SC-200 Respond to security incidents Practice Test 6 — 15 Questions

Question 1

Your organization uses Microsoft Defender for Cloud. You receive a security alert about a suspicious process on a virtual machine. You want to investigate the process further. What should you do?

Accepted Answer

Initiate a live response session on the VM from Microsoft Defender for Cloud.. Microsoft Defender for Cloud's live response capability allows you to remotely connect to a VM and perform real-time forensic actions, such as running commands, examining running processes, and collecting artifacts. This is the most direct way to investigate a suspicious process on a specific VM, as it provides interactive access without needing to install additional agents or reboot the machine.

Answer

Create a custom detection rule to alert on similar processes.

Answer

Run a vulnerability assessment scan on the VM.

Answer

Initiate an automated investigation on the VM.

Question 2

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You want to automatically isolate a device when a high-severity incident is created. What is the most efficient way to achieve this?

Accepted Answer

Create an automation rule in Microsoft Sentinel that triggers a playbook, which uses the Microsoft Defender for Endpoint connector to isolate the device.. It leverages Microsoft Sentinel's automation rules to trigger a playbook that uses the Microsoft Defender for Endpoint connector, enabling automated device isolation in response to a high-severity incident. This approach is the most efficient as it combines Sentinel's incident-driven automation with Defender for Endpoint's native isolation action, eliminating manual intervention and ensuring rapid response.

Answer

Manually isolate the device from the Microsoft Defender for Endpoint console after the incident is created.

Answer

Create an automation rule in Microsoft Sentinel that runs a PowerShell script to isolate the device.

Answer

Create a custom detection rule in Microsoft Defender XDR that triggers device isolation.

Question 3

Your organization uses Microsoft Sentinel. You have a requirement to automatically add a tag to incidents that involve a specific user. The tag should be added when the incident is created. What should you configure?

Accepted Answer

Create an automation rule that triggers on incident creation and runs a playbook with the 'Add tag' action.. Automation rules in Microsoft Sentinel can be configured to trigger when an incident is created, and they can run a playbook that includes the 'Add tag' action. This allows you to automatically tag incidents involving a specific user by incorporating logic within the playbook to check for that user's presence in the incident entities.

Answer

Add the user to a watchlist and create a fusion rule.

Answer

Modify the analytics rule to include a tag in the incident configuration.

Answer

Enable entity behavior analytics to automatically tag incidents.

Question 4

Your organization uses Microsoft Defender for Office 365. You detect a phishing email that was delivered to a user's inbox. You want to remove the email from all recipients. What should you do?

Accepted Answer

Use Threat Explorer to find the email and take action to delete it.. Threat Explorer in Microsoft Defender for Office 365 allows security analysts to search for specific emails based on attributes like sender, subject, or recipient, and then take bulk remediation actions such as soft-delete (move to Deleted Items) or hard-delete (purge from mailbox). This is the correct tool to remove a phishing email that has already been delivered to users' inboxes, as it provides granular search and remediation capabilities for existing messages.

Answer

Submit the email to Microsoft for analysis.

Answer

Create a mail flow rule to delete similar emails in the future.

Answer

Block the sender using the Tenant Allow/Block List.

Question 5

Your organization uses Microsoft Defender for Identity. You receive an alert about a suspicious Kerberos authentication attempt. What is the best first step to contain the potential threat?

Accepted Answer

Disable the account that was used for the authentication.. Immediately disabling the suspicious account prevents further authentication attempts and contains the threat. Option A is incorrect because reviewing logs is an investigative step that does not directly contain the threat. Option C is incorrect because resetting the krbtgt account password twice is a recovery step typically performed after a compromise to mitigate Golden Ticket attacks, not the first action during an active alert. Option D is incorrect because investigating the source IP is also an investigative step and does not immediately stop the attack.

Answer

Review the Active Directory logs for related events.

Answer

Reset the krbtgt account password twice.

Answer

Investigate the source IP address of the authentication attempt.

Question 6

Your organization uses Microsoft Sentinel and has enabled UEBA (User and Entity Behavior Analytics). You notice a series of incidents involving anomalous logon times for a privileged user. You want to automate the response to disable the user's account in Microsoft Entra ID when such incidents are created. What should you configure?

Accepted Answer

Create an automation rule that runs a playbook when an incident from the UEBA analytics rule is created, and configure the playbook to disable the user in Microsoft Entra ID.. Microsoft Sentinel automation rules can trigger a playbook when an incident is created by a specific analytics rule (e.g., a UEBA-based rule). The playbook, built in Azure Logic Apps, can then use the Microsoft Graph API to disable the user's account in Microsoft Entra ID. This provides a fully automated, event-driven response to anomalous logon time incidents without manual intervention.

Answer

Create an analytics rule that triggers on UEBA anomalies and directly disables the user.

Answer

Add the user to a watchlist and create a playbook that runs on a schedule.

Answer

Configure UEBA to automatically disable the user when anomalous behavior is detected.

Question 7

Your organization uses Microsoft Sentinel. A security analyst receives an alert indicating that a user account was used to sign in from an unfamiliar location. You need to investigate the incident using Microsoft Defender XDR. Which action should you take first?

Accepted Answer

Review the alert in the Microsoft Defender XDR portal and classify it as a true or false positive.. The first step in incident response is to validate the alert by reviewing it in the Microsoft Defender XDR portal. This allows the analyst to assess the alert's context, such as sign-in logs, user risk, and related entities, before taking any corrective action. Classifying the alert as a true or false positive ensures that subsequent steps (like password reset or account disablement) are based on accurate threat assessment, preventing unnecessary disruption.

