SC-200 Respond to security incidents Practice Test 32 — 15 Questions

Question 1

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. An incident in Microsoft Defender XDR is automatically synchronized to Microsoft Sentinel. The incident in Sentinel is closed by the SOC team, but the corresponding incident in Defender remains open. What should you do to ensure that closing an incident in Sentinel also closes its linked incident in Defender?

Accepted Answer

Configure an automation rule in Microsoft Sentinel that triggers on incident closure and runs a playbook that closes the corresponding incident in Microsoft Defender XDR.. Microsoft Sentinel can be configured to sync incident status back to Microsoft Defender XDR using automation rules. Option B is correct. Option A is wrong because the bi-directional sync is not automatic and requires configuration. Option C is wrong because the Defender portal does not automatically sync with Sentinel. Option D is wrong because the integration settings in Defender do not control Sentinel's incident closure.

Answer

In the Microsoft Defender XDR portal, enable the setting to automatically close incidents when the linked Sentinel incident is closed.

Answer

Use the Microsoft Defender XDR API to set up a webhook that listens for Sentinel incident closure.

Answer

Enable the bi-directional sync in the Microsoft Sentinel data connector for Microsoft Defender XDR.

Question 2

Your organization uses Microsoft Sentinel. You need to design a solution that automatically responds to incidents with severity High and enriches them with threat intelligence from Microsoft Defender Threat Intelligence. Which TWO actions should you include?

Accepted Answer

Create an automation rule that triggers when an incident is created with severity High and runs a playbook to enrich the incident with threat intelligence.. To respond to incidents automatically, you use automation rules. Option A is correct because automation rules run playbooks. Option D is correct because automation rules can also change severity. Option B is wrong because playbooks are triggered by automation rules, not directly. Option C is wrong because automation rules cannot modify queries. Option E is wrong because analytics rules do not automatically run playbooks without an automation rule.

Answer

Set the automation rule to modify the analytics rule's query to include threat intelligence.

Answer

Configure the playbook to run directly from the analytics rule that generates the incident.

Answer

Use the analytics rule's incident configuration to automatically run the playbook.

Question 3

A SOC analyst in your organization is investigating an incident in Microsoft Defender XDR that involves a compromised user account. The analyst needs to gather more information about the user's recent activities. Which THREE actions can the analyst take directly from the incident page?

Accepted Answer

Run an advanced hunting query related to the user.. From the incident page, the analyst can view the user's timeline, run advanced hunting queries, and take action like disabling the account. Option A is correct because the user timeline is accessible. Option B is correct because advanced hunting can be initiated from the incident. Option D is correct because the analyst can trigger a playbook from the incident. Option C is wrong because resetting password typically requires going to Microsoft Entra ID admin center. Option E is wrong because deleting the user account is not a standard action from the incident page.

Answer

Delete the user account.

Answer

Reset the user's password directly from the incident.

Question 4

Your organization uses Microsoft Sentinel. You are investigating an incident that involves multiple alerts. Which TWO actions can you perform from the incident details page to consolidate the investigation?

Accepted Answer

Create a bookmark to capture relevant evidence.. From the incident details page, you can add alerts to the incident and create a bookmark to preserve evidence. Option A is correct because you can add related alerts. Option D is correct because bookmarks can be created. Option B is wrong because analytics rules are modified in the Analytics blade. Option C is wrong because playbooks are run from the incident page, not created. Option E is wrong because deleting alerts is not a standard action.

Answer

Delete alerts that are not relevant.

Answer

Create a new playbook from the incident page.

Answer

Modify the analytics rule that generated the incident.

Question 5

Your organization uses Microsoft Sentinel with Microsoft Defender XDR integration. You have a scheduled analytics rule that detects failed logon attempts across multiple on-premises domain controllers. The rule is configured to run every 5 minutes and create an incident when more than 10 failed attempts occur from a single IP address within 5 minutes. Recently, the SOC team noticed that the rule is generating a high volume of low-fidelity incidents, mostly from legitimate users mistyping passwords. You need to reduce the number of false positive incidents while still detecting real brute-force attacks. What should you do?

Accepted Answer

Modify the query to require at least 20 failed attempts from a single IP and include a condition that the attempts are against multiple user accounts.. To reduce false positives, you can increase the threshold to require more failed attempts or add additional conditions like failed attempts across multiple user accounts. Option B is correct because it increases the threshold to 20 and adds a condition for multiple users, which better indicates a brute-force attack. Option A is wrong because increasing the frequency would generate more incidents, not fewer. Option C is wrong because decreasing the threshold would increase incidents. Option D is wrong because disabling the rule would stop detection entirely.

Answer

Increase the query frequency to every 1 minute and reduce the threshold to 5.

Answer

Disable the rule and create a new rule based on successful logons followed by failed attempts.

Answer

Decrease the threshold to 5 and add a condition to exclude known good IP addresses.

