SC-200 Respond to security incidents Practice Test 7 — 15 Questions

Question 1

An organization uses Microsoft Sentinel with the Microsoft Defender XDR connector. An incident is generated for a user who is suspected of being compromised. The analyst wants to automatically block the user's sign-ins using a playbook. Which connector should the playbook use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Entra ID connector. The Microsoft Entra ID connector in Microsoft Sentinel playbooks allows you to perform actions in Microsoft Entra ID, such as blocking sign-ins for a user. This is the correct connector because the requirement is to automatically block the user's sign-ins, which is an Entra ID operation. The playbook can use the connector to call the Microsoft Graph API and update the user's sign-in status.

Answer

Microsoft Sentinel connector

Answer

Microsoft 365 Defender connector

Answer

Microsoft Teams connector

Question 2

Refer to the exhibit. An automation rule is created in Microsoft Sentinel. A new incident is created with severity 'Medium' and two alerts: one 'High' and one 'Medium'. Will the playbook run?

Accepted Answer

Yes, because the incident contains a High severity alert.. The condition checks 'AlertSeverity', but an incident can have multiple alerts with different severities. The condition evaluates the incident's overall severity, which is set to the highest alert severity. Since there is a High alert, the incident severity becomes High, so condition is met.

Answer

No, because the incident severity is Medium.

Answer

Yes, because the playbook runs on all incidents regardless.

Answer

No, because the condition requires all alerts to be High.

Question 3

Which THREE elements are required to create a custom detection rule in Microsoft Sentinel?

Accepted Answer

A KQL query. A custom detection rule requires a KQL query to define logic, a schedule to run the query, and entity mapping to link results to incidents. Alert threshold is optional; playbook is separate.

Answer

An alert threshold

Answer

Entity mapping for incident creation

Answer

An automation playbook

Question 4

Which TWO tools in Microsoft Defender XDR provide automated investigation and response capabilities?

Accepted Answer

Microsoft Defender for Endpoint. Microsoft Defender for Endpoint (A) is correct because it includes Automated Investigation and Response (AIR) capabilities that automatically investigate alerts, remediate threats on endpoints, and manage the investigation queue in the Microsoft 365 Defender portal. Microsoft Defender for Office 365 (B) is also correct because it provides AIR for email and collaboration threats, automatically investigating alerts such as phishing, malware, and malicious URLs, and taking remediation actions like soft-deleting messages or blocking senders. Defender for Identity (C) focuses on identity-based threat detection and lateral movement analysis but does not itself provide the automated investigation and response engine referenced here. Defender for Cloud Apps (D) delivers CASB functionality such as anomaly detection, app governance, and session controls, but its automated investigation capabilities are not the AIR feature being asked about. Defender for Cloud (E) is a cloud security posture and workload protection service (CSPM/CWPP) and does not provide the Microsoft Defender XDR AIR tooling described in this question.

Answer

Microsoft Defender for Identity

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Cloud

Question 5

Which THREE conditions must be met for a Microsoft Sentinel incident to be automatically closed by a playbook?

Accepted Answer

The playbook must have the 'Microsoft Sentinel Incident' connector with 'Update incident' action.. Option A is correct because closing an incident requires the playbook to use the 'Microsoft Sentinel Incident' connector's 'Update incident' action, which is the only mechanism that can change an incident's status (e.g., to Closed) via a playbook. Option B is correct because an incident must actually exist for a playbook to close it, and incidents are only generated when the analytics rule has 'Create incident' enabled in its incident settings. Option C is correct because the automation rule is what invokes the playbook, and it must include the 'Run playbook' action to trigger the playbook that performs the closure. Option D is not required because a classification is optional metadata and does not gate the ability to close an incident. Option E is not required because the playbook can be triggered by an automation rule on various triggers (e.g., incident creation or update), not strictly on incident creation.

Answer

The incident must have a classification set.

Answer

The playbook must be triggered on incident creation.

Question 6

Refer to the exhibit. An admin creates this activity policy in Microsoft Defender for Cloud Apps. What will happen when a user fails to log in from 3 different IP addresses within 10 minutes?

Accepted Answer

The user will be blocked only if the third IP is different from the first two.. The policy triggers when the count of different IPs for failed logins reaches 3 within 10 minutes. The action is to block the user. 'DifferentCount' means distinct IPs, not total attempts. So exactly 3 different IPs trigger it.

