SC-200 Respond to security incidents Practice Test 4 — 15 Questions

Question 1

Your security operations center (SOC) uses Microsoft Sentinel with a custom analytics rule that generates an incident when more than 10 failed logons occur within 5 minutes. During a review, you notice that a single user triggered the rule by forgetting their password multiple times. The incident was automatically closed by a playbook. What is the most effective way to reduce false positives for this rule?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Increase the threshold to 20 failed logons. Increasing the threshold from 10 to 20 failed logons directly reduces false positives by requiring a higher volume of failures before triggering an incident. A user who simply forgets their password typically generates a handful of failed attempts, not 20 within 5 minutes, so legitimate brute-force or password-spray activity would still be caught while benign user error is filtered out. This is the standard tuning approach for threshold-based analytics rules in Microsoft Sentinel.

Answer

Create a playbook to automatically close the incident

Answer

Disable the analytics rule

Answer

Change the rule to group events by user

Question 2

A security analyst is investigating an incident involving a suspicious process that was detected on multiple devices. The analyst wants to check if the same file hash was observed on other devices in the past 30 days. Which Microsoft 365 Defender table should be queried in KQL?

Accepted Answer

DeviceFileEvents. DeviceFileEvents, option A, is the correct table because it captures file creation, modification, and deletion events, including the file hash. This allows querying for the same file hash across devices in the specified time range. DeviceProcessEvents (B) tracks process creation events but does not include file hash information. DeviceNetworkEvents (C) logs network connections and does not contain file hashes. DeviceEvents (D) is a catch-all for various event types but lacks the structured file hash data needed for this investigation.

Answer

DeviceNetworkEvents

Answer

DeviceProcessEvents

Answer

DeviceEvents

Question 3

Refer to the exhibit. You are analyzing a KQL query in Microsoft Sentinel that generates an incident for users with more than 5 failed sign-in attempts (error code 50057 indicates user account is disabled) from a single IP in the last hour. After enabling the rule, you receive too many incidents from a service account that legitimately fails frequently. How should you modify the query to reduce false positives?

Accepted Answer

Add a filter to exclude the service account: and UserPrincipalName !="svc-account@domain.com". The false positives come from a known-good service account that legitimately generates 50057 (account disabled) errors. Adding a KQL filter `and UserPrincipalName !="svc-account@domain.com"` excludes that identity from the summarize/threshold logic, so the rule only fires for non-service accounts. This is the standard Sentinel tuning pattern: whitelist known benign entities rather than weaken detection logic.

Answer

Change the error code to 50126

Answer

Remove the IPAddress from the summarize clause and group only by UserPrincipalName

Answer

Increase the Threshold to 10

Question 4

Which TWO actions can be taken directly from within a Microsoft Sentinel incident to aid in investigation? (Choose two.)

Accepted Answer

Create a bookmark to preserve a specific event. Option A is correct because Microsoft Sentinel incidents allow analysts to create bookmarks directly from incident entities or events, preserving specific evidence (such as a particular event or query result) for later reference during the investigation. Option B is correct because playbooks (Logic Apps) can be triggered manually from within an incident, enabling automated response or enrichment actions such as querying threat intelligence or notifying teams as part of the investigation workflow. Option C is not correct because reviewing a user's risk level in Microsoft Entra ID requires navigating to Entra ID (or using the entity's user page/IdentityInfo), not an action performed directly within the incident itself. Option D is not correct because severity is an attribute set on the incident (often automatically or manually via incident properties), not an investigative action that aids analysis. Option E is not correct because resetting a user's password is a remediation action performed in Entra ID or via a playbook, not a direct investigative action available from the incident.

Answer

Review the user risk level in Microsoft Entra ID

Answer

Assign a severity to the incident

Answer

Reset the user's password

Question 5

Which THREE of the following are valid incident types in Microsoft 365 Defender? (Choose three.)

Accepted Answer

Phishing. Options B, D, and E are correct because Microsoft 365 Defender incidents include categories like 'Phishing', 'Data exfiltration', and 'Malware'. Option A is incorrect because 'Insider risk' is managed in Microsoft Purview, not as a primary incident type in Defender. Option C is incorrect because 'Misconfiguration' is a finding, not an incident type.