Answer

Create an automated playbook to reset the user's password.

Answer

Turn off the user account in Microsoft Entra ID.

Answer

Reset the user's password immediately to prevent further access.

Question 8

During a security incident, you need to isolate a compromised Windows device from the network while allowing communication with Microsoft Defender for Endpoint services. Which Microsoft Defender for Endpoint action should you use?

Accepted Answer

Isolate device. The correct action is 'Isolate device' because it disconnects the compromised Windows device from the network while maintaining a dedicated communication channel to Microsoft Defender for Endpoint (MDE) services. This ensures the device cannot be used to spread laterally or exfiltrate data, yet MDE can still receive telemetry and apply remediation commands. The isolation is enforced via a Windows Filtering Platform (WFP) firewall rule that blocks all inbound and outbound traffic except for MDE-related endpoints (e.g., *.events.data.microsoft.com).

Answer

Run antivirus scan

Answer

Collect investigation package

Answer

Restrict app execution

Question 9

You are investigating a phishing incident in Microsoft Defender XDR. The incident involves a user who clicked a malicious link in an email. Which data source would you use to trace the email's origin?

Accepted Answer

Microsoft Defender for Office 365. Microsoft Defender for Office 365 (MDO) is the correct data source because it provides email-specific telemetry, including SMTP headers, sender IP addresses, and authentication results (SPF, DKIM, DMARC). This data is essential for tracing the origin of a phishing email that a user clicked. MDO's Threat Explorer and Email Entity page allow you to reconstruct the email's path from the sending server to the recipient's inbox.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Identity

Question 10

During a ransomware incident, you need to prevent the encryption of files on a server running Windows Server 2022. You have Microsoft Defender for Endpoint Plan 2. Which attack surface reduction rule should you enable?

Accepted Answer

Use advanced protection against ransomware. The 'Use advanced protection against ransomware' attack surface reduction (ASR) rule specifically targets ransomware behavior by blocking untrusted processes from writing to protected folders, such as those defined in Controlled Folder Access (CFA). This rule is designed to prevent file encryption during a ransomware incident, aligning with the scenario's requirement to protect files on a Windows Server 2022 with Microsoft Defender for Endpoint Plan 2.

Answer

Block executable files from running unless they meet a prevalence, age, or trusted list criterion

Answer

Block credential stealing from the Windows local security authority subsystem

Answer

Block Adobe Reader from creating child processes

Question 11

You are responding to an incident where a user's device may be compromised. You need to collect forensic data from the device using Microsoft Defender for Endpoint. Which action should you take?

Accepted Answer

Collect investigation package. The 'Collect investigation package' action in Microsoft Defender for Endpoint is specifically designed to gather forensic data—such as registry hives, event logs, memory dumps, and disk images—from a device for offline analysis. This is the correct choice because the question explicitly asks to collect forensic data, and this action packages all relevant artifacts into a single .zip file for detailed examination.

Answer

Isolate device

Answer

Initiate Live Response

Answer

Run antivirus scan

Question 12

Your organization uses Microsoft Sentinel. A security incident is generated by a scheduled analytics rule. You need to automatically assign the incident to the SOC team and set its severity. What should you create?

Accepted Answer

An automation rule. Automation rules in Microsoft Sentinel allow you to automatically assign incidents to a specific team (e.g., SOC team) and set their severity based on conditions like analytics rule name or incident properties. Unlike playbooks, automation rules are lightweight, run immediately without a Logic Apps connector, and are designed for simple, no-code incident management tasks such as assignment and severity changes.

Answer

An analytics rule

Answer

A workbook

Answer

A playbook

Question 13

During an incident, you need to prevent a malicious process from running on all endpoints using Microsoft Defender for Endpoint. The process is not yet detected by antivirus signatures. Which action should you use?

Accepted Answer

Add an indicator to block the process. Microsoft Defender for Endpoint allows you to create custom indicators of compromise (IoCs) to block or allow specific processes, files, or behaviors. Since the malicious process is not yet detected by antivirus signatures, adding an indicator to block the process file hash or certificate is the most direct and immediate action to prevent it from running on all endpoints.

Answer

Run antivirus scan

Answer

Collect investigation package

Answer

Initiate Live Response

Question 14

You are investigating an incident in Microsoft Defender XDR. The incident involves multiple alerts from different workloads. You need to view all related alerts in a single timeline. What should you use?

Accepted Answer

Incident page. The Incident page in Microsoft Defender XDR aggregates all alerts from different workloads (e.g., Microsoft Defender for Endpoint, Office 365, Identity) into a single, unified timeline view. This allows you to see the sequence of events and alerts related to the incident in chronological order, which is essential for understanding the attack chain and coordinating response actions.

Answer

Advanced hunting

Answer

Action center

Answer

Device timeline

Question 15

Which TWO actions can you perform in Microsoft Defender XDR as part of incident response?

Accepted Answer

Collect an investigation package from a device. Microsoft Defender XDR allows you to collect an investigation package from a device during incident response. This package includes system logs, registry hives, memory dumps, and other forensic data that can be analyzed to understand the scope and impact of a security incident. The action is performed directly from the device timeline or incident graph within the Defender portal.

Answer

Create a Microsoft Sentinel workbook

Answer

Modify a Microsoft Entra ID conditional access policy

Answer

Run a KQL query in Azure Data Explorer