SC-200 Respond to security incidents Practice Test 6 — 15 Questions

Question 1

You are analyzing a firewall policy in Azure Firewall deployed via Azure Policy. What is the effect of this rule?

Accepted Answer

Denies inbound traffic from IP 10.0.0.5 to any destination.. Option B is correct because the rule denies inbound traffic from IP 10.0.0.5 to any destination. Option A is wrong because it denies, not allows. Option C is wrong because the direction is inbound. Option D is wrong because it blocks all traffic from that IP, not just specific ports.

Answer

Allows outbound traffic from any source to IP 10.0.0.5.

Answer

Allows inbound traffic from IP 10.0.0.5 to any destination.

Answer

Denies outbound traffic from any source to IP 10.0.0.5.

Question 2

You are reviewing a scheduled analytics rule in Microsoft Sentinel. What does the suppressionDuration setting affect?

Accepted Answer

It stops the rule from creating new alerts for that duration after an alert is generated.. Option C is correct. Suppression duration determines how long to wait before creating another alert from the same rule after an alert is generated, suppressing duplicates. Option A is wrong because it does not affect query execution. Option B is wrong because it does not affect incident grouping. Option D is wrong because it does not stop the rule from running.

Answer

It groups alerts into a single incident within that time window.

Answer

It delays the execution of the query by that amount of time.

Answer

It determines how often the query runs.

Question 3

Your organization uses Microsoft Defender for Cloud. You receive a security alert about a suspicious process on a virtual machine. You want to investigate the process further. What should you do?

Accepted Answer

Initiate a live response session on the VM from Microsoft Defender for Cloud.. Option A is correct because live response allows real-time investigation of a VM. Option B is wrong because creating a custom detection rule is for future alerts. Option C is wrong because initiating an automated investigation is for incident response, not ad-hoc investigation. Option D is wrong because running a vulnerability scan is for vulnerabilities, not process investigation.

Answer

Create a custom detection rule to alert on similar processes.

Answer

Run a vulnerability assessment scan on the VM.

Answer

Initiate an automated investigation on the VM.

Question 4

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You want to automatically isolate a device when a high-severity incident is created. What is the most efficient way to achieve this?

Accepted Answer

Create an automation rule in Microsoft Sentinel that triggers a playbook, which uses the Microsoft Defender for Endpoint connector to isolate the device.. Option C is correct because Microsoft Sentinel automation rules can run a playbook that isolates the device via Microsoft Defender for Endpoint. Option A is wrong because automation rules cannot directly run scripts. Option B is wrong because creating a custom detection rule in Defender does not integrate with Sentinel incident creation. Option D is wrong because manual isolation is not automatic.

Answer

Manually isolate the device from the Microsoft Defender for Endpoint console after the incident is created.

Answer

Create an automation rule in Microsoft Sentinel that runs a PowerShell script to isolate the device.

Answer

Create a custom detection rule in Microsoft Defender XDR that triggers device isolation.

Question 5

Your organization uses Microsoft Sentinel. You have a requirement to automatically add a tag to incidents that involve a specific user. The tag should be added when the incident is created. What should you configure?

Accepted Answer

Create an automation rule that triggers on incident creation and runs a playbook with the 'Add tag' action.. Option A is correct because an automation rule can run a playbook that adds a tag based on incident properties. Option B is wrong because watchlists are for enrichment, not tagging. Option C is wrong because analytics rules create alerts, not tags. Option D is wrong because entity behavior analytics does not add tags.

Answer

Add the user to a watchlist and create a fusion rule.

Answer

Modify the analytics rule to include a tag in the incident configuration.

Answer

Enable entity behavior analytics to automatically tag incidents.

Question 6

Your organization uses Microsoft Defender for Office 365. You detect a phishing email that was delivered to a user's inbox. You want to remove the email from all recipients. What should you do?

Accepted Answer

Use Threat Explorer to find the email and take action to delete it.. Option B is correct because the Threat Explorer in Defender for Office 365 allows you to take action on emails, such as deleting them. Option A is wrong because creating a mail flow rule is reactive but not immediate removal. Option C is wrong because submitting to Microsoft is for analysis. Option D is wrong because blocking the sender does not remove already delivered emails.

Answer

Submit the email to Microsoft for analysis.

Answer

Create a mail flow rule to delete similar emails in the future.

Answer

Block the sender using the Tenant Allow/Block List.

Question 7

Your organization uses Microsoft Defender for Identity. You receive an alert about a suspicious Kerberos authentication attempt. What is the best first step to contain the potential threat?

Accepted Answer

Disable the account that was used for the authentication.. Option C is correct because disabling the compromised account immediately stops further authentication. Option A is wrong because investigating the source IP does not contain the threat. Option B is wrong because reviewing logs does not contain. Option D is wrong because resetting the krbtgt account is a drastic step and not the first action.

Answer

Review the Active Directory logs for related events.

Answer

Reset the krbtgt account password twice.

Answer

Investigate the source IP address of the authentication attempt.

Question 8

Your organization uses Microsoft Sentinel and has enabled UEBA (User and Entity Behavior Analytics). You notice a series of incidents involving anomalous logon times for a privileged user. You want to automate the response to disable the user's account in Microsoft Entra ID when such incidents are created. What should you configure?

