SC-200 Respond to security incidents Practice Test 5 — 15 Questions

Question 1

Your organization uses Microsoft Sentinel and Microsoft Defender for Cloud. During an incident, you need to automatically disable a compromised Azure VM from the network. Which playbook action should you use?

Accepted Answer

Add a rule to the VM's network security group to deny all traffic.. Option A is correct because you can use Azure Network Security Group to deny all inbound/outbound traffic to the VM. Option B is wrong because Azure RBAC does not affect network access. Option C is wrong because Azure Policy does not apply runtime network controls. Option D is wrong because Azure Firewall rules are not VM-specific.

Answer

Apply an Azure Policy to deny network changes.

Answer

Create an Azure Firewall rule to block the VM's IP.

Answer

Remove the VM's role assignment from Azure RBAC.

Question 2

You are investigating a suspicious sign-in to a privileged account. You need to determine if the sign-in was from a known malicious IP address. Which Microsoft Sentinel data source should you query?

Accepted Answer

ThreatIntelligenceIndicator. Option B is correct because Threat Intelligence in Sentinel contains known malicious IPs. Option A is wrong because SigninLogs show sign-in events but not threat intelligence. Option C is wrong because AuditLogs are for directory changes. Option D is wrong because SecurityEvent is for Windows event logs.

Answer

SecurityEvent

Answer

SigninLogs

Answer

AuditLogs

Question 3

Which TWO actions should you perform to contain a ransomware incident in Microsoft Defender for Endpoint?

Accepted Answer

Isolate the device from the network.. Options B and D are correct. Isolating the device prevents further spread, and killing malicious processes stops encryption. Option A is wrong because running antivirus may not be immediate containment. Option C is wrong because resetting passwords is for user accounts, not endpoints. Option E is wrong because collecting files is for investigation, not containment.

Answer

Reset the local administrator password.

Answer

Run a full antivirus scan.

Answer

Collect the ransomware sample for analysis.

Question 4

Which THREE actions are part of the containment phase in the Microsoft Incident Response process?

Accepted Answer

Block known malicious IP addresses at the firewall.. Options A, C, and D are correct. Disabling compromised accounts, isolating affected systems, and blocking malicious IPs are containment actions. Option B is wrong because collecting forensic data is part of investigation. Option E is wrong because notifying stakeholders is communication.

Answer

Notify senior management of the incident.

Answer

Collect forensic data from affected systems.

Question 5

Which TWO Microsoft Defender XDR entities can be managed during incident response?

Accepted Answer

Devices. Options B and D are correct. Devices and user accounts are managed entities in Defender XDR. Option A is wrong because Azure subscriptions are not entities in Defender XDR. Option C is wrong because Microsoft 365 tenants are not managed entities. Option E is wrong because network interfaces are not entities.

Answer

Network interfaces

Answer

Azure subscriptions

Answer

Microsoft 365 tenants

Question 6

You are reviewing an automation rule in Microsoft Sentinel. The rule triggers on incident creation with severity High. However, during a recent High severity incident, the playbook did not run. What is the most likely cause?

Accepted Answer

The automation rule does not have an owner assigned.. Option B is correct because automation rules require an assigned owner to run playbooks. Option A is wrong because the rule triggers on creation, not closure. Option C is wrong because the condition is correct for High severity. Option D is wrong because the action order is fine.

Answer

The action order is set to 1, but another action has a higher priority.

Answer

The condition requires IncidentSeverity equals High, but the incident was classified as Medium.

Answer

The rule triggers on incident creation, but the incident was first closed and then reopened.

Question 7

You are investigating repeated SQL injection alerts. The KQL query returns IP addresses with more than 5 alerts in the last 7 days. What is the purpose of the `summarize` and `where AlertCount > 5` lines?

Accepted Answer

To identify IPs with a high number of alerts, indicating a possible attack.. Option D is correct because the query groups alerts by IP and filters for those with high frequency, indicating a potential attack. Option A is wrong because the query does not remove duplicates. Option B is wrong because it does not count distinct IPs. Option C is wrong because it does not correlate with other tables.

Answer

To correlate alerts with other data sources.

Answer

To remove duplicate alerts from the same IP.

Answer

To count the number of distinct IP addresses.

Question 8

You are reviewing an incident in Microsoft Sentinel. The incident is assigned to a user. What does the 'assignedTo' field indicate?

Accepted Answer

The incident is assigned to that user for investigation.. Option A is correct because 'assignedTo' indicates the user responsible for the incident. Option B is wrong because the incident is not closed. Option C is wrong because it is the owner. Option D is wrong because it is an individual.

Answer

The incident was created by that user.

Answer

The incident was closed by that user.

