SC-200 Respond to security incidents Practice Test 32 — 15 Questions

Question 1

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. A critical incident has been generated from Microsoft Defender for Cloud indicating that a Linux VM in Azure is running a cryptocurrency miner. The VM is part of a production application and cannot be shut down immediately. The incident severity is High. You need to contain the threat while maintaining application availability, investigate the root cause, and prevent recurrence. The environment includes Azure Policy, Microsoft Defender for Endpoint on the VM, and a Log Analytics workspace. You must minimize manual steps. What course of action should you take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Microsoft Sentinel automation to apply a block rule on the VM's network security group (NSG) to block outbound traffic to known mining pools, initiate Live Response to collect evidence, and create an Azure Policy to automatically deploy Microsoft Defender for Endpoint on all VMs. It uses Microsoft Sentinel automation to apply a network security group (NSG) rule to block outbound traffic to known mining pools, which contains the threat without disrupting the VM's availability for production traffic. Initiating Live Response on the VM allows collection of forensic evidence for investigation. Creating an Azure Policy to enforce Microsoft Defender for Endpoint deployment on all VMs helps prevent recurrence by ensuring all VMs have endpoint detection and response (EDR) capabilities. Option A is incorrect because remotely connecting and killing the process is a manual step that does not block the miner from restarting or communicating outbound, and it may not be immediately effective. Option B is incorrect because removing the VM from the load balancer alone does not stop the miner from running locally or potentially communicating via other routes, and Azure Policy for antivirus is insufficient for modern threats like miners. Option C is incorrect because stopping the VM immediately would disrupt production, and taking a snapshot then redeploying from backup does not address the immediate containment of the threat on the current VM.

Answer

Remotely connect to the VM and run a script to kill the miner process, then update antivirus definitions

Answer

Remove the VM from the load balancer, then use Azure Policy to enforce that all VMs have antivirus enabled

Answer

Stop the VM immediately, take a snapshot for forensic analysis, and then redeploy a clean VM from a backup

Question 2

Your company uses Microsoft Defender XDR. During a ransomware incident, you need to isolate a compromised Windows 10 device from the network while allowing connectivity to the Microsoft Defender for Endpoint service. Which action should you take?

Accepted Answer

Initiate a Full isolation from the device's action menu.. Full isolation from the device's action menu is correct because in Microsoft Defender XDR, full isolation blocks all network traffic to and from the device except for the Defender for Endpoint service communication channel. This allows the security team to contain ransomware spread while still managing the device and running remediation actions through the Defender portal. Selective isolation, by contrast, only blocks external connections and permits internal ones, which is insufficient for ransomware containment.

Answer

Contain the device from the Microsoft Defender XDR portal.

Answer

Apply a firewall rule to block all outbound traffic.

Answer

Run a selective isolation to block only external connections.

Question 3

You are investigating a phishing incident in Microsoft Defender XDR. The user reported receiving an email with a malicious link. You need to identify all users who received the same email. Which feature should you use?

Accepted Answer

Threat Explorer. Threat Explorer (part of Microsoft Defender for Office 365 / Defender XDR) is purpose-built for email and collaboration threat investigation. It lets you pivot on a malicious URL, sender, or message and see every recipient who received the same email, along with delivery status and remediation actions. This is the correct tool for identifying the blast radius of a phishing campaign.

Answer

Automation & investigations

Answer

Incidents view

Answer

Advanced Hunting

Question 4

Your organization uses Microsoft Sentinel. You receive an incident for a potential data exfiltration involving a sensitive blob storage container. You need to determine if the data was accessed from an unusual IP address. What should you do?

Accepted Answer

Use the Incident details pane to review the entity timeline.. The Incident details pane in Microsoft Sentinel includes an entity timeline that shows activities and events associated with entities (such as IP addresses, accounts, hosts) tied to the incident. Reviewing the entity timeline lets you see whether the blob storage was accessed from an unusual IP and correlate that IP with other activity. This is the direct investigative step for the question.

Answer

Modify the analytics rule that triggered the incident.

Answer

Run a playbook to collect IP information.

Answer

Open the Sentinel workbook for storage monitoring.

Question 5

Your company uses Microsoft Defender for Cloud Apps. You discover that a user's account is compromised and used to access a sensitive SharePoint site from an unfamiliar IP. You need to immediately revoke the user's session and force them to re-authenticate. Which action should you take?

