SC-200 Respond to security incidents Practice Test 5 — 15 Questions

Question 1

Your Microsoft Defender XDR environment generates an incident indicating that a user's account was used to sign in from an anonymous IP address and then accessed sensitive data in SharePoint Online. After confirming the account is compromised, what should be your first containment step?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Revoke the user's session and require reauthentication using Microsoft Entra ID Protection. The correct first containment step is to revoke the user's session and require reauthentication using Microsoft Entra ID Protection. This immediately invalidates all active refresh tokens and access tokens, forcing the attacker out of any ongoing sessions across Microsoft 365 services like SharePoint Online. Disabling the account is a valid containment action, but it does not instantly terminate existing authenticated sessions, leaving a window for the attacker to continue accessing data. Revoking sessions is the fastest way to cut off active access while preserving the account for investigation and remediation.

Answer

Disable the user account in Microsoft Entra ID

Answer

Block the anonymous IP address in the firewall

Answer

Review audit logs to determine the extent of data access

Question 2

During a security incident, you need to collect forensic evidence from a compromised Linux server running in Azure. The server is not domain-joined and has the Azure Monitor Agent installed. You need to capture volatile data such as running processes and network connections. What is the most efficient method?

Accepted Answer

Use a custom script via Azure Custom Script Extension to collect data and send to Log Analytics. Using a custom script via Azure Custom Script Extension to collect volatile data and send it to Log Analytics is the most efficient method. This approach allows you to run commands on the Linux server to capture running processes, network connections, and other volatile data, and then send the output to a central location for analysis. It leverages the existing Azure Monitor Agent and Log Analytics workspace, providing a scalable and automated way to collect forensic evidence.

Answer

Use Event Viewer to export logs

Answer

Use Microsoft Defender for Endpoint live response to run commands

Answer

Take a snapshot of the OS disk for later analysis

Question 3

Your security team detects a potential data exfiltration incident where an employee emailed sensitive customer data to a personal email address. The email was sent via Exchange Online. What is the immediate action to prevent further data loss?

Accepted Answer

Disable the user's account in Microsoft Entra ID. Disabling the user's account in Microsoft Entra ID immediately prevents the user from sending further emails or accessing any Microsoft 365 services, thereby stopping any ongoing data loss. This is the most direct and immediate action to contain the incident.

Answer

Create a data loss prevention rule to block future emails to that domain

Answer

Review the user's email archive for other suspicious emails

Answer

Use Microsoft Purview to perform a content search and purge the email from the recipient's mailbox

Question 4

Refer to the exhibit. You run this KQL query in Microsoft Defender for Endpoint advanced hunting as part of an incident investigation. The query returns zero results, but you suspect PowerShell execution with encoded commands occurred. What is the most likely reason for no results?

Accepted Answer

The query only looks at the last hour; the event may have occurred earlier. The query uses a time filter of `ago(1h)`, which means it only looks at events from the last hour. If the PowerShell execution occurred earlier, it would not appear in the results. The query syntax and table/column names are valid for Microsoft Defender for Endpoint advanced hunting. Option A is incorrect because the `contains` operator is case-insensitive in KQL, so case sensitivity is not an issue. Option B is incorrect because `DeviceProcessEvents` is the correct table name for process events. Option C is incorrect because `ProcessCommandLine` is a valid column in that table; the column name does not need to be changed to `CommandLine`.

Answer

The query uses 'contains' which is case-sensitive

Answer

The table name is incorrect; it should be 'ProcessEvents'

Answer

The column 'ProcessCommandLine' should be 'CommandLine'

Question 5

Which THREE are valid response actions when using Microsoft Sentinel automation rules?

Accepted Answer

Assign the incident to a specific analyst. Automation rules in Microsoft Sentinel can assign incidents to analysts (A), tag incidents with custom labels (B), and run playbooks (C). Changing the incident status (D) is also a valid action, but the question asks for three specific actions; the correct set is A, B, and C.

Answer

Change the incident status to 'Active' or 'Closed'

Answer

Disable a compromised user account

Question 6

Which THREE are valid incident severity levels in Microsoft Sentinel?

Accepted Answer

Low. Informational is a valid Microsoft Sentinel incident severity level, but since this question asks for exactly THREE, Low, Medium, and High are the three severities selected here; Informational and Critical are excluded (Critical is not a real Sentinel severity).

Answer

Critical

Answer

Informational

Question 7

A security analyst receives an alert from Microsoft Defender for Cloud Apps indicating that a user from the finance department downloaded 500 files from SharePoint Online in 10 minutes. The analyst needs to determine if this is a true positive and, if so, contain the incident. Which action should the analyst take first?

Accepted Answer

Suspend the user's account in Microsoft Entra ID.. When a user downloads a large number of files in a short period from SharePoint Online, it may indicate a data exfiltration attempt. The first action should be to contain the incident by suspending the user's account in Microsoft Entra ID to prevent further access. This is an immediate containment step before investigating further. Checking the user's risk score (D) or creating alerts (C) are secondary steps. Correlating with other alerts (A) can be done but containment takes priority.

Answer

Run a KQL query in Microsoft Sentinel to correlate with other alerts.

Answer

Create an alert in Microsoft Sentinel for similar behavior.

Answer

Check the user's risk score in Microsoft Entra ID Identity Protection.

Question 8

During a security incident, a SOC analyst uses Microsoft Defender XDR to investigate a compromised device. The analyst needs to collect a memory dump for forensic analysis. Which action should the analyst take from the Microsoft Defender XDR portal?

