SC-200 Respond to security incidents Practice Test 4 — 15 Questions

Question 1

Refer to the exhibit. You are reviewing an automation rule in Microsoft Sentinel. What will happen when a new incident with severity Medium is created?

Accepted Answer

The rule will not trigger because severity is Medium. The automation rule triggers only on 'IncidentCreated' with condition 'IncidentSeverity Equals High'. Medium severity does not meet the condition, so the rule does not run.

Answer

The rule will trigger and create a new incident

Answer

The rule will trigger and run the playbook

Answer

The rule will update the incident severity to High

Answer

The rule will trigger but skip the playbook

Question 2

Your Microsoft 365 tenant is protected by Microsoft Defender for Office 365. A user reports receiving a suspicious email with a link. You need to investigate whether the link was malicious and if any other users clicked it. Which tool should you use first?

Accepted Answer

Threat Explorer. Threat Explorer allows investigation of email threats, including URLs and user clicks. The others are for other purposes.

Answer

Microsoft Entra ID sign-in logs

Answer

Microsoft Purview compliance portal

Answer

Email Entity page in Microsoft Defender XDR

Answer

Attack Simulation Training

Question 3

Refer to the exhibit. A security analyst runs this PowerShell script to query a Log Analytics workspace. What is the purpose of this query?

Accepted Answer

Detect suspicious PowerShell activity using encoded commands. The query hunts for PowerShell executions with encoded commands, a common technique for obfuscation. It is not limited to specific users, recent activity, or only encoded commands without other criteria.

Answer

Count the number of unique devices

Answer

Identify all PowerShell executions in the last 7 days

Answer

List all processes run by a specific account

Answer

Find devices that have not run PowerShell recently

Question 4

During an incident, you need to isolate a compromised device from the network while allowing communication with Microsoft Defender for Endpoint cloud services. Which isolation type should you choose in Microsoft Defender XDR?

Accepted Answer

Selective isolation. Selective isolation (E) is the correct choice because it restricts network communication to only Microsoft Defender for Endpoint cloud services, blocking all other inbound and outbound traffic. This allows the compromised device to remain manageable and receive security updates while preventing lateral movement and further compromise. Full isolation would block all network traffic, including Defender services, rendering the device unmanageable.

Answer

Controlled folder access

Answer

Network protection

Answer

Block file

Answer

Full isolation

Question 5

Which Microsoft Sentinel feature allows you to automatically respond to incidents by running a playbook when an incident is created?

Accepted Answer

Automation rules. Automation rules in Microsoft Sentinel allow you to define automated responses to incidents, including running a playbook when an incident is created. They provide a centralized way to trigger actions based on incident properties such as severity, status, or specific tactics, without needing to embed automation logic directly in analytics rules.

Answer

Analytics rules

Answer

Playbooks

Answer

Watchlists

Answer

Workbooks

Question 6

Your organization uses Microsoft Defender for Cloud Apps. You receive an alert about an impossible travel activity for a user. What is the best first step to validate if this is a true positive?

Accepted Answer

Review the user's sign-in logs in Microsoft Entra ID. Option D is correct because impossible travel alerts in Microsoft Defender for Cloud Apps are generated based on sign-in activity and user location data. The most direct way to validate whether the alert is a true positive is to review the user's sign-in logs in Microsoft Entra ID (formerly Azure AD), which provides detailed information about each sign-in attempt, including IP addresses, locations, timestamps, and authentication details. This allows you to confirm whether the two sign-ins occurred within an unrealistic time frame for the geographic distance, or if there are anomalies such as VPN usage or IP spoofing that indicate a false positive.

Answer

Block the user immediately

Answer

Run an advanced hunting query in Microsoft Sentinel

Answer

Contact the user's manager

Answer

Check the user's device compliance in Microsoft Intune

Question 7

During an incident investigation in Microsoft Sentinel, you need to gather related events from multiple data sources into a single view for analysis. Which feature should you use?

Accepted Answer

Investigation graph. The Investigation graph in Microsoft Sentinel is specifically designed to visually correlate and explore related entities and events across multiple data sources within a single investigation. It allows you to pivot from an alert or entity to see connected users, hosts, IP addresses, and other events, providing a unified view for analysis. This feature directly addresses the need to gather related events from disparate sources into one cohesive view during incident response.

Answer

Workbooks

Answer

Watchlists

Answer

Logs blade

Answer

Analytics rules

Question 8

Refer to the exhibit. You are deploying this analytics rule in Microsoft Sentinel. Which activity will trigger an alert?

Accepted Answer

Word launching cmd.exe. The query detects when cmd.exe is created by winword.exe, indicating a potential macro-based attack. It does not look for other processes or parent processes.

Answer

cmd.exe launching winword.exe

Answer

Any process creation event

Answer

Winword.exe execution

Answer

Any cmd.exe execution

Question 9

During an incident response, you identify that a user's account was used to sign in from an unusual location. You need to contain the incident immediately. What should you do first?

