SC-200 Respond to security incidents Practice Test 32 — 15 Questions

Question 1

Your company uses Microsoft Sentinel with the Microsoft Defender XDR connector. You receive an incident: 'Suspicious mailbox forwarding rule created.' The incident indicates that a user's mailbox in Exchange Online has a forwarding rule to an external email address. The user's account shows no other suspicious activity. You need to respond to the incident. The company policy requires preserving evidence for 30 days. Which action should you take FIRST?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Remove the mailbox forwarding rule.. The first priority is to stop the data exfiltration caused by the forwarding rule. Removing the forwarding rule is the most direct and immediate action to prevent further unauthorized email forwarding. Reset the password only if account compromise is suspected, but here no other suspicious activity is present. Blocking the external domain may be too broad and affect legitimate communication. An automated playbook can be used later for investigation, but immediate containment takes precedence.

Answer

Run an automated playbook to collect additional evidence.

Answer

Reset the user's password and require MFA.

Answer

Block the external email domain in Exchange Online.

Question 2

Wide World Importers uses Microsoft Sentinel, Microsoft Defender XDR, and Microsoft Purview for data loss prevention (DLP). An incident is generated: 'DLP policy violation - sensitive data shared externally.' The incident shows that a user shared a document containing credit card numbers via SharePoint Online with an external guest. The user is a finance department employee. You need to respond to the incident. The organization wants to minimize business disruption while protecting data. Which of the following is the BEST immediate action?

Accepted Answer

Remove the external guest's access to the document in SharePoint Online.. Removing the external guest's access to the document stops data exposure without affecting the user's work. Option A is wrong: disabling the user prevents all work and may be too drastic. Option B is wrong: deleting the document destroys evidence. Option D is wrong: DLP policy change takes time and does not stop current exposure.

Answer

Delete the document from SharePoint Online.

Answer

Modify the DLP policy to block sharing of credit card numbers.

Answer

Disable the user's account in Microsoft Entra ID and investigate.

Question 3

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. An incident is triggered: 'Lateral movement detected - pass-the-hash attack.' The incident includes alerts from Microsoft Defender for Identity (MDI) showing anomalous NTLM authentication attempts from a compromised workstation to multiple servers. The compromised workstation is a Windows 10 device. You need to contain the incident. Which of the following actions should you take FIRST?

Accepted Answer

Isolate the compromised workstation using Microsoft Defender for Endpoint.. To contain a pass-the-hash attack, the immediate priority is to stop lateral movement from the compromised workstation. Isolating the workstation using Microsoft Defender for Endpoint prevents further anomalous authentication attempts. While resetting passwords or disabling NTLM may be necessary later, the first step is to contain the source of the attack.

Answer

Reset the krbtgt account password twice.

Answer

Disable NTLM authentication across the domain.

Answer

Reset passwords on all servers that received anomalous authentication attempts.

Question 4

Contoso uses Microsoft Sentinel with the Microsoft Defender for Cloud Apps connector. An incident is generated: 'Unusual file download by user - possible data exfiltration.' The incident shows that a user downloaded 500 files from SharePoint Online within 10 minutes, which is abnormal for that user. The user's account shows no other suspicious activity. You need to respond. Which of the following is the BEST first action?

Accepted Answer

Suspend the user account in Microsoft Entra ID.. Suspending the user account in Microsoft Entra ID immediately stops any further downloads and prevents potential data exfiltration. Option A is wrong: blocking SharePoint Online for all users is too disruptive and may not be necessary. Option B is wrong: creating an anomaly detection policy is a long-term improvement, not an immediate response. Option D is wrong: investigating logs is important but should be done after stopping the active threat.

Answer

Block SharePoint Online access for all users temporarily.

Answer

Create an anomaly detection policy for such downloads.

Answer

Investigate the user's recent activity logs.

Question 5

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You receive an incident: 'Malicious PowerShell command executed on endpoint.' The incident shows that a PowerShell command was executed on a server that attempted to download a payload from a known malicious IP. The process was terminated by MDE, but the server may still be compromised. You need to respond to the incident. Which of the following actions should you take FIRST?

