SC-200 Respond to security incidents Practice Test 4 — 15 Questions

Question 1

Your Microsoft 365 tenant is protected by Microsoft Defender for Office 365. A user reports receiving a suspicious email with a link. You need to investigate whether the link was malicious and if any other users clicked it. Which tool should you use first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Threat Explorer. Threat Explorer (Option D) is the correct first tool because it provides a centralized view of email threats, including malicious links and clicks. You can filter by URL or sender to identify if the specific link was detected as malicious and then use the 'Click to allow/block' feature or the 'URL clicks' view to see which users clicked it. This aligns with the incident response workflow for investigating phishing campaigns in Defender for Office 365.

Answer

Microsoft Entra ID sign-in logs

Answer

Microsoft Purview compliance portal

Answer

Email Entity page in Microsoft Defender XDR

Answer

Attack Simulation Training

Question 2

Refer to the exhibit. A security analyst runs this PowerShell script to query a Log Analytics workspace. What is the purpose of this query?

Accepted Answer

Detect suspicious PowerShell activity using encoded commands. The PowerShell script uses the `| where {$_ -match 'powershell.*-enc'} ` filter to search for command lines containing 'powershell' followed by '-enc', which is the alias for the `-EncodedCommand` parameter. This parameter is commonly used by attackers to obfuscate malicious PowerShell commands by passing them as a Base64-encoded string. The query is specifically designed to detect suspicious PowerShell executions that use encoded commands, making option D correct.

Answer

Count the number of unique devices

Answer

Identify all PowerShell executions in the last 7 days

Answer

List all processes run by a specific account

Answer

Find devices that have not run PowerShell recently

Question 3

During an incident, you need to isolate a compromised device from the network while allowing communication with Microsoft Defender for Endpoint cloud services. Which isolation type should you choose in Microsoft Defender XDR?

Accepted Answer

Selective isolation. Selective isolation (E) is the correct choice because it restricts network communication to only Microsoft Defender for Endpoint cloud services, blocking all other inbound and outbound traffic. This allows the compromised device to remain manageable and receive security updates while preventing lateral movement and further compromise. Full isolation would block all network traffic, including Defender services, rendering the device unmanageable.

Answer

Controlled folder access

Answer

Network protection

Answer

Block file

Answer

Full isolation

Question 4

Your organization uses Microsoft Defender for Cloud Apps. You receive an alert about an impossible travel activity for a user. What is the best first step to validate if this is a true positive?

Accepted Answer

Review the user's sign-in logs in Microsoft Entra ID. Impossible travel alerts in Microsoft Defender for Cloud Apps are generated based on sign-in activity and user location data. The most direct way to validate whether the alert is a true positive is to review the user's sign-in logs in Microsoft Entra ID (formerly Azure AD), which provides detailed information about each sign-in attempt, including IP addresses, locations, timestamps, and authentication details. This allows you to confirm whether the two sign-ins occurred within an unrealistic time frame for the geographic distance, or if there are anomalies such as VPN usage or IP spoofing that indicate a false positive.

Answer

Block the user immediately

Answer

Run an advanced hunting query in Microsoft Sentinel

Answer

Contact the user's manager

Answer

Check the user's device compliance in Microsoft Intune

Question 5

During an incident investigation in Microsoft Sentinel, you need to gather related events from multiple data sources into a single view for analysis. Which feature should you use?

Accepted Answer

Investigation graph. The Investigation graph in Microsoft Sentinel is specifically designed to visually correlate and explore related entities and events across multiple data sources within a single investigation. It allows you to pivot from an alert or entity to see connected users, hosts, IP addresses, and other events, providing a unified view for analysis. This feature directly addresses the need to gather related events from disparate sources into one cohesive view during incident response.

Answer

Workbooks

Answer

Watchlists

Answer

Logs blade

Answer

Analytics rules

Question 6

Refer to the exhibit. You are deploying this analytics rule in Microsoft Sentinel. Which activity will trigger an alert?

Accepted Answer

Word launching cmd.exe. The analytics rule is configured to trigger an alert when a process creation event (Event ID 4688) has a parent process of 'winword.exe' and a child process of 'cmd.exe'. This specific parent-child relationship indicates that Microsoft Word is launching a command prompt, which is a common technique used in malicious documents to execute commands. The rule's query filters for 'ParentImage' containing 'winword.exe' and 'Image' containing 'cmd.exe', so only when Word launches cmd.exe will the alert fire.

Answer

cmd.exe launching winword.exe

Answer

Any process creation event

Answer

Winword.exe execution

Answer

Any cmd.exe execution

Question 7

During an incident response, you identify that a user's account was used to sign in from an unusual location. You need to contain the incident immediately. What should you do first?

Accepted Answer

Disable the user account in Microsoft Entra ID.. Disabling the user account in Microsoft Entra ID is the fastest and most effective way to immediately prevent any further sign-ins from any location, including the compromised session. This action blocks all authentication attempts instantly, regardless of tokens or session state, and is the recommended first step in containing a confirmed account compromise during incident response.

Answer

Reset the user's password.

Answer

Revoke the user's refresh tokens.

Answer

Create a Conditional Access policy to block the user.

Question 8

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. During an incident investigation, you find that a device is exfiltrating data to an external IP. You need to isolate the device from the network using automated response. Which action should you configure in an automation rule?

Accepted Answer

Run a playbook that triggers a Microsoft Defender for Endpoint 'Isolate device' action.. The scenario requires network isolation of a device that is actively exfiltrating data. Microsoft Defender for Endpoint provides a built-in 'Isolate device' action that can be triggered via a playbook from a Microsoft Sentinel automation rule. This action immediately blocks all inbound and outbound network traffic to and from the device, except for communication with the Defender for Endpoint service, effectively containing the threat.