Answer

The incident is assigned to a Microsoft Entra group.

Question 9

Your organization uses Microsoft Sentinel. You receive an alert for a suspicious sign-in from an unusual location. You want to automatically create an incident and assign it to the security team for investigation. What should you configure?

Accepted Answer

Configure an automation rule that runs when the alert is generated, creates an incident, and sets the owner to the security team.. Option B is correct because automation rules in Microsoft Sentinel can automatically create incidents from alerts and assign them to analysts. Option A is wrong because playbooks are for automated responses, not incident creation. Option C is wrong because analytics rules create alerts, not incidents directly. Option D is wrong because watchlists are for enrichment, not incident creation.

Answer

Add the user to a watchlist and configure a fusion rule.

Answer

Create a playbook that triggers on the alert and creates an incident manually.

Answer

Modify the analytics rule to set the incident creation setting to 'Create incident from alert'.

Question 10

Your organization uses Microsoft Defender for Cloud Apps. You detect a suspicious app that has high data access and unusual API calls. You want to automatically block the app and notify the user. What should you implement?

Accepted Answer

Create an app governance policy that automatically blocks the app and sends a notification to the user.. Option C is correct because app governance policies in Defender for Cloud Apps allow automated actions like blocking apps and sending notifications. Option A is wrong because access policies are for user or device access, not app blocking. Option B is wrong because session policies control real-time sessions, not app blocking. Option D is wrong because DLP policies are for data loss prevention, not app control.

Answer

Create an access policy that blocks the app based on the risk level.

Answer

Create a session policy to monitor the app's API calls.

Answer

Create a DLP policy to prevent data exfiltration from the app.

Question 11

Your organization has a hybrid identity environment with Microsoft Entra ID and on-premises Active Directory. You suspect a compromised on-premises admin account that has been used to modify security groups. You want to quickly contain the threat. What should you do first?

Accepted Answer

Revoke the user's sessions in Microsoft Entra ID and reset the password in both on-premises AD and Entra ID.. Option D is correct because revoking the user's session tokens and resetting the password in both on-premises AD and Entra ID immediately stops further activity. Option A is wrong because disabling the user in Entra ID alone does not block on-premises access. Option B is wrong because resetting password in on-premises AD does not revoke current tokens. Option C is wrong because moving the user to a blocked OU may not take effect immediately.

Answer

Move the user account to an Organizational Unit (OU) with blocked logon hours.

Answer

Reset the user's password in on-premises Active Directory.

Answer

Disable the user account in Microsoft Entra ID.

Question 12

Which TWO are valid incident response actions in Microsoft Sentinel?

Accepted Answer

Change the incident status to Active.. Options A and C are correct. Changing incident status and assigning owner are standard actions. Options B, D, and E are not valid: adding comments is a separate action, running a query is not an incident action, and merging incidents is already done via automation.

Answer

Run a KQL query from the incident.

Answer

Merge the incident with another incident.

Answer

Add a comment to the incident.

Question 13

Which THREE are valid ways to automatically respond to a security incident in Microsoft Defender XDR?

Accepted Answer

Configure an automated investigation and response (AIR) playbook.. Options A, B, and D are correct. Automated investigation and response (AIR) is a core feature, custom detection rules can trigger actions, and attack simulation training can be automated. Option C is wrong because manual playbooks are not automatic. Option E is wrong because threat intelligence integration does not automatically respond.

Answer

Integrate threat intelligence to automatically block indicators.

Answer

Manually run a playbook from the incident.

Question 14

Which TWO actions should you take when responding to a confirmed ransomware incident in Microsoft Defender for Endpoint?

Accepted Answer

Run a full antivirus scan on the affected devices.. Options B and D are correct. Isolating affected devices prevents spread, and running antivirus scans cleans the device. Option A is wrong because allowing malicious files is dangerous. Option C is wrong because collecting investigation package is for analysis, not immediate response. Option E is wrong because initiating live response might be needed but is not a standard first action.

Answer

Allow the ransomware executable in the firewall.

Answer

Collect an investigation package from the affected devices.

Answer

Initiate a live response session to delete files.

Question 15

You are reviewing an alert rule in Microsoft Sentinel created via ARM template. What is the primary purpose of this rule?

Accepted Answer

To send an alert when a sign-in with high risk level is detected.. Option B is correct because the rule triggers when a sign-in risk level is high, sending an alert to an action group. Option A is wrong because it does not block the user. Option C is wrong because it creates an alert, not an incident directly. Option D is wrong because it does not isolate devices.

Answer

To isolate the user's device from the network.

Answer

To automatically block the user from signing in.

Answer

To create an incident in Microsoft Sentinel.