SC-200 Respond to security incidents Practice Test 7 — 15 Questions

Question 1

Which THREE actions can you take in Microsoft Sentinel to respond to an incident?

Accepted Answer

Assign the incident to a user. Assigning an incident to a user is a core incident response action in Microsoft Sentinel. It establishes ownership, ensuring a specific analyst is responsible for investigation and remediation. This action is performed directly from the incident details pane and is a fundamental step in managing the incident lifecycle.

Answer

Modify a KQL query in an analytics rule

Answer

Export logs to Azure Storage

Question 2

Which TWO actions are valid containment steps for a compromised user account in Microsoft Defender XDR?

Accepted Answer

Disable the user account in Microsoft Entra ID. Disabling the user account in Microsoft Entra ID is a valid containment step because it immediately revokes the user's access to all cloud resources, including Microsoft 365, Azure, and any applications relying on Entra ID authentication. This prevents the compromised account from being used for further malicious activities while preserving the account for investigation. It is a core incident response action in Microsoft Defender XDR for containing identity-based threats.

Answer

Create a new email rule to forward emails

Answer

Add the user to a privileged role

Answer

Run a full antivirus scan on the user's device

Question 3

A security analyst receives an alert in Microsoft Defender XDR indicating a possible credential theft attempt from an external IP. The analyst wants to isolate the affected device immediately while preserving forensic data. What should the analyst do?

Accepted Answer

Initiate a live response session on the device and run the 'isolate device' command.. Initiating a live response session and running the 'isolate device' command in Microsoft Defender for Endpoint immediately disconnects the device from the network (both internal and external) while preserving forensic data on the endpoint. This action stops the ongoing credential theft attempt without destroying volatile evidence, which is critical for subsequent investigation.

Answer

Use Microsoft Defender for Endpoint to 'contain device' from the device inventory.

Answer

Disable the user account in Microsoft Entra ID.

Answer

Reset the user's password and enforce sign-out.

Question 4

During an incident response, a SOC analyst needs to automatically collect relevant evidence from multiple Microsoft 365 services. Which Microsoft Sentinel playbook trigger should the analyst configure?

Accepted Answer

Microsoft Sentinel Incident trigger with action 'Collect evidence'.. The Microsoft Sentinel Incident trigger with the 'Collect evidence' action is specifically designed to automate evidence collection across Microsoft 365 services during incident response. This trigger fires when an incident is created or updated, allowing the playbook to gather relevant data from sources like Microsoft Defender for Endpoint, Microsoft 365 Defender, and Azure Active Directory without manual intervention.

Answer

Microsoft Sentinel Playbook trigger 'When a response action is executed'.

Answer

Microsoft Sentinel Scheduled Analytics rule trigger.

Answer

Microsoft Sentinel Alert trigger.

Question 5

Your organization uses Microsoft Sentinel and Microsoft Defender for Cloud. A critical server in Azure was compromised by ransomware. The incident response team needs to ensure that no other resources in the same resource group are affected. What is the most immediate containment action?

Accepted Answer

Disable the public IP address and apply an NSG rule to block all inbound/outbound traffic to the server's subnet.. The most immediate containment action is to isolate the compromised server's subnet by disabling its public IP and applying an NSG rule that blocks all inbound and outbound traffic. This prevents lateral movement of ransomware to other resources in the same resource group while preserving the VM for forensic analysis. In Microsoft Defender for Cloud and Sentinel, network isolation at the subnet level is the fastest way to contain a breach without destroying evidence.

Answer

Delete the virtual machine immediately to stop the ransomware.

Answer

Change the local administrator password on the VM.

Answer

Move the VM to a different virtual network and subnet.

Question 6

Refer to the exhibit. You are reviewing a Microsoft Sentinel scheduled analytics rule configured as above. An incident was created for multiple alerts triggering within a 5-hour window. The SOC team needs to investigate each alert separately because they involve different user accounts. What should the analyst do to ensure each alert generates a separate incident?

Accepted Answer

Set 'enabled' to false under groupingConfiguration.. Setting 'enabled' to false under groupingConfiguration disables alert grouping entirely. When grouping is disabled, each individual alert that triggers the scheduled rule will generate its own separate incident, allowing the SOC team to investigate alerts involving different user accounts independently.

Answer

Change the matchingMethod to 'AnyAlert'.

Answer

Set 'reopenClosedIncident' to true.

Answer

Change the lookbackDuration to PT0H.

Question 7

A SOC analyst is investigating a phishing campaign that targets Microsoft 365 users. The analyst needs to collect email message headers from multiple users' mailboxes. Which Microsoft 365 Defender action should the analyst use?

Accepted Answer

Use Microsoft 365 Defender > Email & collaboration > Explorer to query email headers.. Microsoft 365 Defender's Email & collaboration > Explorer (also known as Threat Explorer) is the dedicated tool for querying email message headers across multiple user mailboxes. It allows analysts to search for specific email messages by sender, recipient, subject, or other attributes, and then view the full internet message headers (RFC 5322) for forensic analysis. This is the standard workflow for investigating phishing campaigns in Microsoft 365 Defender.

Answer

Use Microsoft 365 Defender > Actions & submissions to view email headers.

Answer

Use Microsoft 365 Defender > Threat hunters to search for email headers.

Answer

Use Microsoft 365 Defender > Attack simulation training to collect headers.