Answer

Trigger a Microsoft Purview data loss prevention policy.

Answer

Run a Microsoft Entra ID playbook to disable the device.

Answer

Create an automation rule in Microsoft Intune to wipe the device.

Question 9

You are investigating a ransomware incident in Microsoft Sentinel. The incident contains multiple alerts. You need to group related alerts under the same incident to reduce alert fatigue. What should you do?

Accepted Answer

Configure incident creation rules in the analytics rule.. In Microsoft Sentinel, incident creation is configured directly within the analytics rule. When you create or edit an analytics rule, the 'Incident creation' settings allow you to enable incident generation from alerts triggered by that rule. This ensures that all alerts from the same rule are grouped into a single incident, reducing alert fatigue by preventing multiple separate incidents for related alerts.

Answer

Enable User and Entity Behavior Analytics (UEBA).

Answer

Create a new analytics rule to combine alerts.

Answer

Use an automation rule to merge incidents.

Question 10

You are responding to a phishing incident. The investigation reveals that a user clicked a link in a phishing email and entered credentials on a fake site. You need to contain the incident and prevent further compromise. What should you do first?

Accepted Answer

Reset the user's password and revoke sessions.. The immediate priority when credentials have been compromised is to invalidate them, preventing the attacker from using them for further access. Resetting the password and revoking sessions (e.g., via Azure AD 'Revoke-AzureADUserAllRefreshToken' or 'Revoke-MgUserSignInSession') ensures the attacker cannot authenticate again, even if they have the password hash or active tokens. This aligns with the NIST SP 800-61 incident response containment phase.

Answer

Report the phishing site to Microsoft.

Answer

Block the phishing URL in Microsoft Defender for Office 365.

Answer

Delete the phishing email from the user's mailbox.

Question 11

Your organization uses Microsoft Defender for Cloud Apps. During an incident, you discover that a user is downloading large amounts of data from SharePoint to an unmanaged device. You need to automatically block further downloads from that device. What should you configure?

Accepted Answer

Create a session policy in Microsoft Defender for Cloud Apps to block download.. A session policy in Microsoft Defender for Cloud Apps uses reverse proxy capabilities to monitor and control user activities in real time. By configuring a session policy with the 'block download' action, you can immediately stop further downloads from SharePoint to the unmanaged device during the incident, without affecting managed devices.

Answer

Create a Conditional Access policy to require a compliant device.

Answer

Configure Microsoft Intune device compliance policy.

Answer

Create a DLP policy in Microsoft Purview.

Question 12

You are investigating a security incident in Microsoft Sentinel. You want to visualize the relationships between entities such as IP addresses, users, and hosts. Which tool should you use?

Accepted Answer

Investigation graph. The Investigation graph in Microsoft Sentinel is specifically designed to visualize relationships between entities such as IP addresses, users, and hosts, making it the correct tool for this task. Analytics rules (B) are used for detection, automation rules (C) for automated responses, and workbooks (D) for dashboards and reporting, not for entity relationship visualization.

Answer

Analytics rules

Answer

Automation rules

Answer

Workbooks

Question 13

You are responding to an incident where a malicious PowerShell script was executed on multiple endpoints. You need to collect the script content from the affected devices for analysis. What should you use?

Accepted Answer

Microsoft Defender for Endpoint live response. Microsoft Defender for Endpoint live response (Option B) is the correct tool because it provides a remote shell connection to an endpoint, allowing you to collect the malicious PowerShell script content directly from the device's file system or memory. This is essential for forensic analysis when a script has been executed, as you can use commands like `Get-Content` or `Get-File` to retrieve the script file. Other options lack the direct, real-time access needed to extract script content from affected endpoints.

Answer

Microsoft Defender for Cloud Apps activity logs

Answer

Microsoft Purview eDiscovery

Answer

Azure Automation runbook

Question 14

Your organization uses Microsoft Sentinel and Microsoft Defender for Cloud. During an incident, you need to automatically disable a compromised Azure VM from the network. Which playbook action should you use?

Accepted Answer

Add a rule to the VM's network security group to deny all traffic.. Adding a rule to the VM's network security group (NSG) to deny all traffic is the most direct and immediate way to isolate a compromised Azure VM at the network level. NSG rules are evaluated in order of priority, and a deny-all rule (e.g., denying any inbound and outbound traffic) effectively cuts off all network communication to and from the VM, which is a common containment step during incident response. This action can be automated via a Microsoft Sentinel playbook using the Azure Network Security Group connector.

Answer

Apply an Azure Policy to deny network changes.

Answer

Create an Azure Firewall rule to block the VM's IP.

Answer

Remove the VM's role assignment from Azure RBAC.

Question 15

You are investigating a suspicious sign-in to a privileged account. You need to determine if the sign-in was from a known malicious IP address. Which Microsoft Sentinel data source should you query?

Accepted Answer

ThreatIntelligenceIndicator. The ThreatIntelligenceIndicator table in Microsoft Sentinel contains indicators of compromise, including known malicious IP addresses, making it the correct data source to query for this investigation. Option B (SecurityEvent) contains Windows security event logs, not threat intelligence. Option C (SigninLogs) shows sign-in events but does not include threat intelligence data. Option D (AuditLogs) records directory changes and administrative activities, not threat indicators.

Answer

SecurityEvent

Answer

SigninLogs

Answer

AuditLogs