SC-200 Respond to security incidents Practice Test 5 — 15 Questions

Question 1

Which TWO actions should you perform to contain a ransomware incident in Microsoft Defender for Endpoint?

Accepted Answer

Isolate the device from the network.. Isolating the device from the network (Option B) is a critical containment step in a ransomware incident because it immediately stops the ransomware from communicating with its command-and-control (C2) server and prevents lateral movement to other devices. In Microsoft Defender for Endpoint, device isolation can be initiated from the Security Center, which applies a network-level block that only allows communication with the Defender for Endpoint service, effectively quarantining the device while preserving forensic data.

Answer

Reset the local administrator password.

Answer

Run a full antivirus scan.

Answer

Collect the ransomware sample for analysis.

Question 2

Which THREE actions are part of the containment phase in the Microsoft Incident Response process?

Accepted Answer

Block known malicious IP addresses at the firewall.. Blocking known malicious IP addresses at the firewall is a containment action because it immediately stops inbound or outbound communication with threat actors, preventing further data exfiltration or command-and-control traffic. In the Microsoft Incident Response (IR) process, containment focuses on limiting the blast radius and stopping the spread of an attack, and firewall rules are a primary technical control for achieving this at the network perimeter.

Answer

Notify senior management of the incident.

Answer

Collect forensic data from affected systems.

Question 3

Which TWO Microsoft Defender XDR entities can be managed during incident response?

Accepted Answer

Devices. During incident response in Microsoft Defender XDR, you can manage devices (endpoints) and user accounts directly from the incident page. Devices can be isolated, have antivirus scans run, or be added to a blocklist, while user accounts can be disabled, forced to sign out, or have their password reset. These actions are executed via Microsoft Defender for Endpoint and Microsoft Defender for Identity integrations within the unified incident response workflow.

Answer

Network interfaces

Answer

Azure subscriptions

Answer

Microsoft 365 tenants

Question 4

You are reviewing an automation rule in Microsoft Sentinel. The rule triggers on incident creation with severity High. However, during a recent High severity incident, the playbook did not run. What is the most likely cause?

Accepted Answer

The automation rule does not have an owner assigned.. Automation rules in Microsoft Sentinel require an owner to be assigned for the rule to be active and execute playbooks. Without an owner, the rule is considered improperly configured and will not trigger, even if all other conditions (such as incident severity) are met. This is a common oversight that prevents playbook execution.

Answer

The action order is set to 1, but another action has a higher priority.

Answer

The condition requires IncidentSeverity equals High, but the incident was classified as Medium.

Answer

The rule triggers on incident creation, but the incident was first closed and then reopened.

Question 5

You are investigating repeated SQL injection alerts. The KQL query returns IP addresses with more than 5 alerts in the last 7 days. What is the purpose of the `summarize` and `where AlertCount > 5` lines?

Accepted Answer

To identify IPs with a high number of alerts, indicating a possible attack.. The `summarize` operator in KQL aggregates data by grouping on the IP address field and counting the number of alerts per IP. The `where AlertCount > 5` filter then retains only those IP addresses whose aggregated count exceeds 5. This combination directly serves to identify IPs that have triggered a high volume of SQL injection alerts within the 7-day window, which is a strong indicator of a sustained or automated attack attempt.

Answer

To correlate alerts with other data sources.

Answer

To remove duplicate alerts from the same IP.

Answer

To count the number of distinct IP addresses.

Question 6

You are reviewing an incident in Microsoft Sentinel. The incident is assigned to a user. What does the 'assignedTo' field indicate?

Accepted Answer

The incident is assigned to that user for investigation.. In Microsoft Sentinel, the 'assignedTo' field is used to track ownership of an incident during its lifecycle. When an incident is assigned to a user, it indicates that user is responsible for investigating and resolving the incident, not that they created or closed it. This field is set manually or via automation rules to ensure clear accountability for incident response.

Answer

The incident was created by that user.

Answer

The incident was closed by that user.

Answer

The incident is assigned to a Microsoft Entra group.

Question 7

Your organization uses Microsoft Sentinel. You receive an alert for a suspicious sign-in from an unusual location. You want to automatically create an incident and assign it to the security team for investigation. What should you configure?

Accepted Answer

Configure an automation rule that runs when the alert is generated, creates an incident, and sets the owner to the security team.. Automation rules in Microsoft Sentinel allow you to automatically create incidents from alerts and assign them to specific teams or owners. This is the native, efficient method to handle the scenario without manual intervention or custom playbooks.

Answer

Add the user to a watchlist and configure a fusion rule.

Answer

Create a playbook that triggers on the alert and creates an incident manually.

Answer

Modify the analytics rule to set the incident creation setting to 'Create incident from alert'.

Question 8

Your organization uses Microsoft Defender for Cloud Apps. You detect a suspicious app that has high data access and unusual API calls. You want to automatically block the app and notify the user. What should you implement?

Accepted Answer

Create an app governance policy that automatically blocks the app and sends a notification to the user.. App governance policies in Microsoft Defender for Cloud Apps are specifically designed to govern OAuth-enabled apps that have been granted permissions to access organizational data. When an app exhibits suspicious behavior like high data access and unusual API calls, an app governance policy can automatically block the app and send a notification to the user, directly addressing the requirement to both block and notify.

