SC-200 Respond to security incidents Practice Test 6 — 15 Questions

Question 1

Your organization is using Microsoft Defender XDR. During an incident, you need to create a custom detection rule that triggers when a specific file hash is executed on any device. Which component should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Custom detection rules. Custom detection rules in Defender XDR allow you to create detection logic based on advanced hunting queries. Option A is wrong because Attack Surface Reduction (ASR) rules are built-in and cannot be customized for specific file hashes. Option C is wrong because automation rules in Sentinel are for incident response, not detection. Option D is wrong because indicators of compromise (IoC) block or alert but are not detection rules.

Answer

Attack Surface Reduction (ASR) rules

Answer

Automation rules in Microsoft Sentinel

Answer

Indicators of compromise (IoC)

Question 2

Your incident response team has identified a phishing campaign targeting your organization. The emails contain a link to a malicious site. Which Microsoft Defender for Office 365 feature should you use to block the URL across all users?

Accepted Answer

Tenant Allow/Block List. The Tenant Allow/Block List in Microsoft Defender for Office 365 allows you to block URLs and senders across all users in the tenant. It is the centralized list for blocking known malicious URLs, overriding other policies. This ensures immediate blocking of the phishing URL for all users.

Answer

Safe Links policy

Answer

Anti-Phish policy

Answer

Safe Attachments policy

Question 3

Your organization is using Microsoft Sentinel as a SIEM. You need to forward logs from a legacy firewall that does not support common event format (CEF) or Syslog. Which solution should you use?

Accepted Answer

Deploy a Logstash forwarder with the Sentinel output plugin. The legacy firewall does not support CEF or Syslog, so you need a custom log ingestion method. Logstash, with the Microsoft Sentinel output plugin, can receive data from the firewall via a custom method (e.g., file, API, or other input plugins) and forward it to Microsoft Sentinel using the Log Analytics Data Collector API. This is the recommended approach for sources that cannot use standard formats or agents. Azure Policy, Azure Monitor Agent, and Logic Apps are not designed for direct log forwarding from such devices.

Answer

Use Azure Policy to export logs from the firewall

Answer

Install Azure Monitor Agent on the firewall

Answer

Create a Logic App with an HTTP trigger

Question 4

Which TWO of the following are valid response actions when a malware outbreak is detected on multiple endpoints? (Select TWO.)

Accepted Answer

Isolate the affected devices from the network. Option B is correct because isolating the affected devices from the network (e.g., via EDR network containment or disabling the NIC/switch port) stops lateral movement and command-and-control communication during a malware outbreak. Option C is correct because running a full antivirus scan on the affected endpoints detects and remediates additional malicious files, persistence mechanisms, and secondary payloads beyond the initially identified malware. Option A is not a standard malware response action since password resets are used for credential compromise, not malware containment, and would disrupt users without addressing the infection. Option D is wrong because deleting user accounts is a destructive identity action unrelated to malware eradication and could destroy forensic evidence. Option E is not appropriate as an immediate step because reimaging should occur only after containment, evidence collection, and scoping, and doing it immediately can destroy forensic artifacts needed to understand the outbreak.

Answer

Reset passwords for all users on affected devices

Answer

Delete the affected user accounts

Answer

Reimage the affected devices immediately

Question 5

Based on the KQL query shown, what is the purpose of the case() function?

Accepted Answer

To reclassify High severity alerts as Critical. The case() function in KQL is used to evaluate a series of conditions and return the first matching result, effectively reclassifying or transforming values. In the context of the query, it takes High severity alerts and returns 'Critical', thereby reclassifying them. This is a common pattern for normalizing or escalating severity levels in security analytics.

Answer

To aggregate counts by severity

Answer

To include alerts with name containing Malware or Ransomware

Answer

To filter alerts with severity High or Critical

Question 6

An organization uses Microsoft Sentinel. A security engineer needs to set up automatic response actions when a high-severity incident is created. The engineer wants to trigger a playbook that sends a notification to a Microsoft Teams channel and creates a ticket in ServiceNow. What should the engineer use?

