wrong because blocking the IP address in the firewall is reactive and may not be effective if the attacker uses a different IP.

Answer

Reset the user's password.

Answer

Create a custom analytics rule in Sentinel to detect similar sign-ins.

Answer

Block the IP address in the firewall.

Question 2

You are responding to a security incident involving a user who clicked on a malicious link in an email. The link led to a website that downloaded a file to the user's device. Microsoft Defender for Endpoint (MDE) detected the file as malware and blocked it. However, the user reports that the device is running slowly. You need to verify if there are any remnants of the malware. Which action should you take?

Accepted Answer

Initiate a live response session and run a PowerShell script to check for persistence mechanisms.. A live response session in Microsoft Defender for Endpoint lets you run remote investigative commands — including PowerShell scripts — directly on the device to enumerate persistence mechanisms such as Run keys, scheduled tasks, services, and WMI subscriptions. Since MDE already blocked the malware, the goal is to verify no remnants or persistence artifacts remain, and live response is the purpose-built tool for that forensic check.

Answer

Re-onboard the device to MDE to ensure it's fully managed.

Answer

Run a full antivirus scan using Microsoft Defender Antivirus.

Answer

Perform a full OS reinstall to ensure the device is clean.

Question 3

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You receive an alert about a suspicious sign-in from an IP address associated with a known malicious actor. The sign-in was for a privileged account. You need to immediately contain the incident. What should you do first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Review the UEBA insights for the user to understand the anomaly.. Before taking any disruptive action like disabling an account or resetting a password, the analyst must review the UEBA insights to validate whether the anomaly is a true compromise or a false positive (e.g., VPN usage, travel, or shared credentials). UEBA in Microsoft Sentinel correlates sign-in logs, Azure Activity, and other sources to surface risk scores and anomalous entities, giving the context needed for an informed decision.

Answer

Disable the user account in Microsoft Entra ID.

Answer

Create a custom automation rule in Sentinel to disable the account on similar alerts.

Answer

Reset the user's password immediately.

Question 4

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You receive an alert about a suspicious sign-in from an IP address associated with a known malicious actor. The sign-in was for a privileged account. You need to immediately contain the incident. What should you do first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Initiate a live response session to collect forensic artifacts.. Option B is correct because initiating a live response session in Microsoft Defender for Endpoint lets you run forensic commands (e.g., getfile, analyze, run) on the affected server to collect volatile artifacts such as memory, running processes, and network connections for investigation. Option C is correct because Microsoft Sentinel incidents are integrated with Microsoft 365 Defender, so reviewing the incident timeline provides correlated alerts, entities, and investigation data across endpoints, identities, and email to understand the attack scope. Option E is correct because isolating the server via Microsoft Defender for Endpoint network isolation blocks inbound/outbound traffic (except for Defender communication) to stop ransomware propagation while preserving the ability to investigate. Option A is not appropriate during containment/investigation because creating a new analytics rule is a detection-engineering task, not an incident response action. Option D is not appropriate because resetting the password of the anomalous account is a remediation step that may destroy evidence and does not contain the server-based ransomware activity.

Answer

Create a new analytics rule to detect similar behavior.

Answer

Reset the password of the account that showed anomalous behavior.

Question 5

You are investigating a security incident involving a compromised user account. The attacker used the account to access sensitive data in SharePoint Online. Which TWO actions should you take to remediate the incident? (Choose two.)

Accepted Answer

Revoke all refresh tokens for the user.. Option B is correct because revoking all refresh tokens for the compromised user immediately invalidates the OAuth 2.0 refresh tokens that the attacker could use to silently obtain new access tokens for SharePoint Online and other Microsoft 365 resources, cutting off their persistent access. Option C is correct because disabling the user account in Microsoft Entra ID blocks any further authentication attempts with that identity, preventing the attacker from signing in again while the incident is contained. Option A is not the best remediation action here because resetting the password alone does not invalidate existing refresh tokens, so the attacker could retain access until those tokens expire. Option D is a detection/investigation step rather than a remediation action, and Option E is a preventive control that does not immediately stop an active compromise.

Answer

Reset the user's password.