Question 6

Your organization has a hybrid identity environment with Microsoft Entra ID (Azure AD) and on-premises Active Directory. You are using Microsoft Defender for Identity (MDI) integrated with Microsoft Defender XDR. An incident is raised indicating that a user account has been compromised because of an anomaly in Kerberos protocol activity. The incident severity is High. You need to contain the incident immediately by disabling the user account across both on-premises and cloud. However, you also want to preserve the account for forensic analysis. What is the recommended course of action?

Accepted Answer

From Microsoft Defender XDR incident, use the action to disable the user account in Microsoft Entra ID and also disable the on-premises account using a playbook that runs a PowerShell script.. To contain the incident, you can disable the account in Microsoft Entra ID and on-premises AD. However, to preserve the account for forensics, you should disable it rather than delete it. Option A is correct because disabling the account in both locations stops access while preserving the account. Option B is wrong because resetting password alone does not prevent Kerberos abuse if the account is already compromised. Option C is wrong because requiring MFA does not block on-premises authentication. Option D is wrong because deleting the account would lose forensic evidence.

Answer

Delete the user account from Microsoft Entra ID and on-premises AD immediately.

Answer

Reset the user's password in Microsoft Entra ID and force a password change at next logon on-premises.

Answer

Enable conditional access policy to require MFA for the user and revoke all refresh tokens.

Question 7

Your organization uses Microsoft Sentinel and Microsoft 365 Defender. You have a playbook that automatically isolates a device when a malware incident is confirmed. The playbook uses the Microsoft Defender for Endpoint connector. During a recent incident, the playbook failed to isolate a device because the device was not found in Defender for Endpoint. Upon investigation, you find that the device is onboarded to Microsoft Defender for Endpoint but the playbook is using an incorrect device ID format. What should you do to ensure the playbook works correctly?

Accepted Answer

Modify the playbook to use the device ID from the incident's entities instead of a manually entered ID.. The device ID format must match what Defender for Endpoint expects. Option A is correct because using the correct device ID from the incident entity ensures the playbook can isolate the device. Option B is wrong because the connector is already configured. Option C is wrong because the device is onboarded. Option D is wrong because the device ID is the issue.

Answer

Ensure the device is properly onboarded to Microsoft Defender for Endpoint by running the onboarding script again.

Answer

Reconfigure the Microsoft Defender for Endpoint connector in Sentinel to use a different API version.

Answer

Use the device name instead of the device ID in the playbook.

Question 8

Your company uses Microsoft Sentinel and Microsoft Defender for Cloud Apps (MCAS). A security analyst detects that a user is accessing a sanctioned cloud app from an unusual location. The analyst creates an incident in Sentinel. You need to automatically apply a session policy in MCAS to block downloads from that user for the next hour. You have an existing playbook that can apply session policies. What is the most efficient way to automate this response?

Accepted Answer

Create an automation rule in Sentinel that triggers when an incident is created with the relevant conditions and runs the playbook.. To automate the response, you can create an automation rule that triggers on incident creation and runs the playbook. Option A is correct. Option B is wrong because analytics rules do not run playbooks directly. Option C is wrong because the incident creation rule is not for automated response. Option D is wrong because manual actions are not automated.

Answer

Instruct the analyst to run the playbook manually from the incident page each time.

Answer

Configure the incident creation rule in MCAS to automatically run the playbook.

Answer

Modify the analytics rule that detected the anomaly to run the playbook as an automated response.

Question 9

Your organization uses Microsoft Sentinel and has deployed the Microsoft Defender XDR connector. You notice that some incidents from Defender XDR are not being synchronized to Sentinel. You verify that the connector is enabled and healthy. You also check that the relevant Defender XDR alerts are being generated. What could be the cause of the missing incidents?

Accepted Answer

The Microsoft Defender XDR connector has a filter that only syncs incidents with severity High or Medium, and the missing incidents are Low severity.. Incidents from Defender XDR are synchronized to Sentinel based on the connector's filtering settings. Option A is correct because the connector might be configured to only sync incidents of certain severities. Option B is wrong because alert grouping is not a connector setting. Option C is wrong because the data connector is for incidents, not raw data. Option D is wrong because diagnostic settings are for logs, not incidents.

Answer

The Microsoft Defender XDR connector is configured to group alerts by entity, which prevents individual incidents from being created.

Answer

The diagnostic settings in Microsoft Defender XDR are not configured to send incidents to Sentinel.

Answer

The data connector is set to ingestion mode 'Raw data' instead of 'Incidents'.

Question 10

Your organization uses Microsoft Sentinel. You have a playbook that sends an email notification to the SOC team when a new incident is created. The playbook is currently triggered manually. You want the playbook to run automatically every time an incident of severity High is created. What should you do?

Accepted Answer

Create an automation rule that triggers when an incident is created with severity High and runs the playbook.. Automation rules in Sentinel can automatically trigger playbooks based on incident conditions. Option A is correct. Option B is wrong because automation rules are created in the Automation blade. Option C is wrong because the analytics rule does not directly run playbooks. Option D is wrong because the playbook trigger is not configured in Logic Apps designer.

Answer

Edit the analytics rule that generates the incident to include the playbook as an automated response.