Accepted Answer

An automation rule that triggers a playbook. Automation rules in Microsoft Sentinel can trigger playbooks (Azure Logic Apps) when incidents are created or updated, enabling automated response actions like sending Teams notifications and creating ServiceNow tickets. Option B is incorrect because analytics rules generate alerts, which can then create incidents if configured, but they do not directly trigger playbooks for automated response. Option C is incorrect because workbooks are for visualization and analysis, not automation. Option D is incorrect because watchlists are used for correlation and enrichment, not for triggering automated responses.

Answer

An analytics rule with incident creation enabled

Answer

A watchlist to detect the incident

Answer

A workbook with a custom alert

Question 7

Your organization uses Microsoft Defender for Cloud Apps. A security analyst discovers that a user's account has been compromised and is exfiltrating sensitive data from SharePoint Online. The analyst needs to immediately block the suspicious activities while allowing legitimate user activities to continue. What should the analyst do?

Accepted Answer

Suspend the user from Defender for Cloud Apps. Suspending the user in Defender for Cloud Apps immediately blocks the compromised account's activities (including data exfiltration) while preserving the account's data and configuration for investigation. This action is reversible and allows the analyst to contain the incident without disrupting other users. It is the fastest way to stop active exfiltration from SharePoint Online while maintaining the ability to restore access after remediation.

Answer

Reset the user's password and require MFA

Answer

Revoke all OAuth tokens for the user

Answer

Block the user's IP address in the firewall

Question 8

An organization uses Microsoft Defender for Endpoint. A user reports that their device is running slowly and they see unexpected pop-ups. The security team suspects malware. What should the team do first to investigate?

Accepted Answer

Run a quick scan on the device from Microsoft Defender for Endpoint. Running a quick scan in Microsoft Defender for Endpoint will detect common malware quickly. Option B is wrong because checking the device inventory for recent software installations is not the first step in an active suspected infection. Option C is wrong because initiating a live response session is more invasive and should be used after initial detection. Option D is wrong because submitting a suspicious file to Microsoft for analysis is not the first step and typically occurs after a sample is collected.

Answer

Check the device inventory for recent software installations

Answer

Initiate a live response session on the device

Answer

Submit a suspicious file to Microsoft for analysis

Question 9

Which TWO actions should a security analyst take when responding to a confirmed malware outbreak in Microsoft Defender for Endpoint?

Accepted Answer

Isolate the affected device. Options A and B are correct. Option A: Isolating the affected device immediately contains the outbreak and prevents lateral movement to other endpoints. Option B: Running a full scan ensures all malware components and artifacts are identified and removed. Option C is wrong because creating a custom detection rule is a proactive measure for future detections, not an immediate response to a confirmed outbreak. Option D is wrong because deleting the user account is extreme and does not address the malware on the device. Option E is wrong because resetting the user's password helps with credential compromise but does not stop active malware.

Answer

Create a custom detection rule for the malware

Answer

Delete the user account

Answer

Reset the user's password

Question 10

Which TWO sources of evidence should a security analyst examine first when investigating a user-reported phishing email in Microsoft Defender XDR?

Accepted Answer

The email entity page. The email entity page (A) is correct because in Microsoft Defender XDR it consolidates the message's metadata, headers, authentication results (SPF/DKIM/DMARC), URLs, attachments, and detections, giving the analyst the fastest triage view of the reported phishing email. The user's mailbox audit log (C) is correct because it reveals whether the message was delivered, read, moved, deleted, or if the user clicked links or opened attachments, and whether any inbox rules were created — critical for assessing impact and scope. The action center (B) is not a first-look evidence source; it tracks remediation actions already taken (e.g., soft/hard delete, block sender), not the initial investigative artifacts. The user's device timeline (D) focuses on endpoint process/file/network activity and is only relevant if the user interacted with the payload, so it is not a primary email-triage source. Advanced hunting for email events (E) is a powerful query tool but is used to broaden or pivot the investigation after the initial entity and audit evidence is reviewed, not as the first source.