Answer

Review the sign-in logs to determine the extent of the breach.

Answer

Create a Conditional Access policy to require MFA for the user.

Question 6

Your Microsoft Sentinel workspace ingests logs from Microsoft Defender for Cloud and Microsoft 365 Defender. You need to create an incident response playbook that automatically responds to high-severity incidents. Which THREE components are required? (Choose three.)

Accepted Answer

An analytics rule that generates the incident. Option B is required because an analytics rule is what detects the activity and generates the incident in Microsoft Sentinel; without an incident, there is nothing for the playbook to respond to. Option C is required because an automation rule in Microsoft Sentinel is the mechanism that triggers a playbook automatically when an incident is created, matching conditions such as high severity. Option E is required because the playbook itself is implemented as an Azure Logic Apps workflow that uses the Microsoft Sentinel incident trigger to run the response actions. Option A is not required because a workbook is only a visualization/reporting tool and plays no role in automated incident response. Option D is not required because a hunting query is used for proactive threat hunting, not for automatically triggering a playbook.

Answer

A workbook to visualize the incident data

Answer

A hunting query to search for similar activity

Question 7

You are investigating a potential ransomware incident detected by Microsoft Defender XDR. The incident shows multiple machines with suspicious encryption activity. You need to contain the threat immediately. What should you do first?

Accepted Answer

Initiate device isolation on affected machines from Microsoft Defender XDR. In Microsoft Defender XDR, device isolation is the fastest containment action that stops lateral movement and further encryption while preserving the machine for investigation. Isolating affected devices immediately cuts off network communication except for the Defender connection, preventing ransomware from spreading. This is the recommended first step in the incident response containment phase for active ransomware.

Answer

Reset the passwords of all users on the affected machines

Answer

Run a full antivirus scan on all endpoints

Answer

Disable the user accounts associated with the affected machines

Question 8

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You receive an alert about a suspicious sign-in from an IP address associated with a known malicious actor. The sign-in was for a privileged account. You need to immediately contain the incident. What should you do first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Sign-in logs in Microsoft Entra ID. Sign-in logs in Microsoft Entra ID contain detailed token information such as token issuer, session ID, and device details, which are essential for determining if a token was compromised. Option A is incorrect because audit logs track changes to directory objects, not sign-in details. Option B is incorrect because Azure Activity Log monitors Azure resource operations, not sign-in events. Option D is incorrect because Microsoft Defender for Cloud Apps logs focus on cloud application sessions and anomalies, but do not provide the granular sign-in token details found in sign-in logs.

Answer

Audit logs in Microsoft Entra ID

Answer

Azure Activity Log

Answer

Microsoft Defender for Cloud Apps logs

Question 9

A Microsoft Defender XDR incident shows that a user's device has been communicating with a known malicious C2 server. The device is online and the user is actively working. You need to contain the threat with minimal business disruption. What should you do?

Accepted Answer

Initiate device isolation from Microsoft Defender XDR. Initiating device isolation in Microsoft Defender XDR stops all network communication to and from the device while allowing the user to continue working locally, thus containing the threat with minimal business disruption. Option A is incorrect because disabling the switch port would require physical access to the network infrastructure and may not be feasible remotely. Option B is incorrect because shutting down the device remotely causes immediate disruption and loss of user productivity. Option C is incorrect because a full antivirus scan does not stop ongoing C2 communication and may allow the threat to continue spreading.

Answer

Remove the device from the network by disabling the switch port

Answer

Shut down the device remotely

Answer

Run a full antivirus scan on the device

Question 10

You are investigating a Microsoft Sentinel incident involving a user who clicked a phishing link. The incident includes alerts from Microsoft Defender for Office 365. You need to identify if any other users received the same phishing email. What should you do?

Accepted Answer

Use the Threat Explorer in Microsoft Defender for Office 365. Threat Explorer in Microsoft Defender for Office 365 is the purpose-built tool for investigating email threats at scale — it lets you pivot on the phishing campaign's sender, URL, or message ID and see every recipient who received the same message. This is exactly the 'who else got this email' question. Sentinel's incident graph and timeline show correlated alerts but do not provide the email-centric recipient enumeration that Threat Explorer does.

