SC-200 Respond to security incidents Practice Test 33 — 15 Questions

Question 1

Refer to the exhibit. A security analyst creates a scheduled analytics rule in Microsoft Sentinel based on the JSON shown. After enabling the rule, the analyst notices that the rule generates alerts every hour for the same user accounts even after the incidents are resolved. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Suppression is disabled, so the rule fires every hour with overlapping results. In Microsoft Sentinel, an analytics rule with suppression disabled will fire every time its query period elapses and the query returns results, even if those results overlap with previously generated incidents. Since the rule runs hourly and the query period likely covers a window that includes the same user accounts, it repeatedly generates alerts for the same entities. Enabling suppression (or configuring the rule to group and suppress duplicate alerts) prevents this repetitive firing.

Answer

The severity is set to High, causing multiple alerts

Answer

The query period is too short, causing the rule to refetch old data

Answer

The trigger threshold is too low, causing the rule to fire too often

Question 2

A SOC analyst receives a phishing alert in Microsoft Defender for Office 365. The analyst needs to quickly determine if any users clicked the malicious link. Which action should the analyst take first?

Accepted Answer

Open the email entity page to view click details. The email entity page in Microsoft Defender for Office 365 provides detailed information about a specific email, including click verdicts for any URLs contained within. This allows the analyst to quickly see if any users clicked the malicious link. Option A (Threat Explorer) can also be used, but it requires more steps to filter for the specific email and then view click details. Option B (user entity page) shows user-specific activities and alerts, but not email-specific click details. Option D (hunting query in Microsoft Sentinel) is effective but slower than directly viewing the email entity page in Defender for Office 365.

Answer

Use Threat Explorer to search for the email subject

Answer

Open the user entity page for each recipient

Answer

Run a hunting query in Microsoft Sentinel

Question 3

Which THREE data sources should be included in a Microsoft Sentinel workspace to comprehensively monitor for lateral movement within an Azure environment?

Accepted Answer

Azure AD sign-in logs. Microsoft Entra ID sign-in logs (A) are correct because they record authentication events, including risky sign-ins, IP addresses, and conditional access results, which are essential for detecting credential-based lateral movement across Azure resources. Azure Network Security Group flow logs (C) are correct because they capture allowed and denied IP traffic flows through NSGs, enabling detection of east-west movement between subnets and VMs. Azure Activity logs (E) are correct because they record control-plane operations such as role assignments, resource creation, and management actions that attackers use to pivot and escalate privileges. Power BI audit logs (B) and Azure DevOps audit logs (D) are not included because they focus on BI and DevOps activities, not on authentication, network, or Azure control-plane events relevant to lateral movement monitoring.

Answer

Power BI audit logs

Answer

Azure DevOps audit logs

Question 4

Your company uses Microsoft Defender for Endpoint (MDE) on all Windows 10 devices. You are investigating a machine that is suspected of being part of a botnet. The machine is communicating with a known C2 server at IP 203.0.113.55. You have confirmed that the IP is malicious. You need to block all outbound traffic from the machine to that IP immediately, and also ensure that no other devices in the organization can communicate with that IP. The solution must be implemented without deploying additional network appliances. What should you do?

Accepted Answer

Create a custom network indicator in Microsoft Defender for Endpoint with action 'Alert and block'. Custom network indicators in Microsoft Defender for Endpoint allow you to define IP addresses, URLs, or domains and assign an action of 'Alert and block' or 'Alert only'. When set to 'Alert and block', the indicator is enforced on all onboarded devices via the Defender for Endpoint network protection stack, blocking outbound connections to the specified IP without requiring any additional network appliances. This satisfies both requirements: immediate blocking on the affected machine and organization-wide enforcement across all MDE-onboarded Windows 10 devices.