Answer

Create an access policy that blocks the app based on the risk level.

Answer

Create a session policy to monitor the app's API calls.

Answer

Create a DLP policy to prevent data exfiltration from the app.

Question 9

Your organization has a hybrid identity environment with Microsoft Entra ID and on-premises Active Directory. You suspect a compromised on-premises admin account that has been used to modify security groups. You want to quickly contain the threat. What should you do first?

Accepted Answer

Revoke the user's sessions in Microsoft Entra ID and reset the password in both on-premises AD and Entra ID.. Revoke the user's sessions in Microsoft Entra ID and reset the password in both on-premises AD and Entra ID. This immediately terminates active sessions and prevents further use of the compromised account. Option A is incorrect because moving the user to an OU with blocked logon hours does not revoke current sessions and may not take effect immediately. Option B is incorrect because resetting the password only in on-premises AD does not revoke existing tokens or sessions in the cloud. Option D is incorrect because disabling the account only in Entra ID does not block on-premises access, and the user might still have active sessions.

Answer

Move the user account to an Organizational Unit (OU) with blocked logon hours.

Answer

Reset the user's password in on-premises Active Directory.

Answer

Disable the user account in Microsoft Entra ID.

Question 10

Which TWO are valid incident response actions in Microsoft Sentinel?

Accepted Answer

Change the incident status to Active.. Changing the incident status to 'Active' is a valid incident response action in Microsoft Sentinel because it formally acknowledges the incident as under investigation. This status update is part of the incident lifecycle management, allowing analysts to track progress from New to Active to Closed.

Answer

Run a KQL query from the incident.

Answer

Merge the incident with another incident.

Answer

Add a comment to the incident.

Question 11

Which THREE are valid ways to automatically respond to a security incident in Microsoft Defender XDR?

Accepted Answer

Configure an automated investigation and response (AIR) playbook.. Options A and B are correct: Microsoft Defender XDR includes automated investigation and response (AIR) playbooks that trigger actions based on incident criteria, and custom detection rules can automatically run remediation actions. Option C is also correct because integrating threat intelligence allows you to automatically block indicators like IPs or domains, acting as an automated response. Option D is manual, not automatic. Option E is incorrect because attack simulation training is for simulation and training, not for automated incident response.

Answer

Manually run a playbook from the incident.

Answer

Use attack simulation training to automatically isolate devices.

Question 12

Which TWO actions should you take when responding to a confirmed ransomware incident in Microsoft Defender for Endpoint?

Accepted Answer

Run a full antivirus scan on the affected devices.. Running a full antivirus scan on affected devices helps identify and remove any remaining ransomware artifacts or secondary payloads that may not have been detected during the initial response. In Microsoft Defender for Endpoint, a full scan leverages the cloud-delivered protection and behavior monitoring to thoroughly examine all files and processes, reducing the risk of reinfection.

Answer

Allow the ransomware executable in the firewall.

Answer

Collect an investigation package from the affected devices.

Answer

Initiate a live response session to delete files.

Question 13

You are reviewing an alert rule in Microsoft Sentinel created via ARM template. What is the primary purpose of this rule?

Accepted Answer

To send an alert when a sign-in with high risk level is detected.. The primary purpose of an alert rule in Microsoft Sentinel created via ARM template is to generate an alert when a specific condition is met, such as a sign-in with a high risk level detected by Azure AD Identity Protection. This alert can then be used to trigger automated responses or create incidents, but the rule itself is designed to detect and alert on the defined condition, not to perform remediation actions like isolation or blocking.

Answer

To isolate the user's device from the network.

Answer

To automatically block the user from signing in.

Answer

To create an incident in Microsoft Sentinel.

Question 14

You are analyzing a firewall policy in Azure Firewall deployed via Azure Policy. What is the effect of this rule?

Accepted Answer

Denies inbound traffic from IP 10.0.0.5 to any destination.. The rule in Azure Firewall deployed via Azure Policy uses a default deny approach for inbound traffic. Since the rule explicitly denies inbound traffic from IP 10.0.0.5 to any destination, option C is correct. Azure Firewall processes rules in a priority order, and a deny rule for inbound traffic from a specific source IP overrides any allow rules that might match the same traffic.

Answer

Allows outbound traffic from any source to IP 10.0.0.5.

Answer

Allows inbound traffic from IP 10.0.0.5 to any destination.

Answer

Denies outbound traffic from any source to IP 10.0.0.5.

Question 15

You are reviewing a scheduled analytics rule in Microsoft Sentinel. What does the suppressionDuration setting affect?

Accepted Answer

It stops the rule from creating new alerts for that duration after an alert is generated.. The suppressionDuration setting in a Microsoft Sentinel scheduled analytics rule stops the rule from creating new alerts for a specified period after an alert is generated. This prevents alert fatigue by suppressing duplicate alerts from the same rule when the same conditions persist, allowing analysts to focus on unique incidents.

Answer

It groups alerts into a single incident within that time window.

Answer

It delays the execution of the query by that amount of time.

Answer

It determines how often the query runs.