Accepted Answer

Isolate the server using Microsoft Defender for Endpoint.. Isolating the server using Microsoft Defender for Endpoint immediately contains the threat, preventing any potential malware from communicating with command and control servers or spreading to other systems. This is the highest priority action after an incident is detected, as containment limits further damage. Option A is incorrect because running a playbook for forensic data collection is important but should occur after containment to ensure the evidence is preserved without risking further compromise. Option C is incorrect because there is no indication of credential compromise, and resetting the local admin password is not a primary containment measure. Option D is incorrect because blocking the malicious IP at the firewall does not address the possibility that the server itself is compromised and may still have active malware that could exfiltrate data or execute additional commands.

Answer

Run a Microsoft Sentinel playbook to collect forensic data.

Answer

Reset the local administrator password on the server.

Answer

Block the malicious IP address at the firewall.

Question 6

Fabrikam uses Microsoft Sentinel, Microsoft Defender XDR, and Microsoft Purview Compliance Manager. An incident is generated: 'Insider risk - user deleting large volumes of files from SharePoint Online.' The incident is from Microsoft Purview Insider Risk Management. The user is a senior executive, and disabling the account is not an option without board approval. You need to contain the data deletion. Which of the following is the BEST immediate action?

Accepted Answer

Apply a retention hold to the user's OneDrive and SharePoint sites.. The best immediate action because applying a retention hold to the user's OneDrive and SharePoint sites preserves the data from deletion without affecting the user's access, which is important for a senior executive. Option A is incorrect: removing permissions may not stop deletion if the user is the owner, and it disrupts work. Option B is incorrect: blocking access in Entra ID disrupts work and may require board approval. Option D is incorrect: creating a DLP policy does not stop current deletion, only prevents future occurrences.

Answer

Remove the user's permissions to the SharePoint sites.

Answer

Block the user's access in Microsoft Entra ID temporarily.

Answer

Create a DLP policy to block deletion of files.

Question 7

Which TWO Microsoft 365 Defender portals provide automated investigation and response capabilities? (Choose two.)

Accepted Answer

Microsoft Defender for Endpoint (security.microsoft.com). Microsoft Defender for Endpoint (D) and Microsoft 365 Defender (E) both provide automated investigation and response (AIR) capabilities. Defender for Endpoint uses AIR to automatically investigate alerts on endpoints and take remediation actions, while Microsoft 365 Defender orchestrates AIR across email, identity, endpoints, and cloud apps. These portals are accessed via security.microsoft.com and offer built-in playbooks for automated response.

Answer

Microsoft Purview compliance portal

Answer

Microsoft Sentinel (portal.azure.com)

Answer

Microsoft Intune admin center

Question 8

Which Microsoft Sentinel feature allows you to automatically respond to incidents by running a playbook when an incident is created?

Accepted Answer

Automation rules. Automation rules in Microsoft Sentinel allow you to define automated responses to incidents, including running a playbook when an incident is created. They provide a centralized way to trigger actions based on incident properties such as severity, status, or specific tactics, without needing to embed automation logic directly in analytics rules.

Answer

Analytics rules

Answer

Playbooks

Answer

Watchlists

Answer

Workbooks

Question 9

Your organization uses Microsoft Sentinel. You receive an incident that involves a potential lateral movement detected by Microsoft Defender for Identity. You need to investigate the timeline of the attack. Which Microsoft Sentinel feature should you use?

Accepted Answer

Investigation graph. The Investigation graph in Microsoft Sentinel is specifically designed to explore the scope and timeline of an attack by visually mapping entities (e.g., users, devices, IPs) and their connections. For a lateral movement incident detected by Defender for Identity, the graph automatically surfaces related alerts, entities, and activities in a chronological view, enabling you to trace the attacker's path across resources. This makes it the correct tool for investigating the attack timeline.

Answer

Workbooks

Answer

Automation rules

Answer

Analytics rules

Question 10

Refer to the exhibit. You are reviewing an alert in Microsoft Defender for Endpoint. The alert details are shown. Which of the following actions should you take first?