Answer

Create a network protection policy in Microsoft Intune to block the IP

Answer

Use the Microsoft Defender for Endpoint portal to block the IP globally

Answer

Create a firewall rule in Windows Defender Firewall to block outbound traffic to the IP, and deploy via Group Policy

Question 5

Your organization uses Microsoft Sentinel for security operations. The SOC team receives an incident that was generated from a Microsoft Defender for Cloud Apps alert. The incident involves a user who is downloading a large number of files from SharePoint Online. The analyst needs to suspend the user's account immediately to stop the potential data exfiltration. The organization has a Microsoft Sentinel playbook that can suspend a user in Microsoft Entra ID. However, the playbook is not triggering automatically. You need to ensure that the playbook runs automatically whenever a Defender for Cloud Apps alert generates an incident in Sentinel. What should you configure?

Accepted Answer

Create an automation rule that triggers the playbook when an incident is created from Defender for Cloud Apps. An automation rule can be created to trigger a playbook on incident creation, specifically filtering for incidents from Defender for Cloud Apps. This enables automatic execution of the playbook to suspend the user. Option B is incorrect because a scheduled analytics rule is for generating alerts based on queries, not for triggering playbooks on existing incidents. Option C is incorrect because enabling the connector only syncs alerts, but does not automatically run playbooks; an automation rule is required. Option D is incorrect because the playbook's trigger is configured in the automation rule, not by modifying the playbook itself.

Answer

Create a scheduled analytics rule that detects large file downloads

Answer

Enable the Microsoft Defender for Cloud Apps connector to sync alerts

Answer

Modify the playbook to run on alert creation

Question 6

A security analyst in your company uses Microsoft Defender XDR to investigate an incident involving a user who received a malicious email. The analyst needs to block the sender's email address across all tenants in the organization. What is the most efficient way to achieve this?

Accepted Answer

In the Microsoft 365 Defender portal, use the action center to block the sender's email address across all tenants.. Microsoft Defender XDR allows you to take action on entities like email senders. Using the action center, you can block the sender's email address globally, which applies to all tenants. Option C is correct. Option A is wrong because Exchange admin center works per tenant and is not as efficient for cross-tenant blocking. Option B is wrong because Microsoft Entra ID admin center manages identities, not email blocking. Option D is wrong because Microsoft Purview is for compliance, not email threat protection.

Answer

From the Microsoft 365 Defender portal, go to Email & collaboration > Exchange admin center and block the sender.

Answer

In Microsoft Purview, create a data loss prevention policy to block the sender.

Answer

In Microsoft Entra ID admin center, create a conditional access policy to block the sender.

Question 7

Your organization uses Microsoft Sentinel with Microsoft Defender XDR integration. You have a scheduled analytics rule that detects failed logon attempts across multiple on-premises domain controllers. The rule is configured to run every 5 minutes and create an incident when more than 10 failed attempts occur from a single IP address within 5 minutes. Recently, the SOC team noticed that the rule is generating a high volume of low-fidelity incidents, mostly from legitimate users mistyping passwords. You need to reduce the number of false positive incidents while still detecting real brute-force attacks. What should you do?

Accepted Answer

Modify the query to require at least 20 failed attempts from a single IP and include a condition that the attempts are against multiple user accounts.. The correct approach is to tune the analytics rule to be more specific: raising the threshold to 20 failed attempts and requiring attempts against multiple user accounts filters out single-user password mistypes while still catching brute-force attacks that spray across accounts. This directly reduces false positives without losing detection fidelity.

Answer

Increase the query frequency to every 1 minute and reduce the threshold to 5.

Answer

Disable the rule and create a new rule based on successful logons followed by failed attempts.

Answer

Decrease the threshold to 5 and add a condition to exclude known good IP addresses.

Question 8

Your organization has a hybrid identity environment with Microsoft Entra ID (Azure AD) and on-premises Active Directory. You are using Microsoft Defender for Identity (MDI) integrated with Microsoft Defender XDR. An incident is raised indicating that a user account has been compromised because of an anomaly in Kerberos protocol activity. The incident severity is High. You need to contain the incident immediately by disabling the user account across both on-premises and cloud. However, you also want to preserve the account for forensic analysis. What is the recommended course of action?