Accepted Answer

Disable the user account in Microsoft Entra ID.. Option A is correct because disabling the user account in Microsoft Entra ID is the fastest way to stop all sign-ins, containing the incident. Option B is wrong because resetting password alone does not prevent the attacker from using existing tokens. Option C is wrong because revoking sessions does not block future sign-ins. Option D is wrong because Conditional Access policies cannot block a specific user instantly.

Answer

Reset the user's password.

Answer

Revoke the user's refresh tokens.

Answer

Create a Conditional Access policy to block the user.

Question 10

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. During an incident investigation, you find that a device is exfiltrating data to an external IP. You need to isolate the device from the network using automated response. Which action should you configure in an automation rule?

Accepted Answer

Run a playbook that triggers a Microsoft Defender for Endpoint 'Isolate device' action.. Option B is correct because Microsoft Defender for Endpoint provides the 'Isolate device' action that can be triggered from Sentinel automation rules. Option A is wrong because Microsoft Entra ID does not have device isolation. Option C is wrong because Intune is for device management but not immediate isolation. Option D is wrong because Microsoft Purview is for data governance, not device isolation.

Answer

Trigger a Microsoft Purview data loss prevention policy.

Answer

Run a Microsoft Entra ID playbook to disable the device.

Answer

Create an automation rule in Microsoft Intune to wipe the device.

Question 11

You are investigating a ransomware incident in Microsoft Sentinel. The incident contains multiple alerts. You need to group related alerts under the same incident to reduce alert fatigue. What should you do?

Accepted Answer

Configure incident creation rules in the analytics rule.. Option A is correct because incident creation rules in Sentinel automatically group alerts by entities and time window. Option B is wrong because analytics rules create alerts, not incidents. Option C is wrong because automation rules trigger playbooks, not grouping. Option D is wrong because entity behavior analytics is a separate feature.

Answer

Enable User and Entity Behavior Analytics (UEBA).

Answer

Create a new analytics rule to combine alerts.

Answer

Use an automation rule to merge incidents.

Question 12

You are responding to a phishing incident. The investigation reveals that a user clicked a link in a phishing email and entered credentials on a fake site. You need to contain the incident and prevent further compromise. What should you do first?

Accepted Answer

Reset the user's password and revoke sessions.. Option D is correct because resetting the compromised user password immediately prevents further access using stolen credentials. Option A is wrong because blocking the URL does not invalidate already stolen credentials. Option B is wrong because deleting the email from the user's mailbox does not prevent use of stolen credentials. Option C is wrong because reporting the site to Microsoft is reactive.

Answer

Report the phishing site to Microsoft.

Answer

Block the phishing URL in Microsoft Defender for Office 365.

Answer

Delete the phishing email from the user's mailbox.

Question 13

Your organization uses Microsoft Defender for Cloud Apps. During an incident, you discover that a user is downloading large amounts of data from SharePoint to an unmanaged device. You need to automatically block further downloads from that device. What should you configure?

Accepted Answer

Create a session policy in Microsoft Defender for Cloud Apps to block download.. Option B is correct because Defender for Cloud Apps session policies can block downloads from unmanaged devices. Option A is wrong because conditional access policies block access but not specific actions. Option C is wrong because DLP policies generate alerts but do not block. Option D is wrong because device compliance policies require Intune enrollment.

Answer

Create a Conditional Access policy to require a compliant device.

Answer

Configure Microsoft Intune device compliance policy.

Answer

Create a DLP policy in Microsoft Purview.

Question 14

You are investigating a security incident in Microsoft Sentinel. You want to visualize the relationships between entities such as IP addresses, users, and hosts. Which tool should you use?

Accepted Answer

Investigation graph. Option D is correct because the investigation graph in Sentinel provides a visual map of entity relationships. Option A is wrong because workbooks are for dashboards. Option B is wrong because analytics rules define detections. Option C is wrong because automation rules trigger responses.

Answer

Analytics rules

Answer

Automation rules

Answer

Workbooks

Question 15

You are responding to an incident where a malicious PowerShell script was executed on multiple endpoints. You need to collect the script content from the affected devices for analysis. What should you use?

Accepted Answer

Microsoft Defender for Endpoint live response. Option C is correct because Microsoft Defender for Endpoint live response allows you to remotely collect files from devices. Option A is wrong because Microsoft Defender for Cloud Apps is for cloud apps. Option B is wrong because Azure Automation runbooks are for orchestration. Option D is wrong because Microsoft Purview eDiscovery is for legal discovery.

Answer

Microsoft Defender for Cloud Apps activity logs

Answer

Microsoft Purview eDiscovery

Answer

Azure Automation runbook

SC-200 Respond to security incidents Practice Test 4 — 15 Questions

Exhibit

SC-200 Respond to security incidents Practice Test 4 — 15 Questions

Exhibit