Accepted Answer

Investigate the device and the alert details. The first step in incident response is to investigate the alert details and the affected device to understand the scope and severity of the threat. Without investigation, you cannot determine whether the alert is a true positive, whether isolation is appropriate, or which remediation steps are needed. Microsoft Defender for Endpoint provides a rich investigation experience, including the alert story, device timeline, and related events, which must be reviewed before taking any containment or remediation actions.

Answer

Mark the alert as a false positive

Answer

Initiate device isolation to contain the threat

Answer

Run a full antivirus scan on the device

Question 11

You are investigating an incident where a user reported receiving a suspicious email with a malicious attachment. Microsoft Defender for Office 365 did not block it. The email originated from a known malicious sender domain. What configuration should you check first?

Accepted Answer

Anti-phishing policy in Microsoft Defender for Office 365. The anti-phishing policy in Microsoft Defender for Office 365 is the primary configuration that evaluates sender reputation, impersonation attempts, and spoof intelligence. Since the email originated from a known malicious sender domain and was not blocked, the anti-phishing policy's spoof settings or impersonation protection may be misconfigured or not applied to the affected user. This policy directly controls how Defender handles emails from malicious domains, making it the first place to check.

Answer

User-reported message settings

Answer

SPF record for the sender domain

Answer

Safe Attachments policy

Question 12

Your organization uses Microsoft Sentinel. A security analyst reports that an incident was automatically closed by a playbook before the investigation was complete. What should you do to prevent automatic closure in the future?

Accepted Answer

Modify the analytics rule to not automatically close incidents. The analytics rule that generates the incident includes a setting to automatically close incidents when an alert is triggered again. Modifying this setting prevents the incident from being closed prematurely, regardless of any playbook or automation rule. This ensures that incidents remain open for investigation until manually resolved.

Answer

Disable the playbook

Answer

Remove the playbook from the automation rule

Answer

Disable the automation rule that triggers the playbook

Question 13

You are a security analyst investigating a detected phishing campaign targeting users in your organization. The Microsoft Defender for Office 365 alert indicates that several users clicked on a malicious link. Which action should you take first to prevent further compromise?

Accepted Answer

Add the malicious URL to the Microsoft Defender for Endpoint custom threat indicator list.. Adding the malicious URL to the Microsoft Defender for Endpoint custom threat indicator list is the correct first action because it immediately blocks future access to that URL across all endpoints protected by Defender for Endpoint, preventing further compromise from users clicking the same link. This leverages the threat intelligence feed to enforce a block action at the network level, stopping the attack vector proactively without disrupting user productivity or requiring device isolation.

Answer

Isolate all affected users' devices from the network.

Answer

Report the email to Microsoft for analysis.

Answer

Block the sender email address in the tenant.

Question 14

Your organization uses Microsoft Sentinel. An incident is created for a possible data exfiltration via an unapproved external IP address. Which type of Microsoft Sentinel automation should you use to automatically block the IP address in the firewall?

Accepted Answer

Playbook.. Playbooks in Microsoft Sentinel are automated workflows based on Azure Logic Apps that can perform response actions, such as blocking an IP address in a firewall. When an incident indicates data exfiltration via an unapproved external IP, a playbook can be triggered automatically or manually to execute the block action via integration with firewall APIs or management tools.

Answer

Data connector.

Answer

Analytics rule.

Answer

Watchlist.

Question 15

A Microsoft Defender for Endpoint alert indicates that a device has been communicating with a known command-and-control (C2) server. The device is critical for production. What is the most appropriate response?

Accepted Answer

Isolate the device using Microsoft Defender for Endpoint's device isolation feature.. Microsoft Defender for Endpoint's device isolation feature is designed to contain a compromised device while preserving forensic data and minimizing disruption. For a critical production device, full isolation (blocking all network traffic except to the Defender service) stops C2 communication without physically disconnecting the device, allowing the security team to investigate and remediate remotely.

Answer

Disconnect the network cable of the device.

Answer

Run a full antivirus scan on the device.

Answer

Block the C2 server URL in the firewall.