Accepted Answer

Use the 'Collect investigation package' action.. 'Collect investigation package' is the action available in Microsoft Defender XDR that collects a memory dump along with other forensic data such as registry hives and event logs. This is specifically designed for in-depth forensic analysis of a compromised device. Option B, 'Initiate a live response session,' allows remote command execution but does not directly collect a memory dump as a single action. Option C, 'Run a custom detection rule,' is for creating detection logic, not collection. Option D, 'Submit the file to Microsoft Defender for Cloud Apps,' is for file analysis in cloud apps, not memory collection.

Answer

Initiate a live response session.

Answer

Run a custom detection rule.

Answer

Submit the file to Microsoft Defender for Cloud Apps.

Question 9

Refer to the exhibit. You have an automation rule in Microsoft Sentinel that triggers a playbook to isolate a device when a High severity incident is created. However, you notice that the playbook is not triggered for incidents that are created from analytics rules that use entity mapping. What is the most likely cause?

Accepted Answer

The analytics rule sets the severity after incident creation, so the condition does not match at creation time.. Automation rules in Microsoft Sentinel trigger when an incident is created, and the condition checks the severity at that moment. If an analytics rule uses entity mapping, it may set the severity after the incident is created (e.g., during enrichment or correlation), so at creation time the severity might not match the condition (High severity). This means the automation rule won't trigger for those incidents. Options A, B, and C are possible but less likely to be the cause in this specific scenario.

Answer

The playbook requires a managed identity, which is missing.

Answer

The playbook is not authorized to run for automation rules.

Answer

The automation rule is disabled.

Question 10

During a security incident, a SOC analyst needs to collect evidence from multiple Microsoft 365 workloads including Exchange Online, SharePoint Online, and Teams. Which Microsoft Purview solution should the analyst use to perform a unified investigation?

Accepted Answer

Microsoft Purview eDiscovery. After containment, the next step in the incident response lifecycle is eradication. Eradication involves removing the root cause of the incident, such as deleting malware or closing vulnerabilities, to prevent recurrence. Post-incident review (option D) occurs after recovery and closure, not immediately after containment. Detection (A) is the initial phase, and analysis (B) is ongoing throughout but does not represent the distinct next step.

Answer

Microsoft Purview Data Lifecycle Management

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Audit

Question 11

Refer to the exhibit. A SOC analyst runs this KQL query in Microsoft Sentinel to investigate devices in the finance subnet. Which result would indicate that a device might be compromised?

Accepted Answer

A device with multiple connected networks, including an external IP.. In Microsoft Sentinel, a device with multiple connected networks, including an external IP, is suspicious because it may indicate the device is communicating with external command-and-control servers or exfiltrating data. The query likely examines network connections; an external IP in addition to internal networks suggests potential compromise. The other options describe normal or benign scenarios: a single network connection, no recent connections, or a private IP address are not inherently indicative of compromise.

Answer

A device named 'finance-server-01' with a single network connection.

Answer

A device with no network connections in the last 7 days.

Answer

A device with a LocalIPAddress starting with 10.0.0.

Question 12

Which THREE components can be used in Microsoft Sentinel to automate incident response?

Accepted Answer

Automation rules. Correct answers are A, B, and C. Automation rules are built-in automation that can automatically perform actions based on triggers when incidents are created or updated. Triggers are the conditions that initiate automation rules, such as 'When incident created' or 'When incident updated.' Playbooks are workflows that can be run automatically from automation rules to perform complex response actions. Analytics rules (E) generate alerts and incidents, but do not automate response; they are detection rules. Watchlists (D) are used for enrichment and correlation, not automation.

Answer

Watchlists

Answer

Analytics rules

Question 13

Which TWO indicators of compromise (IOCs) are most likely to be included in a Microsoft Sentinel threat intelligence feed to detect a known malware campaign?

Accepted Answer

File hash (SHA-256). Correct answers are B and E. File hashes (SHA-256) are commonly used as IOCs to uniquely identify malware samples, and IP addresses are frequently used to identify command-and-control servers or distribution points. Domain names and email addresses are less common for malware detection, and registry keys are not typical IOCs in threat intelligence feeds.

Answer

Domain name

Answer

Email address

Answer

Registry key

Question 14

Your incident response team receives an alert from Microsoft Sentinel for a user account that has been compromised. The alert indicates that the user's credentials were used from an unfamiliar location. What is the first action you should take?

Accepted Answer

Disable the user account in Microsoft Entra ID. The first action in a compromised account incident should be to contain the threat by disabling the account in Microsoft Entra ID (formerly Azure AD). This immediately prevents further unauthorized access and potential damage. While reviewing sign-in logs, resetting passwords, or notifying the user are important, they are secondary to containment. Disabling the account stops the attacker from continuing to use the compromised credentials.

Answer

Review the sign-in logs to confirm the alert

Answer

Reset the user's password

Answer

Notify the user and ask them to change their password

Question 15

During a security incident, you need to collect forensic evidence from a compromised Windows device. Which Microsoft Defender for Endpoint action should you use to collect a memory dump?

Accepted Answer

Initiate Live Response. Live Response lets an analyst connect to the device and run a memory-acquisition tool/script to capture a memory dump. The 'Collect investigation package' action gathers artifacts such as autoruns, processes, network connections, and prefetch files, but it does not include a full memory dump.

Answer

Isolate device

Answer

Collect investigation package

Answer

Run antivirus scan