Answer

Insider risk

Answer

Misconfiguration

Question 6

Refer to the exhibit. You are configuring an automation rule in Microsoft Sentinel to block IP addresses from high-severity incidents. The rule triggers on incident creation but fails to block the IP. What is the most likely cause?

Accepted Answer

The entity path 'incident.entities.IP' is incorrect; it needs to iterate over entities. In Microsoft Sentinel automation rules, to act on entities like IP addresses from an incident, you must iterate over the entities collection because an incident can contain multiple entities. The entity path 'incident.entities.IP' is incorrect because it assumes a single IP entity and does not account for the array structure. The correct approach is to use a 'For each' loop over 'incident.entities' and then reference the IP property. This is the most likely cause of the failure.

Answer

The trigger type should be 'alertTrigger' instead of 'incidentTrigger'

Answer

The action type 'blockIP' is not supported in automation rules

Answer

The severity condition should be 'GreaterThan' instead of 'Equals'

Question 7

Refer to the exhibit. An Azure administrator deploys this ARM template to create a Microsoft Sentinel automation rule. After deployment, the automation rule does not trigger when a high-severity incident is created. What is the most likely reason?

Accepted Answer

The automation rule is missing the 'triggers' property. The ARM template snippet does not include the required 'triggers' property. Microsoft Sentinel automation rules need a 'triggers' structure (e.g., incidentTrigger or alertTrigger) to define when the rule should activate; without it, the rule will never trigger. Option A is incorrect because 'LogicApp' is a valid action type for these automation rules. Option B is incorrect because the API version is not the root cause; the resource type in option D is actually correct.

Answer

The apiVersion is outdated

Answer

The action type 'LogicApp' is misspelled

Answer

The resource type should be 'Microsoft.OperationalInsights/workspaces/providers/automations'

Question 8

Your organization uses Microsoft Sentinel with the Microsoft Defender XDR connector. During an incident, you receive a critical alert for a user who is reported as compromised. You need to verify if the compromise is real and respond quickly. Which feature should you use to automatically trigger a playbook that contains the account?

Accepted Answer

An automation rule that triggers a playbook when the alert is created.. In Microsoft Sentinel, automation rules are the native mechanism to trigger playbooks in response to incidents or alerts. They evaluate conditions (e.g., alert severity, analytics rule name) and can automatically run a playbook that contains the affected account, enabling rapid containment.

Answer

An analytics rule configured to run a playbook when the alert is generated.

Answer

A workbook that displays the user's activity for manual investigation.

Answer

A watchlist that includes the user's name to block the account.

Question 9

During an incident investigation, you find that a user's credentials were used to sign in from an unfamiliar location. You want to force a password reset and revoke all sessions immediately. Which action should you take in the Microsoft 365 Defender portal?

Accepted Answer

Use the 'Require password reset' action from the user investigation page.. The 'Require password reset' action in the Microsoft 365 Defender user investigation page forces the user to change their password at next sign-in and simultaneously revokes all active refresh tokens and sessions. This directly satisfies both requirements — password reset and session revocation — in a single action. It is the recommended containment step for suspected credential compromise.

Answer

Disable the user account in Microsoft Entra ID.

Answer

Block the user's sign-in from the unfamiliar location via Conditional Access.

Answer

Remove the user's MFA registration to force re-registration.

Question 10

Your incident response team uses Microsoft Sentinel with automation rules and playbooks. During an incident, you need to automatically collect a memory dump from an affected Windows server and upload it to an Azure storage account for analysis. Which type of playbook should you use?

Accepted Answer

A playbook triggered by an automation rule when the incident is created.. Automation rules in Microsoft Sentinel trigger playbooks in response to incident creation or updates. To automatically collect a memory dump when an incident is created, you configure an automation rule with a trigger of 'When incident is created' that runs a playbook — this is the only mechanism that provides automatic, incident-driven execution.

Answer

A playbook that installs a script on the server to collect the dump.

Answer

A playbook triggered directly from the analytics rule that generates the alert.

Answer

A playbook that must be run manually from the incident page.

Question 11

You are investigating a suspicious sign-in reported in Microsoft Defender for Cloud Apps. The activity shows that a user accessed a sensitive SharePoint site from an anonymous IP address. What is the most effective immediate response to prevent further access?