Question 8

During an incident involving a compromised Azure VM, the security team wants to capture a memory dump for forensic analysis. The VM is running Windows Server 2022. What is the recommended approach?

Accepted Answer

Initiate a live response session on the VM and run the 'dump memory' command.. Microsoft Defender for Endpoint's live response capability provides a built-in 'dump memory' command that captures a full memory dump of the compromised Azure VM for forensic analysis. This is the recommended approach as it allows memory acquisition without requiring additional tools or direct RDP/PSRemoting access, preserving the forensic integrity of the volatile data.

Answer

Use Azure Backup to create a VM snapshot.

Answer

Establish a PowerShell remote session and run 'Get-Process | Export-CliXML'.

Answer

Use Azure Disk Encryption to export the disk.

Question 9

Your organization uses Microsoft Sentinel and Microsoft Defender for Identity. An alert fires for a potential DCSync attack. The incident response team needs to immediately block the source account from performing directory replication. Which action should be taken?

Accepted Answer

Disable the account in Microsoft Entra ID (if synced) or Active Directory.. Immediately disabling the account in Microsoft Entra ID (if synced) or Active Directory is the fastest way to stop the compromised account from performing any directory replication, including DCSync attacks. DCSync abuses the domain controller's replication protocol (MS-DRSR) to request password hashes, and disabling the account blocks all Kerberos and NTLM authentication, effectively halting the attack at the source.

Answer

Use Microsoft Defender for Identity to disable the account.

Answer

Reset the account password and enforce a sign-out.

Answer

Remove the account from the Domain Admins group.

Question 10

A SOC analyst is triaging an incident in Microsoft Sentinel and needs to assign it to a senior analyst for further investigation. What is the correct action?

Accepted Answer

Open the incident and change the Owner field to the senior analyst.. In Microsoft Sentinel, the correct way to assign an incident to a specific analyst is to open the incident and change the Owner field to that analyst. This action formally transfers ownership and responsibility for the incident within the SIEM, ensuring proper tracking and accountability. Other methods, such as adding comments or sending emails, do not update the incident's ownership metadata.

Answer

Create a new incident and manually add the senior analyst as a comment.

Answer

Close the incident and reopen it under the senior analyst's name.

Answer

Run a playbook that sends an email to the senior analyst.

Question 11

Refer to the exhibit. A Microsoft Sentinel scheduled rule is configured as shown. The rule generates an alert, but the incident created contains only the first alert, and subsequent alerts do not update the incident. What is the most likely cause?

Accepted Answer

The rule does not have incident grouping enabled.. The exhibit shows the rule is configured to create a single incident from alerts grouped by entities, but the 'Grouping' settings are not enabled. Without incident grouping enabled, each alert generates a separate incident, and subsequent alerts do not update the existing incident. Enabling incident grouping allows alerts matching the same grouping criteria to be merged into the same incident, ensuring updates occur.

Answer

The triggerOperator and triggerThreshold are misconfigured.

Answer

The KQL query is missing a join to include more data.

Answer

The severity is set to High, which prevents incident updates.

Question 12

Which TWO actions can be performed using Microsoft Sentinel's automation rules? (Choose two.)

Accepted Answer

Change the severity of an incident.. Automation rules in Microsoft Sentinel can perform several actions on incidents, including changing severity (B), assigning owner (C), and triggering a playbook (D). Option A is incorrect because blocking an IP address is a more complex remediation typically done via a playbook, not directly by an automation rule. Option E is incorrect because running a KQL query is not an action available in automation rules; queries are executed in the Log Analytics workspace or via analytics rules.

Answer

Block an IP address in Azure Firewall.

Answer

Run a KQL query against a Log Analytics workspace.

Question 13

Which THREE are valid containment actions in Microsoft Defender for Endpoint? (Choose three.)

Accepted Answer

Contain device. 'Contain device' is a built-in response action in Microsoft Defender for Endpoint (MDE) that limits a compromised device's network communication to the MDE service and other trusted services, effectively stopping lateral movement while maintaining visibility and control. This action is part of the 'Device' response actions available in the MDE portal.

Answer

Reset password

Answer

Collect investigation package

Question 14

Which TWO are valid sources of evidence in a Microsoft Sentinel incident? (Choose two.)

Accepted Answer

Alerts. Alerts are a core evidence type in Microsoft Sentinel incidents because they represent the raw security findings that trigger an incident. When an alert is generated from a detection rule (e.g., analytics rule, fusion, or scheduled query), it is automatically linked to the incident as evidence, providing the initial context and supporting data for investigation.

Answer

Playbooks

Answer

Watchlists

Answer

Hunting queries

Question 15

Your organization uses Microsoft Purview to manage insider risk. A user is suspected of exfiltrating data via email. The incident response team needs to preserve a copy of the user's mailbox for legal hold. Which action should be taken?

Accepted Answer

Place the mailbox on litigation hold.. A litigation hold preserves all mailbox content, including deleted and modified items, ensuring the mailbox is preserved for legal hold. Option A is incorrect because an eDiscovery hold is typically used for specific search results rather than full mailbox preservation. Option C is incorrect because disabling MFA does not preserve any data. Option D is incorrect because a retention policy applies to all mailboxes in the organization and may not target this specific user's legal hold need.

Answer

Place the mailbox on an eDiscovery hold.

Answer

Disable the user's multi-factor authentication to prevent access.

Answer

Apply a Microsoft Purview retention policy to the user's mailbox.