Accepted Answer

Create an automation rule that runs a playbook when an incident from the UEBA analytics rule is created, and configure the playbook to disable the user in Microsoft Entra ID.. Option D is correct because an automation rule can trigger a playbook that uses the Microsoft Entra ID connector to disable a user. Option A is wrong because UEBA does not directly trigger actions. Option B is wrong because analytics rules create alerts, not direct account actions. Option C is wrong because watchlists are for enrichment.

Answer

Create an analytics rule that triggers on UEBA anomalies and directly disables the user.

Answer

Add the user to a watchlist and create a playbook that runs on a schedule.

Answer

Configure UEBA to automatically disable the user when anomalous behavior is detected.

Question 9

Your organization uses Microsoft Sentinel. A security analyst receives an alert indicating that a user account was used to sign in from an unfamiliar location. You need to investigate the incident using Microsoft Defender XDR. Which action should you take first?

Accepted Answer

Review the alert in the Microsoft Defender XDR portal and classify it as a true or false positive.. Option D is correct because the first step in incident response is to classify the incident as a true or false positive. Option A is wrong because creating a playbook should be done after confirming the incident is a true positive. Option B is wrong because resetting the password should be a containment action after classification. Option C is wrong because turning off the user account is a containment action, not the first step.

Answer

Create an automated playbook to reset the user's password.

Answer

Turn off the user account in Microsoft Entra ID.

Answer

Reset the user's password immediately to prevent further access.

Question 10

During a security incident, you need to isolate a compromised Windows device from the network while allowing communication with Microsoft Defender for Endpoint services. Which Microsoft Defender for Endpoint action should you use?

Accepted Answer

Isolate device. Option B is correct because 'Isolate device' allows communication with Defender for Endpoint services while blocking other network traffic. Option A is wrong because 'Run antivirus scan' only scans and does not isolate. Option C is wrong because 'Restrict app execution' limits applications but does not isolate network. Option D is wrong because 'Collect investigation package' gathers data but does not isolate.

Answer

Run antivirus scan

Answer

Collect investigation package

Answer

Restrict app execution

Question 11

You are investigating a phishing incident in Microsoft Defender XDR. The incident involves a user who clicked a malicious link in an email. Which data source would you use to trace the email's origin?

Accepted Answer

Microsoft Defender for Office 365. Option A is correct because Microsoft Defender for Office 365 provides email and phishing data. Option B is wrong because Defender for Endpoint focuses on devices. Option C is wrong because Defender for Identity focuses on on-premises identity threats. Option D is wrong because Defender for Cloud Apps focuses on cloud applications.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Identity

Question 12

Your organization uses Microsoft Sentinel. You receive an incident that involves a potential lateral movement detected by Microsoft Defender for Identity. You need to investigate the timeline of the attack. Which Microsoft Sentinel feature should you use?

Accepted Answer

Investigation graph. Option C is correct because the investigation graph in Sentinel provides a visual timeline of related alerts and entities. Option A is wrong because workbooks are for reporting, not investigation. Option B is wrong because analytics rules generate alerts, not investigate. Option D is wrong because automation rules trigger playbooks, not investigation.

Answer

Workbooks

Answer

Automation rules

Answer

Analytics rules

Question 13

During a ransomware incident, you need to prevent the encryption of files on a server running Windows Server 2022. You have Microsoft Defender for Endpoint Plan 2. Which attack surface reduction rule should you enable?

Accepted Answer

Use advanced protection against ransomware. Option A is correct because 'Use advanced protection against ransomware' is a specific ASR rule that blocks ransomware behavior. Option B is wrong because 'Block executable files from running unless they meet a prevalence, age, or trusted list criterion' helps against unknown executables but not specifically ransomware. Option C is wrong because 'Block credential stealing from the Windows local security authority subsystem' targets credential theft. Option D is wrong because 'Block Adobe Reader from creating child processes' is for PDF exploits.

Answer

Block executable files from running unless they meet a prevalence, age, or trusted list criterion

Answer

Block credential stealing from the Windows local security authority subsystem

Answer

Block Adobe Reader from creating child processes

Question 14

You are responding to an incident where a user's device may be compromised. You need to collect forensic data from the device using Microsoft Defender for Endpoint. Which action should you take?

Accepted Answer

Collect investigation package. Option B is correct because 'Collect investigation package' gathers forensic data. Option A is wrong because 'Initiate Live Response' is for live remote shell, not just data collection. Option C is wrong because 'Run antivirus scan' is for malware detection. Option D is wrong because 'Isolate device' is for containment.

Answer

Isolate device

Answer

Initiate Live Response

Answer

Run antivirus scan

Question 15

Your organization uses Microsoft Sentinel. A security incident is generated by a scheduled analytics rule. You need to automatically assign the incident to the SOC team and set its severity. What should you create?

Accepted Answer

An automation rule. Option D is correct because automation rules in Sentinel can perform actions like assigning owner and changing severity. Option A is wrong because playbooks are for complex tasks, but automation rules are simpler. Option B is wrong because workbooks are for visualization. Option C is wrong because analytics rules generate incidents, not handle them.

Answer

An analytics rule

Answer

A workbook

Answer

A playbook

SC-200 Respond to security incidents Practice Test 6 — 15 Questions

Exhibit

SC-200 Respond to security incidents Practice Test 6 — 15 Questions

Exhibit