Answer

The policy will generate an alert but not block the user.

Answer

The user will be blocked immediately after the third failed login from any IP.

Answer

The user will be blocked after 10 minutes regardless of the number of IPs.

Question 7

Refer to the exhibit. An analyst runs this Azure CLI command and receives no output. The workspace has many High severity incidents in 'New' status. What is the most likely reason?

Accepted Answer

The query syntax is incorrect; the pipe between conditions is invalid.. The JMESPath query uses '||' operator incorrectly; the correct syntax for filtering is '&&' or multiple filters. The query as written tries to combine two conditions with '|' which is not valid. Also the index [0] might be wrong if no matches, but the issue is the query syntax.

Answer

The analyst does not have read permissions for the workspace.

Answer

No incidents match both conditions.

Answer

The --query parameter is not supported for this command.

Question 8

You are reviewing this ARM template for a Microsoft Sentinel analytics rule. What is the most likely issue with the rule?

Accepted Answer

The query references a table that does not exist in Microsoft Sentinel. The most likely issue is that the query references a table that does not exist in Microsoft Sentinel. Analytics rules in Sentinel query Log Analytics workspace tables (e.g., SecurityEvent, SigninLogs, CommonSecurityLog), and a common ARM template error is referencing a table name that is not present in the workspace, causing the rule to fail validation or return no results. This is the classic misconfiguration when deploying analytics rules via ARM.

Answer

The rule type is incorrect for this scenario

Answer

The query syntax is invalid

Answer

The severity property should be 'Informational'

Question 9

You are responding to an incident where a user's Microsoft Entra ID account was compromised and used to send phishing emails internally. You need to prevent further damage. Which two actions should you take first?

Accepted Answer

Revoke the user's sessions. The two correct first-response actions are B, revoke the user's sessions, and C, disable the user account in Microsoft Entra ID. Disabling the account immediately stops any further sign-ins and blocks the attacker from using the compromised identity, while revoking sessions invalidates existing refresh tokens and access tokens so any already-authenticated sessions (including those used to send phishing email) are terminated. Together these contain the incident quickly without waiting on password changes or mailbox cleanup. Option A (reset password) is useful but alone does not kill active sessions, and it is not the fastest containment step. Option D (block all external email) is overly broad and unrelated to the compromised account, and option E (remove from distribution groups) is a remediation detail, not an immediate containment action.

Answer

Reset the user's password

Answer

Block all external email from the organization

Answer

Remove the user from all distribution groups

Question 10

Which THREE actions should you take when investigating a potential data exfiltration incident detected by Microsoft Defender for Cloud Apps?

Accepted Answer

Create a file policy to detect similar activities in the future. Option A is correct because creating a file policy in Microsoft Defender for Cloud Apps lets you define detection criteria (such as sensitive file types, labels, or specific users/apps) so that similar exfiltration activity triggers alerts going forward, which is a standard remediation step after confirming an incident. Option C is correct because Microsoft Sentinel's investigation tools (hunting queries, entity behavior, and incident graph) let you pivot from the Defender for Cloud Apps alert to correlated events across connected data sources, expanding the scope of the investigation. Option E is correct because the user's activity log in the Defender for Cloud Apps portal shows the raw Cloud App Security activity entries (file downloads, shares, uploads, etc.) needed to reconstruct exactly what the user did and when. Option B is not correct because Microsoft Defender for Identity monitors on-premises Active Directory signals and identity-based attacks, not cloud data exfiltration activity, so it is not the primary investigative source here. Option D is not correct because a cloud discovery report identifies shadow IT/unsanctioned apps from traffic logs, which is unrelated to investigating a specific user's data exfiltration incident.

Answer

Check Microsoft Defender for Identity for related alerts

Answer

Run a cloud discovery report to identify unsanctioned apps

Question 11

You are reviewing this analytics rule in Microsoft Sentinel. What is the problem with this rule?