Accepted Answer

Suspend the user account in Microsoft 365 Defender.. Suspending the user account in Microsoft 365 Defender is the most effective immediate response to prevent further access when a suspicious sign-in from an anonymous IP is detected. Suspending the account immediately blocks all sign-ins and access to Microsoft 365 services, including SharePoint, stopping any ongoing malicious activity. This is a containment action that takes effect quickly across all services.

Answer

Change the SharePoint site permissions to remove the user's access.

Answer

Disable the user's device in Microsoft Intune.

Answer

Add the anonymous IP address to the blocked IP address list in Conditional Access.

Question 12

Which THREE of the following are valid incident response actions in Microsoft Defender XDR?

Accepted Answer

Isolate a device.. Options A, D, and E are valid incident response actions in Microsoft Defender XDR. Isolating a device (A) prevents further compromise. Deleting an email message (D) removes malicious content from user mailboxes. Disabling a user account (E) stops access for compromised accounts. Option B is invalid because resetting a user password is typically done in Microsoft Entra ID, not directly as an incident action in Defender XDR. Option C is invalid because blocking a malicious URL is a threat protection action in Defender for Office 365 or Defender for Cloud Apps, not a direct incident response action in the Defender XDR portal.

Answer

Reset user password.

Answer

Block a malicious URL.

Question 13

You are investigating a data exfiltration incident in Microsoft Defender for Cloud Apps. The investigation reveals that a user downloaded sensitive files from SharePoint and uploaded them to a third-party cloud storage app. Which THREE actions should you take to contain the incident?

Accepted Answer

Apply a session policy to block uploads to unauthorized apps.. Option A is correct because a session policy in Defender for Cloud Apps uses Conditional Access App Control to monitor and block uploads to unauthorized cloud apps in real time, directly stopping the exfiltration channel. Option B is correct because suspending the user account in Microsoft 365 Defender immediately revokes the compromised user's access and halts further data movement while the investigation continues. Option C is correct because adding the third-party app to the blocked apps list in Defender for Cloud Apps marks it as unsanctioned, so governance controls and session policies will block or restrict its use going forward. Option D is not appropriate because Defender for Cloud Apps cannot delete files residing in a third-party cloud app it does not manage, and doing so could destroy evidence. Option E is not appropriate because sensitivity labels are applied in Microsoft 365 workloads to classify and protect files, not to contain an active exfiltration incident involving an external app.

Answer

Delete the files from the third-party cloud app.

Answer

Apply a sensitivity label to the files to prevent sharing.

Question 14

You have an automation rule in Microsoft Sentinel configured as shown. An incident with severity Medium is created, but the playbook does not run. What is the most likely reason?

Accepted Answer

The automation rule trigger is set to 'When incident is created', but the incident may have been created with a lower severity and later updated to Medium.. Automation rules in Microsoft Sentinel trigger based on the incident's properties at the time of the event. If the rule is set to trigger 'When incident is created' and the incident was initially created with a lower severity (e.g., Low) and later updated to Medium, the rule will not fire because the creation event did not match the severity condition.

Answer

The triggerType should be 'Alert' instead of 'Incident'.

Answer

The playbook does not have permissions to run in the Sentinel resource group.

Answer

The playbookId is incorrect or the playbook has been deleted.

Question 15

You are investigating a phishing incident in Microsoft Defender XDR. The alert indicates that a user clicked a malicious link in an email. After confirming the email was delivered to the user's inbox, what should be your first action?

Accepted Answer

Use Microsoft Defender for Office 365 to soft-delete the email from the user's mailbox and other recipients. The first action after confirming a phishing email was delivered is to soft-delete the email from the user's mailbox and other recipients using Microsoft Defender for Office 365 (D). This removes the threat from all mailboxes, preventing further clicks or credential theft. Soft-delete uses the 'Soft delete' action in Threat Explorer or the 'Purge' action, which moves the message to the Deleted Items folder and allows recovery if needed. This is the standard incident response step for delivered phishing.

Answer

Add the URL to the tenant block list in Microsoft Defender for Office 365

Answer

Send a training notification to the user

Answer

Reset the user's password immediately