Accepted Answer

Apply a policy with the 'Revoke session' action.. The 'Revoke session' governance action in Defender for Cloud Apps invalidates the user's active sessions across connected SaaS apps (SharePoint, Exchange, Teams, etc.) and forces re-authentication, which is the correct immediate response to an active session hijack. It is applied via an access or session policy and works with Conditional Access App Control to terminate the session in real time.

Answer

Add the IP to the blocked IP addresses list.

Answer

Create a governance action to suspend the user.

Answer

Send a notification to the user to change their password.

Question 6

You are an incident responder for a company using Microsoft 365 Defender. A critical incident is assigned to you. What is the first action you should take according to best practices?

Accepted Answer

Triage the incident to determine the scope and severity.. The first and most critical step in incident response is to triage the incident. Triage involves assessing the incident's scope, severity, and potential impact to prioritize and guide subsequent actions. Without triage, you risk wasting resources on low-priority issues or taking inappropriate steps. Option A is correct because it enables informed decision-making. Option B (escalate) should come after triage if necessary. Option C (isolate devices) may be too hasty and could hinder investigation. Option D (collect memory dump) is premature before understanding the incident.

Answer

Escalate the incident to senior management.

Answer

Immediately isolate all affected devices.

Answer

Collect a full memory dump from the affected systems.

Question 7

Your organization uses Microsoft Sentinel. You have an incident that involves multiple alerts. You want to automatically assign the incident to the appropriate analyst based on the alert type. What should you use?

Accepted Answer

Create an automation rule with an 'Assign incident to owner' action.. An automation rule with an 'Assign incident to owner' action is the correct mechanism to automatically assign incidents based on alert type. Automation rules in Microsoft Sentinel support conditions on incident properties (including alert type/analytics rule) and can assign the incident to a specific owner or group. This directly fulfills the requirement.

Answer

Create a playbook that assigns the incident.

Answer

Configure the analytics rule to set the incident owner.

Answer

Use a workbook to filter incidents by alert type.

Question 8

Your company uses Microsoft Defender for Endpoint. A device shows signs of compromise with suspicious PowerShell execution. You need to collect forensic evidence before performing remediation. Which action should you use?

Accepted Answer

Collect investigation package.. In Microsoft Defender for Endpoint, the 'Collect investigation package' action gathers a forensic snapshot of the device — including running processes, network connections, autoruns, scheduled tasks, and recent files — without altering the system state. This is the correct first step when you need to preserve evidence before remediation, because it captures volatile data that would be lost if you isolated or remediated the device. Isolation and live response are separate actions that serve different purposes.

Answer

Isolate the device from the network.

Answer

Run a full antivirus scan.

Answer

Initiate a live response session.

Question 9

Your organization uses Microsoft Sentinel. You receive an incident for a potential malware outbreak. You need to quickly see which entities are involved (e.g., IPs, hosts, accounts). Where should you look?

Accepted Answer

Entities tab. The Entities tab in a Microsoft Sentinel incident provides a consolidated view of all related entities such as IP addresses, hosts, user accounts, and other resources that were identified during the alert investigation. This allows you to quickly assess the scope of a potential malware outbreak by seeing which systems and identities are involved, without needing to navigate through raw alerts or timeline events.

Answer

Incident timeline

Answer

Comments section

Answer

Alerts tab

Question 10

Your organization uses Microsoft Sentinel. A security incident related to a compromised user account has been fully investigated and remediated. Which THREE steps should you take to close the incident properly? (Choose three.)

Accepted Answer

Verify that all related alerts are resolved or closed.. Options A, C, and D are correct. Verifying that all related alerts are resolved or closed (A) ensures no lingering issues. Changing the incident status to Closed with an appropriate classification (C) provides proper closure. Adding comments summarizing the investigation and remediation steps (D) documents the process. Option B (creating a new analytics rule) is not required for closing an incident. Option E (deleting the incident) is not recommended; incidents should be closed, not deleted.

Answer

Create a new analytics rule to detect similar activity.

Answer

Delete the incident to clean up the workspace.

