SC-200 Respond to security incidents Practice Test 34 — 15 Questions

Question 1

Your organization uses Microsoft Sentinel as its SIEM and Microsoft Defender XDR for endpoint detection. A critical incident has been generated: 'Possible ransomware activity detected on multiple endpoints.' The incident includes alerts from Microsoft Defender for Endpoint (MDE) about file encryption behaviors and from Microsoft Defender for Identity (MDI) about anomalous service account logins. You have been assigned the incident and need to contain the threat effectively. You have Microsoft Sentinel automation rules that can trigger playbooks, and you have Microsoft Defender XDR actions available. The environment includes 500 Windows 10 devices managed by Microsoft Intune, and 50 servers on-premises. Some servers are domain controllers. Which of the following is the BEST first course of action?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Isolate the affected devices using Microsoft Defender for Endpoint device isolation.. For active ransomware encrypting files across multiple endpoints, the priority is to stop the spread immediately. Microsoft Defender for Endpoint device isolation cuts network communication while preserving the Defender sensor channel for investigation, containing the threat before lateral movement or further encryption. Forensic collection and account remediation are important but secondary to stopping active encryption.

Answer

Disable all compromised service accounts in Microsoft Entra ID and reset their passwords.

Answer

Reset passwords for all domain administrator accounts and enforce MFA.

Answer

Trigger a Microsoft Sentinel playbook to collect forensic evidence from affected endpoints before remediation.

Question 2

Contoso uses Microsoft Sentinel with Microsoft Defender XDR connector. You receive an incident titled 'Malware detected on endpoint' from Microsoft Defender for Endpoint. The incident includes a detailed timeline showing that the malware was downloaded from a malicious URL. You need to respond to the incident using Microsoft Sentinel and Microsoft Defender XDR capabilities. The affected device is a Windows 10 workstation used by a standard user. You have been asked to contain the threat and prevent recurrence. The organization has a policy to preserve evidence for 90 days. Which action should you take FIRST?

Accepted Answer

Isolate the device using Microsoft Defender for Endpoint device isolation.. Isolating the device using Microsoft Defender for Endpoint immediately contains the threat by disconnecting the device from the network, preventing the malware from spreading or communicating with command-and-control servers. This is the priority first step in incident response. Option A is incorrect because resetting the password does not remove malware from the device. Option B is incorrect creating a custom detection rule is a proactive step but not an immediate containment action. Option C is incorrect because blocking the URL at the firewall prevents further downloads but does not contain the already infected device.

Answer

Reset the user's password and revoke sessions in Microsoft Entra ID.

Answer

Create a custom detection rule in Microsoft Sentinel for the malicious URL.

Answer

Block the malicious URL at the firewall using Microsoft Defender for Cloud Apps.

Question 3

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. An incident is generated for a user who received a phishing email that bypassed Exchange Online Protection. The user clicked the link and entered credentials on a fake login page. The incident includes alerts from Microsoft Defender for Office 365 and Microsoft Entra ID. You need to respond to the incident. The affected user has administrative privileges. Which of the following should you do FIRST?

Accepted Answer

Reset the user's password and revoke sessions in Microsoft Entra ID.. Resetting the user's password and revoking sessions immediately prevents attacker use of stolen credentials, especially given the user has administrative privileges. Option B is wrong because reporting the email is not the highest priority. Option C is wrong because creating a transport rule is a longer-term action. Option D is wrong because deleting the email does not address the compromised credentials.

Answer

Report the phishing email to Microsoft for analysis.

Answer

Create a transport rule to block similar phishing emails.

Answer

Delete the phishing email from the user's mailbox.

Question 4

Wide World Importers uses Microsoft Sentinel, Microsoft Defender XDR, and Microsoft Purview for data loss prevention (DLP). An incident is generated: 'DLP policy violation - sensitive data shared externally.' The incident shows that a user shared a document containing credit card numbers via SharePoint Online with an external guest. The user is a finance department employee. You need to respond to the incident. The organization wants to minimize business disruption while protecting data. Which of the following is the BEST immediate action?

Accepted Answer

Remove the external guest's access to the document in SharePoint Online.. Removing the external guest's access to the document stops data exposure without affecting the user's work. Option A is wrong: disabling the user prevents all work and may be too drastic. Option B is wrong: deleting the document destroys evidence. Option D is wrong: DLP policy change takes time and does not stop current exposure.

Answer

Delete the document from SharePoint Online.

Answer

Modify the DLP policy to block sharing of credit card numbers.

Answer

Disable the user's account in Microsoft Entra ID and investigate.

Question 5

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. An incident is triggered: 'Lateral movement detected - pass-the-hash attack.' The incident includes alerts from Microsoft Defender for Identity (MDI) showing anomalous NTLM authentication attempts from a compromised workstation to multiple servers. The compromised workstation is a Windows 10 device. You need to contain the incident. Which of the following actions should you take FIRST?