Accepted Answer

From Microsoft Defender XDR incident, use the action to disable the user account in Microsoft Entra ID and also disable the on-premises account using a playbook that runs a PowerShell script.. Microsoft Defender XDR provides a built-in action to disable a user account in Microsoft Entra ID directly from the incident. For on-premises AD, a playbook with a PowerShell script can disable the account, preserving it for forensic analysis. This approach contains the incident across both environments without deleting the account.

Answer

Delete the user account from Microsoft Entra ID and on-premises AD immediately.

Answer

Reset the user's password in Microsoft Entra ID and force a password change at next logon on-premises.

Answer

Enable conditional access policy to require MFA for the user and revoke all refresh tokens.

Question 9

Your organization uses Microsoft Sentinel and Microsoft 365 Defender. You have a playbook that automatically isolates a device when a malware incident is confirmed. The playbook uses the Microsoft Defender for Endpoint connector. During a recent incident, the playbook failed to isolate a device because the device was not found in Defender for Endpoint. Upon investigation, you find that the device is onboarded to Microsoft Defender for Endpoint but the playbook is using an incorrect device ID format. What should you do to ensure the playbook works correctly?

Accepted Answer

Modify the playbook to use the device ID from the incident's entities instead of a manually entered ID.. The playbook failed because it used an incorrect device ID format. The correct approach is to modify the playbook to dynamically retrieve the device ID from the incident's entities, which ensures the correct ID is used. This leverages the integration between Microsoft Sentinel and Microsoft 365 Defender, where incident entities include the proper device ID.

Answer

Ensure the device is properly onboarded to Microsoft Defender for Endpoint by running the onboarding script again.

Answer

Reconfigure the Microsoft Defender for Endpoint connector in Sentinel to use a different API version.

Answer

Use the device name instead of the device ID in the playbook.

Question 10

Your company uses Microsoft Sentinel and Microsoft Defender for Cloud Apps (MCAS). A security analyst detects that a user is accessing a sanctioned cloud app from an unusual location. The analyst creates an incident in Sentinel. You need to automatically apply a session policy in MCAS to block downloads from that user for the next hour. You have an existing playbook that can apply session policies. What is the most efficient way to automate this response?

Accepted Answer

Create an automation rule in Sentinel that triggers when an incident is created with the relevant conditions and runs the playbook.. An automation rule in Microsoft Sentinel is triggered by incident creation and can run a playbook automatically when specified conditions are met. This is the most efficient way to automate the response because it eliminates manual intervention and ensures the session policy is applied immediately upon incident creation. The automation rule can be scoped to incidents with specific analytics rules, severities, or entities, matching the requirement.

Answer

Instruct the analyst to run the playbook manually from the incident page each time.

Answer

Configure the incident creation rule in MCAS to automatically run the playbook.

Answer

Modify the analytics rule that detected the anomaly to run the playbook as an automated response.

Question 11

Your organization uses Microsoft Sentinel. You have a playbook that sends an email notification to the SOC team when a new incident is created. The playbook is currently triggered manually. You want the playbook to run automatically every time an incident of severity High is created. What should you do?

Accepted Answer

Create an automation rule that triggers when an incident is created with severity High and runs the playbook.. Automation rules in Sentinel can automatically trigger playbooks based on incident conditions. Option A is correct. Option B is wrong because automation rules are created in the Automation blade. Option C is wrong because the analytics rule does not directly run playbooks. Option D is wrong because the playbook trigger is not configured in Logic Apps designer.

Answer

Edit the analytics rule that generates the incident to include the playbook as an automated response.

Answer

Modify the playbook to add a trigger of 'When an incident is created' and set the severity condition.

Answer

Configure the playbook's Logic Apps designer to use an HTTP trigger that polls Sentinel for new incidents.

Question 12

Your organization uses Microsoft Sentinel and has several analytics rules that generate incidents from various data sources. The SOC team is overwhelmed by the number of incidents. You need to implement a triage system that automatically assigns incidents to different analysts based on the incident's tactics and severity. You also want to send a notification to the assigned analyst via Teams. What should you do?