Accepted Answer

The query is missing a time range filter. The query lacks a time range filter (e.g., '| where TimeGenerated > ago(7d)'), which would cause it to run against the entire historical dataset in Sentinel, leading to excessive resource usage and potential timeouts. Option B is wrong because the query correctly uses 'summarize' with 'dcount' as an aggregate; the syntax is valid and not the issue. Option C is wrong because the trigger threshold (e.g., 5) is not the problem—the rule could match correctly once a time filter is added. Option D is wrong because the query syntax is valid; the problem is the missing time filter, not invalid syntax.

Answer

The aggregate function should be 'summarize' with 'dcount'

Answer

The trigger threshold should be set to 5

Answer

The query syntax is invalid

Question 12

You are working on a security incident in Microsoft Sentinel where you need to contain a compromised virtual machine. What is the most immediate containment action?

Accepted Answer

Isolate the VM by applying a network security group (NSG) rule. In Microsoft Sentinel, immediately containing a compromised VM by isolating it (e.g., using a network security group rule) stops lateral movement, which is the priority. Option B is wrong because applying patches is a remediation step, not an immediate containment. Option C is wrong because running an antivirus scan is a detection or remediation step, not immediate containment. Option D is wrong because taking a snapshot is for forensic preservation, not containment.

Answer

Apply the latest security patches to the VM

Answer

Run a full antivirus scan on the VM

Answer

Take a snapshot of the VM for forensic analysis

Question 13

You are investigating a security incident in Microsoft Defender XDR where a user received a phishing email that bypassed Exchange Online Protection. The email contained a link to a credential harvesting page. After the user entered credentials, the attacker used them to sign in from an unusual location. You need to recommend an automated response to prevent further credential theft from similar emails. What should you implement?

Accepted Answer

Configure a Conditional Access policy to block sign-ins from unusual locations.. Configure a Conditional Access policy (ideally a sign-in risk-based policy via Microsoft Entra ID Protection) to automatically block or require additional verification for sign-ins from unusual or risky locations. This is the automated control that directly stops an attacker from using stolen credentials to authenticate, addressing the credential-theft-to-sign-in chain described in the scenario. Attack Simulation Training is valuable for long-term user awareness, but it is not an automated technical response to an active credential-theft threat.

Answer

Create an Attack Simulation Training campaign in Microsoft Defender for Office 365.

Answer

Enable Cloud App Security to detect and block malicious cloud apps.

Answer

Enable Safe Links policy for all users.

Question 14

You run the above KQL query in Microsoft Sentinel to detect potential brute-force attacks on Microsoft Teams. After reviewing the results, you notice that some entries have a high LogonCount but are missing from the output. What is the most likely reason?

Accepted Answer

The inner join excludes entries that do not have a corresponding risky sign-in event.. The inner join in the KQL query only returns rows where there is a matching risky sign-in event for the same account. If a high LogonCount entry has no corresponding risky sign-in event, the inner join excludes it from the output. This is the most likely reason entries are missing despite having a high LogonCount.

Answer

The RiskLevelDuringSignIn field is misspelled as RiskLevelDuringSignIn.

Answer

The query only considers logons to Microsoft Teams, but the high LogonCount may be from other applications.

Answer

The join condition does not include AccountUpn, so it fails to match.

Question 15

You deploy the above ASR rule in Microsoft Defender for Endpoint. After deployment, you notice that .exe files are still being executed from Outlook attachments. What is the most likely reason?

Accepted Answer

The ASR rule is configured in audit mode instead of block mode.. Attack Surface Reduction (ASR) rules in Microsoft Defender for Endpoint can operate in either block mode or audit mode. By default, when a rule is defined without specifying the enforcement mode, it may default to audit mode. In audit mode, the rule generates logs but does not actually block the execution. Therefore, even though the rule is deployed, .exe files from Outlook attachments can still be executed if the rule is not set to block mode. Option A is incorrect because the rule is designed to block executable files from email attachments regardless of the initiating process, as long as the rule is properly configured. Option B is incorrect because the issue is with .exe files, not .vbs files; the rule could block .vbs if configured, but that does not explain why .exe files are not blocked. Option D is incorrect because fileExtension is a supported field in ASR rules; the rule syntax shown is valid.

Answer

The rule only applies when the initiating process is outlook.exe, but the attachment may be launched from another process.

Answer

The rule does not block .vbs files, which are also commonly used in attacks.

Answer

The rule is not applied because fileExtension is not a supported field in ASR rules.