Accepted Answer

Isolate the compromised workstation using Microsoft Defender for Endpoint.. The compromised Windows 10 workstation is the source of the pass-the-hash authentication attempts, so isolating it via Microsoft Defender for Endpoint immediately cuts off the attacker's ability to pivot to additional servers. This is the fastest containment action and preserves forensic evidence on the endpoint. Only after containment should the team proceed with credential resets and broader remediation.

Answer

Reset the krbtgt account password twice.

Answer

Disable NTLM authentication across the domain.

Answer

Reset passwords on all servers that received anomalous authentication attempts.

Question 6

You are a SOC analyst using Microsoft Defender XDR. An incident named 'Suspicious PowerShell download' is assigned to you. You need to quickly determine the initial entry point and the scope of affected devices. Which action should you perform first within the incident?

Accepted Answer

Review the incident timeline to identify the first alert and related entities.. The incident timeline in Microsoft Defender XDR provides a chronological view of alerts and activities, allowing analysts to quickly identify the initial alert and affected entities. This is critical for understanding the entry point and scope before taking further action. Other options, while valid later, do not directly address the immediate need for triage.

Answer

Export the incident details to a CSV file for offline analysis.

Answer

Initiate an automated investigation to remediate the threat.

Answer

Run an advanced hunting query to list all devices with PowerShell events.

Question 7

You are investigating a potential compromise of a service account in Microsoft Sentinel. You need to identify all actions performed by this account across Azure and Microsoft 365. Which Sentinel feature should you use?

Accepted Answer

Logs query with KQL. Logs query with KQL in Microsoft Sentinel enables analysts to search across multiple data sources for activities related to a specific account. This is essential for identifying all actions performed by a compromised service account. Other features like UEBA, Workbooks, and Automation rules serve different purposes and do not provide the detailed, cross-service activity list needed.

Answer

Entity behavior analytics

Answer

Automation rules

Answer

Workbooks

Question 8

You are a Security Operations Analyst using Microsoft Defender XDR. An incident named 'Phishing campaign targeting finance' has been automatically created from multiple alerts. The incident contains evidence for several users and mailboxes. You need to determine which users were affected by the campaign and the timeline of their interactions with the malicious emails. Which feature should you use?

Accepted Answer

The incident's Attack story timeline. The Attack story timeline within a Microsoft Defender XDR incident aggregates alerts, events, and entities into a chronological narrative. This directly shows which users were involved in the phishing campaign and the sequence of their actions, such as clicking links or opening attachments, enabling rapid scoping and response.

Answer

The Microsoft Defender for Office 365 Explorer

Answer

Advanced hunting with a custom KQL query

Answer

The Microsoft 365 Defender portal's Incidents queue

Question 9

You are investigating a Microsoft Defender XDR incident where a user's device is showing signs of compromise. The incident includes alerts from Microsoft Defender for Endpoint and Microsoft Defender for Identity. You need to isolate the device from the network while preserving forensic evidence. Which action should you take?

Accepted Answer

Run the 'Isolate device' action in Microsoft Defender for Endpoint, selecting the 'Full isolation' option.. Full isolation in Microsoft Defender for Endpoint is the correct action to contain a compromised device while preserving forensic evidence. It restricts network communication to only the Defender for Endpoint service, preventing lateral movement and C2 traffic, and allows investigators to perform live response and collect evidence. Other options either misstate capabilities or do not achieve isolation. Disabling a user account does not isolate the device, and antivirus scans do not contain the threat.

Answer

Initiate a full antivirus scan on the device and then reboot it to remove the threat.

Answer

Use Microsoft Defender for Identity to disable the user account and then isolate the device from the Defender for Identity portal.

Answer

Run the 'Live response' session and execute the 'isolate' command.

Question 10

You are a SOC analyst using Microsoft Defender XDR. An incident named "Multi-stage intrusion on FIN-PC01" contains alerts for a malicious PowerShell script, a suspicious outbound connection to a known C2 IP, and credential dumping activity. You need to perform an investigation that automatically shows the full attack story, including related entities, alerts, and timeline, without manually correlating each alert. What should you use?

Accepted Answer

The incident's attack story timeline in the Microsoft Defender XDR portal. The attack story timeline in Microsoft Defender XDR is designed to automatically correlate all alerts, entities, and events from an incident into a single, interactive timeline. It eliminates manual correlation and provides a comprehensive view of the attack, which is exactly what the analyst needs to understand the full scope quickly.