Accepted Answer

Create multiple automation rules that trigger on incident creation, each with conditions for specific tactics and severity, and then run a playbook that assigns the incident to an analyst and sends a Teams notification.. Automation rules in Microsoft Sentinel trigger on incident creation and support conditions based on incident properties such as tactics and severity, and they can invoke a playbook. Creating multiple automation rules with tactic/severity conditions that each run an assignment-and-notification playbook delivers the required automatic triage and Teams alerting. This is the native, supported pattern for conditional incident routing.

Answer

Use a workbook to create a triage dashboard and instruct analysts to manually claim incidents from the dashboard.

Answer

Modify each analytics rule to include a custom details field that specifies the analyst, and use a playbook to send Teams notification based on that field.

Answer

Create a single playbook that checks the incident's tactics and severity, assigns it to the appropriate analyst, and sends a Teams notification, then configure that playbook to run automatically on all new incidents.

Question 13

Your organization uses Microsoft Defender for Endpoint (MDE) and Microsoft Sentinel. You receive an alert in MDE about a suspicious PowerShell command executed on a device. You create an incident in Sentinel from this alert. You need to automatically collect a memory dump from the affected device for further analysis. You have a playbook that can initiate a memory dump collection via the MDE API. What is the best way to automate this?

Accepted Answer

Create an automation rule that triggers when an incident is created from a MDE alert and runs the playbook to collect the memory dump.. Automation rules in Microsoft Sentinel can trigger playbooks when an incident is created. Option B is correct because it creates an automation rule that triggers on incident creation from a Microsoft Defender for Endpoint alert and runs the playbook to collect the memory dump automatically. Option A is incorrect because alert details enrichment only adds enrichment details, it does not run playbooks. Option C is incorrect because entity behavior analytics does not directly trigger playbooks on incident creation. Option D is incorrect because the requirement is automation, not manual action.

Answer

Configure the alert details enrichment in Sentinel to automatically add the memory dump to the incident.

Answer

Use entity behavior analytics in Sentinel to trigger the playbook when suspicious behavior is detected.

Answer

Have the analyst manually run the playbook from the incident page.

Question 14

A security analyst detects a suspicious login from an unusual location for a user in Microsoft Defender XDR. The analyst needs to investigate and contain the incident. Which TWO actions should be taken?

Accepted Answer

Disable the user account from Microsoft Entra ID.. Option A is correct because disabling the user account in Microsoft Entra ID immediately blocks the compromised identity from authenticating, which is the fastest containment action to stop further unauthorized access during a suspicious-login incident. Option C is correct because reviewing the user's sign-in logs and Identity Protection risk level in Microsoft Entra ID provides the investigative context — source IP, location, device, and whether the sign-in was flagged as risky — needed to confirm compromise before or alongside containment. Option B is not the right primary action because advanced hunting is a proactive threat-hunting tool, not the standard investigative/containment step for a specific flagged sign-in. Option D is not appropriate here because automated investigation playbooks are triggered by specific alerts or incidents and are not the analyst's direct manual containment action. Option E is not the best choice because a password reset alone does not immediately terminate active sessions or block the account, so it is weaker containment than disabling the account.

Answer

Create a custom hunting query in Microsoft 365 Defender advanced hunting.

Answer

Run an automated investigation playbook.

Answer

Reset the user's password.

Question 15

An incident in Microsoft Sentinel involves multiple alerts indicating a potential data exfiltration via SharePoint Online. You need to respond and remediate. Which THREE actions should be taken?

Accepted Answer

Remove external sharing permissions on SharePoint sites.. Removing external sharing permissions on SharePoint sites (A) prevents further data leaks via sharing. Blocking the user account in Microsoft Entra ID (B) stops further access immediately. Isolating the user's device using Microsoft Defender for Endpoint (D) contains the threat by preventing lateral movement. Resetting the user's password and enforcing MFA (C) is a good follow-up but less immediate than blocking the account. Creating a custom detection rule (E) is proactive but not a direct response to the current incident.

Answer

Reset the user's password and enforce MFA.

Answer

Create a custom detection rule for similar activity.