Question 11

You are a security analyst at Contoso. Microsoft Sentinel is deployed with the Microsoft Defender for Cloud Apps connector. An incident is generated for a high-risk sign-in from a user named JaneDoe@contoso.com. The incident severity is Medium. The incident details show that the sign-in originated from an IP address in a country where Contoso has no business presence, and the user recently changed their password. You suspect account compromise. You need to take immediate action to contain the threat and prevent further unauthorized access. The user is currently active in Microsoft Entra ID. You have the following options: A) Force the user to re-authenticate by revoking their sessions in Microsoft Entra ID. B) Disable the user account in Microsoft Entra ID. C) Block the IP address in Microsoft Defender for Cloud Apps. D) Create a Sentinel automation rule to automatically disable accounts on similar alerts. Which action should you take first to contain the current incident?

Accepted Answer

Disable the user account in Microsoft Entra ID.. Disabling the user account immediately stops any further access using that account, which is the most direct containment action. Option A (Revoke sessions) would end current sessions but the user could still authenticate again if credentials are compromised. Option C (Block IP) is less effective as the attacker may use other IPs. Option D (Create automation rule) is a long-term solution, not immediate containment.

Answer

Force the user to re-authenticate by revoking their sessions.

Answer

Block the IP address in Microsoft Defender for Cloud Apps.

Answer

Create a Sentinel automation rule to automatically disable accounts on similar alerts.

Question 12

A security analyst receives an alert in Microsoft Defender XDR indicating that a user account was compromised. The analyst needs to isolate the affected device to prevent lateral movement. Which action should the analyst take first?

Accepted Answer

Initiate device isolation from Microsoft Defender for Endpoint. Initiating device isolation in Microsoft Defender for Endpoint immediately contains the compromised device, preventing lateral movement. Option A is wrong because a full antimalware scan does not isolate the device and may not stop ongoing malicious activity. Option C is wrong because resetting the user's password does not isolate the device; it only revokes access to cloud resources. Option D is wrong because creating a custom detection rule in Microsoft Sentinel does not take immediate action to contain the threat.

Answer

Run a full antimalware scan on the device

Answer

Reset the user's password in Microsoft Entra ID

Answer

Create a custom detection rule in Microsoft Sentinel

Question 13

During an incident response, a forensic investigator needs to collect a memory dump from a compromised Windows server that is still running. The server has Microsoft Defender for Endpoint installed but is not connected to the internet. Which method should the investigator use?

Accepted Answer

Use Sysinternals Suite to capture a memory dump locally. The server is not connected to the internet, which means cloud-based tools like Microsoft 365 Defender portal and Live Response cannot be used. Sysinternals Suite, specifically tools like ProcDump or RAMMap, can be run locally to capture a memory dump without requiring internet connectivity. This is the only option that works in an offline scenario, as it relies on local execution rather than cloud services.

Answer

Collect a system memory snapshot from the Microsoft 365 Defender portal

Answer

Use Live Response to run a memory dump collector on the device

Answer

Initiate a memory dump from the Microsoft Defender for Endpoint portal

Question 14

An organization uses Microsoft Sentinel for security operations. A security engineer needs to automatically disable a compromised user account in Microsoft Entra ID when a high-severity incident is created in Sentinel. Which feature should the engineer use?

Accepted Answer

Automation rule with a playbook. To automatically disable a compromised user account in Microsoft Entra ID when a high-severity incident is created in Sentinel, the engineer should use an automation rule that triggers a playbook. Automation rules in Microsoft Sentinel allow you to define conditions (e.g., incident severity) and then invoke a playbook, which can contain the logic to call Microsoft Graph or Entra ID to disable the user. This is the standard method for automated response.

Answer

Analytics rule

Answer

Workbook

Answer

Hunting query

Question 15

A security operations center (SOC) team uses Microsoft Defender XDR and Microsoft Sentinel. An incident is created in Defender XDR that involves a malicious email and a compromised device. The team wants the incident to automatically sync to Sentinel. What is the minimum configuration required?

Accepted Answer

Configure the Microsoft Defender XDR connector in Sentinel. The Microsoft Defender XDR connector in Microsoft Sentinel is the dedicated connector that ingests incidents and advanced hunting events from all Defender XDR workloads (Defender for Endpoint, Office 365, Identity, Cloud Apps) and syncs them into Sentinel. Because the incident spans email and device, only the unified Defender XDR connector provides the cross-workload incident stream required for automatic synchronization.

Answer

Configure the Microsoft Defender for Office 365 connector in Sentinel

Answer

Configure the Azure AD Identity Protection connector in Sentinel

Answer

Configure the Microsoft 365 Defender connector in Sentinel