Answer

Modify the playbook to add a trigger of 'When an incident is created' and set the severity condition.

Answer

Configure the playbook's Logic Apps designer to use an HTTP trigger that polls Sentinel for new incidents.

Question 11

Your organization uses Microsoft Sentinel and has several analytics rules that generate incidents from various data sources. The SOC team is overwhelmed by the number of incidents. You need to implement a triage system that automatically assigns incidents to different analysts based on the incident's tactics and severity. You also want to send a notification to the assigned analyst via Teams. What should you do?

Accepted Answer

Create multiple automation rules that trigger on incident creation, each with conditions for specific tactics and severity, and then run a playbook that assigns the incident to an analyst and sends a Teams notification.. Automation rules can be used to assign incidents and run playbooks. Option A is correct because multiple automation rules can handle different conditions. Option B is wrong because playbooks cannot assign incidents directly. Option C is wrong because analytics rules do not assign incidents. Option D is wrong because workbooks are for visualization, not automation.

Answer

Use a workbook to create a triage dashboard and instruct analysts to manually claim incidents from the dashboard.

Answer

Modify each analytics rule to include a custom details field that specifies the analyst, and use a playbook to send Teams notification based on that field.

Answer

Create a single playbook that checks the incident's tactics and severity, assigns it to the appropriate analyst, and sends a Teams notification, then configure that playbook to run automatically on all new incidents.

Question 12

Your organization uses Microsoft Defender for Endpoint (MDE) and Microsoft Sentinel. You receive an alert in MDE about a suspicious PowerShell command executed on a device. You create an incident in Sentinel from this alert. You need to automatically collect a memory dump from the affected device for further analysis. You have a playbook that can initiate a memory dump collection via the MDE API. What is the best way to automate this?

Accepted Answer

Create an automation rule that triggers when an incident is created from a MDE alert and runs the playbook to collect the memory dump.. Automation rules can trigger playbooks on incident creation. Option A is correct because the playbook can collect the memory dump immediately. Option B is wrong because the alert details enrichment is not for running playbooks. Option C is wrong because the entity behavior analytics is not relevant. Option D is wrong because the playbook should run automatically, not manually.

Answer

Configure the alert details enrichment in Sentinel to automatically add the memory dump to the incident.

Answer

Use entity behavior analytics in Sentinel to trigger the playbook when suspicious behavior is detected.

Answer

Have the analyst manually run the playbook from the incident page.

Question 13

A security analyst detects a suspicious login from an unusual location for a user in Microsoft Defender XDR. The analyst needs to investigate and contain the incident. Which TWO actions should be taken?

Accepted Answer

Disable the user account from Microsoft Entra ID.. Disabling the user account (B) immediately stops further access. Using Microsoft Entra ID Identity Protection to confirm risk (C) provides additional context. Investigation playbooks (A) are for automation not immediate containment. Resetting password (D) is less immediate than disabling. Hunting queries (E) are for proactive threat hunting.

Answer

Create a custom hunting query in Microsoft 365 Defender advanced hunting.

Answer

Run an automated investigation playbook.

Answer

Reset the user's password.

Question 14

An incident in Microsoft Sentinel involves multiple alerts indicating a potential data exfiltration via SharePoint Online. You need to respond and remediate. Which THREE actions should be taken?

Accepted Answer

Remove external sharing permissions on SharePoint sites.. Blocking the user in Microsoft Entra ID (A) stops further access. Removing external sharing (B) prevents further data leaks. Isolating the user's device (C) is a containment step. Changing passwords (D) is less immediate than blocking. Running a hunting query (E) is investigative, not containment.

Answer

Reset the user's password and enforce MFA.

Answer

Create a custom detection rule for similar activity.

Question 15

Your organization uses Microsoft Sentinel as its SIEM and Microsoft Defender XDR for endpoint detection. A critical incident has been generated: 'Possible ransomware activity detected on multiple endpoints.' The incident includes alerts from Microsoft Defender for Endpoint (MDE) about file encryption behaviors and from Microsoft Defender for Identity (MDI) about anomalous service account logins. You have been assigned the incident and need to contain the threat effectively. You have Microsoft Sentinel automation rules that can trigger playbooks, and you have Microsoft Defender XDR actions available. The environment includes 500 Windows 10 devices managed by Microsoft Intune, and 50 servers on-premises. Some servers are domain controllers. Which of the following is the BEST first course of action?

Accepted Answer

Isolate the affected devices using Microsoft Defender for Endpoint device isolation.. Option C is correct: isolating the affected devices in MDE immediately stops the ransomware from spreading while preserving forensic data. Option A is wrong because disabling service accounts alone does not stop the encryption already in progress. Option B is wrong because running a playbook that collects data is investigative, not urgent containment. Option D is wrong because resetting passwords on domain controllers is time-consuming and does not halt active encryption.

Answer

Disable all compromised service accounts in Microsoft Entra ID and reset their passwords.

Answer

Reset passwords for all domain administrator accounts and enforce MFA.

Answer

Trigger a Microsoft Sentinel playbook to collect forensic evidence from affected endpoints before remediation.