Answer

The action center

Answer

The user's device timeline

Answer

Advanced hunting for email events

Question 11

Refer to the exhibit. A security analyst runs this KQL query in Microsoft Defender XDR advanced hunting. What is the most likely purpose of this query?

Accepted Answer

To identify accounts or devices with high volumes of suspicious PowerShell activity. The query is designed to surface accounts or devices with high volumes of suspicious PowerShell activity — this is a classic Defender XDR advanced hunting pattern that aggregates PowerShell-related events (e.g., DeviceProcessEvents where ProcessCommandLine contains 'powershell' or ScriptBlockLogging events) and ranks by count. High-volume or anomalous PowerShell execution is a strong indicator of malicious scripting, fileless attacks, or lateral movement. The other options describe different hunting patterns (failed logons, outbound C2 connections, scheduled-task persistence) that would use different tables and filters.

Answer

To find accounts with failed logon attempts indicating brute force

Answer

To find devices that made outbound network connections to known malicious IPs

Answer

To detect persistence mechanisms like scheduled tasks

Question 12

Refer to the exhibit. An incident in Microsoft Sentinel contains the entities shown. Which additional data source would be most useful to investigate this incident?

Accepted Answer

Microsoft Entra ID sign-in logs. The incident entities shown in the exhibit typically include user accounts and IP addresses, which are core to identity-based attacks. Microsoft Entra ID sign-in logs provide detailed authentication events, including successful and failed sign-ins, conditional access evaluations, and risk detections. These logs are essential to determine if the user account was compromised and to trace the source of the suspicious activity. Therefore, they are the most useful additional data source for investigating this incident.

Answer

Microsoft Defender for Endpoint device timeline

Answer

Microsoft Purview audit logs

Answer

Microsoft Intune device compliance logs

Question 13

A security analyst detects a suspicious sign-in from an unusual location using Microsoft Entra ID. The user has not enabled MFA. Which action should the analyst take first to investigate and potentially contain the incident?

Accepted Answer

Disable the user account.. When a suspicious sign-in is detected and the user has not enabled MFA, the first containment action should be to disable the user account to prevent further unauthorized access. This immediately blocks the attacker while allowing investigation to continue. Other actions like password reset or Conditional Access may be part of remediation but are not the first step.

Answer

Reset the user's password immediately.

Answer

Enable Conditional Access to block all sign-ins from that location.

Answer

Block legacy authentication for the entire tenant.

Question 14

During a ransomware investigation, a security analyst finds that multiple files on a file server have been encrypted. The server runs Microsoft Defender for Cloud and has been onboarded to Microsoft Sentinel. Which data source in Sentinel would provide the most granular information about the file encryption events?

Accepted Answer

Microsoft Defender for Cloud (Azure Defender) alerts. Microsoft Defender for Cloud (Azure Defender) alerts are the most granular data source for file encryption events because Defender for Cloud includes advanced threat protection for file servers, which monitors file system activity and generates high-fidelity alerts specifically for ransomware behavior, such as mass file encryption. These alerts include detailed information like the process responsible, file paths, and encryption patterns, directly addressing the investigation's need. Other data sources lack this specialized detection and granularity for encryption events.

Answer

Azure Activity Log

Answer

Windows Security Events via MMA

Answer

Sysmon events via Azure Monitor Agent

Question 15

During an incident response, an analyst runs a live response command on a Windows device using Microsoft Defender for Endpoint. The command 'Get-Service -Name BITS' returns no output. What is the most likely cause?

Accepted Answer

The command is blocked due to PowerShell ConstrainedLanguage mode.. Live response uses a restricted PowerShell language mode (ConstrainedLanguage) which blocks many commands. Get-Service may not be available. The service might be stopped but still exist; permissions are usually fine.

Answer

The live response session has insufficient privileges.

Answer

The BITS service is disabled and hidden.

Answer

The BITS service is not installed on the device.