Answer

The Microsoft Sentinel incident investigation graph

Answer

Automated investigation and response (AIR) investigation details page

Answer

Advanced hunting with a custom KQL query across DeviceProcessEvents and DeviceNetworkEvents

Question 11

You are a Security Operations Analyst at a company that uses Microsoft Defender XDR. An incident named 'Phishing campaign targeting finance' is assigned to you. The incident contains multiple alerts across Exchange Online and Microsoft Defender for Office 365. You need to perform a manual investigation and then take remediation actions. Which built-in incident management capability in the Microsoft 365 Defender portal allows you to view the attack story, evidence, and response actions for this incident in a single pane?

Accepted Answer

The incident investigation page in the Microsoft 365 Defender portal. The incident investigation page in Microsoft Defender XDR consolidates alerts, entities, evidence, and the attack story for a single incident. It is purpose-built for analysts to move from triage to investigation and then to response, with actions like email soft delete and device isolation available inline. Other pages either list incidents, provide raw query access, or focus on a different workload, so they do not meet the single-pane investigation and remediation requirement.

Answer

The Microsoft Defender for Cloud Apps portal

Answer

The Incidents queue page in the Microsoft 365 Defender portal

Answer

The Advanced hunting page in the Microsoft 365 Defender portal

Question 12

You are a Microsoft Sentinel analyst investigating an incident that contains several related alerts about a compromised user account. Your incident response runbook requires you to temporarily prevent the attacker from using the account while preserving the ability to restore access after remediation. You need to disable the account in Microsoft Entra ID directly from the incident investigation experience. What should you do?

Accepted Answer

Open the user entity page in the incident, select the Disable user account action, and confirm the operation.. Microsoft Sentinel surfaces user entities inside incidents and provides entity actions that reach into Microsoft Entra ID. Disabling the account immediately blocks authentication for the compromised identity while leaving the object intact, so it can be re-enabled once containment and remediation are verified. Watchlists, Conditional Access, and deletion either do not change account state directly or introduce unnecessary disruption and recovery complexity.

Answer

Delete the user object in Microsoft Entra ID and restore it from the deleted users list after remediation.

Answer

Add the user entity to a watchlist, then configure an automation rule that disables accounts on the watchlist.

Answer

Assign the user a Conditional Access policy that blocks all cloud apps, then close the incident.

Question 13

A security analyst in your SOC is investigating a Microsoft Defender XDR incident. The analyst wants to see a visual representation of the attack timeline and related entities across emails, devices, and identities. Which feature should the analyst use?

Accepted Answer

Incident graph in Microsoft Defender XDR.. The incident graph in Microsoft Defender XDR is designed to provide a visual, interactive representation of an incident, showing the relationships between entities like users, devices, mailboxes, and the timeline of events. It aggregates alerts from multiple Defender workloads, enabling analysts to quickly understand the attack's scope. Advanced hunting is query-based, Sentinel's graph is separate, and Defender for Cloud Apps activity log is app-focused. The incident graph directly fulfills the need for a visual attack timeline and entity mapping.

Answer

Microsoft Sentinel incident investigation graph.

Answer

Advanced hunting in Microsoft Defender XDR.

Answer

Microsoft Defender for Cloud Apps activity log.

Question 14

A SOC analyst is investigating a Microsoft Sentinel incident involving a compromised service principal. The analyst needs to enrich the incident with information from an external threat intelligence platform that exposes a REST API and requires an API key. The enrichment must run automatically each time a matching incident is created and must not require manual steps. Which Microsoft Sentinel component should the analyst use to implement this enrichment?

Accepted Answer

A Microsoft Sentinel playbook triggered by an automation rule. Automated enrichment using an external API with an API key requires a Logic Apps-based playbook, which can securely store secrets, make HTTP calls, and write results back to the incident. Automation rules provide the trigger mechanism when an incident is created, ensuring the playbook runs without manual intervention. Analytics rules, workbooks, and data connectors serve different purposes and cannot fulfill the automated external enrichment requirement.

Answer

A data connector for the threat intelligence platform

Answer

A workbook with a custom parameter

Answer

A scheduled analytics rule with entity mapping

Question 15

A Microsoft Defender XDR incident shows a malicious email delivered to a user, and the analyst confirms the message contains a credential-harvesting link. Before the user clicks, you need to remove the message from all mailboxes in the tenant and block the sender and URL for the future. Which Microsoft Defender for Office 365 capability should you use from the incident?

Accepted Answer

The email entity page action to soft delete, hard delete, or move to junk, plus submitting the sender and URL for blocking.. When a malicious email is confirmed, Microsoft Defender for Office 365 provides email entity remediation actions that purge the message tenant-wide and let you block the associated sender and URL. This combines cleanup of the delivered threat with prevention of recurrence. Tools that only investigate, or controls that only affect future mail, leave the delivered message reachable and do not satisfy both halves of the requirement.

Answer

Threat Explorer with a message trace filter to identify and delete matching messages.

Answer

Automated investigation and response with the soft delete action on the email entity.

Answer

A mail flow transport rule in the Exchange admin center that rejects messages from the sender domain.