Answer

Check the incident timeline for related alerts

Answer

Review the incident graph in Microsoft Sentinel

Answer

Run a KQL query in Advanced Hunting

Question 11

During a ransomware incident, you need to prevent the encryption of files in SharePoint Online and OneDrive for Business. You have already identified the compromised user account. What should you do?

Accepted Answer

Lock the compromised user account in Microsoft Entra ID. Locking the compromised user account in Microsoft Entra ID immediately revokes the attacker's access to SharePoint Online and OneDrive for Business, preventing further file encryption. Option A is incorrect because disabling external sharing does not stop an already authenticated user from encrypting files. Option C is incorrect because deleting the user's OneDrive files does not prevent the attacker from encrypting other files. Option D is incorrect because a retention policy only protects against deletion or modification, not encryption.

Answer

Disable external sharing for SharePoint Online

Answer

Delete the compromised user's OneDrive files

Answer

Apply a retention policy to all SharePoint sites

Question 12

Which TWO actions should you take when responding to a confirmed data exfiltration incident involving Microsoft 365? (Choose two.)

Accepted Answer

Revoke user sessions in Microsoft Entra ID. Options B and C are correct. When responding to a confirmed data exfiltration incident involving Microsoft 365, you should contain the threat by revoking user sessions in Microsoft Entra ID (option B) to prevent further unauthorized access, and investigate by reviewing audit logs in the Microsoft Purview compliance portal (option C) to determine the scope and impact of the exfiltration. Option A (resetting passwords for all users) is excessive and disruptive; instead, focus on resetting passwords for compromised accounts only. Option D (disabling all external sharing in SharePoint) is too broad and may disrupt legitimate business operations. Option E (blocking all access to the tenant) is premature and would cause significant operational disruption.

Answer

Reset passwords for all users

Answer

Disable all external sharing in SharePoint

Answer

Block all access to the tenant

Question 13

Which THREE are valid methods to collect forensic evidence from a compromised Windows machine during incident response in Microsoft Defender XDR? (Choose three.)

Accepted Answer

Collect a memory dump from the device using Live Response. Options B, D, and E are correct: Live Response allows script execution and file collection; collecting a memory dump captures volatile evidence necessary for forensic analysis; exporting Windows Event Logs provides a timeline of events. Option A is incorrect because resetting the device destroys evidence instead of preserving it. Option C is incorrect because full disk imaging is not natively supported in Microsoft Defender XDR; it requires external tools.

Answer

Reset the device to a clean state

Answer

Perform a full disk image using Microsoft Defender for Endpoint

Question 14

Which TWO are immediate containment actions in Microsoft Sentinel for a compromised Azure VM? (Choose two.)

Accepted Answer

Apply an NSG to block all inbound and outbound traffic. (Apply an NSG to block all inbound and outbound traffic), an immediate containment action that isolates the compromised Azure VM by blocking network traffic. Option A (install anti-malware extension) is a remediation step, not immediate containment. Option C (reset password) does not stop an active attack and may interfere with investigation. Option D (initiate VM backup) is not containment and could preserve compromised data. Option E (stop the VM using an automation rule) is not a valid Sentinel containment action; automation rules trigger playbooks and do not directly stop VMs, and stopping the VM can destroy volatile evidence.

Answer

Install anti-malware extension

Answer

Reset the VM administrator password

Answer

Initiate a VM backup

Answer

Stop the VM using an automation rule

Question 15

Which THREE resources can be used as data sources for Microsoft Sentinel to detect security incidents? (Choose three.)

Accepted Answer

Microsoft 365 Defender. Options A, B, and C are correct. Microsoft 365 Defender provides integrated threat signals across endpoints, email, and identities. Microsoft Defender for Cloud delivers security alerts and posture assessments for cloud workloads. Azure Activity Log captures subscription-level operational events, which can be streamed to Sentinel. Option D is incorrect because Azure Cost Management focuses on cost tracking and budgeting, not security events. Option E is incorrect because Azure Advisor provides optimization recommendations, not security incident data.

Answer

Azure Cost Management

Answer

Azure Advisor