SC-200 Respond to security incidents Practice Test 7 — 15 Questions

Question 1

During an incident, you need to prevent a malicious process from running on all endpoints using Microsoft Defender for Endpoint. The process is not yet detected by antivirus signatures. Which action should you use?

Accepted Answer

Add an indicator to block the process. Option C is correct because 'Indicators' allow you to block or allow specific hashes, IPs, or certificates. Option A is wrong because 'Initiate Live Response' is for live interaction. Option B is wrong because 'Run antivirus scan' may not detect unknown processes. Option D is wrong because 'Collect investigation package' is for data collection.

Answer

Run antivirus scan

Answer

Collect investigation package

Answer

Initiate Live Response

Question 2

You are investigating an incident in Microsoft Defender XDR. The incident involves multiple alerts from different workloads. You need to view all related alerts in a single timeline. What should you use?

Accepted Answer

Incident page. Option A is correct because the incident page in Defender XDR shows all related alerts. Option B is wrong because the action center shows remediation actions. Option C is wrong because the hunting page is for proactive queries. Option D is wrong because the device timeline is per device.

Answer

Advanced hunting

Answer

Action center

Answer

Device timeline

Question 3

Which TWO actions can you perform in Microsoft Defender XDR as part of incident response?

Accepted Answer

Collect an investigation package from a device

Answer

Create a Microsoft Sentinel workbook

Answer

Modify a Microsoft Entra ID conditional access policy

Answer

Run a KQL query in Azure Data Explorer

Question 4

Which THREE actions can you take in Microsoft Sentinel to respond to an incident?

Accepted Answer

Assign the incident to a user

Answer

Modify a KQL query in an analytics rule

Answer

Export logs to Azure Storage

Question 5

Which TWO actions are valid containment steps for a compromised user account in Microsoft Defender XDR?

Accepted Answer

Disable the user account in Microsoft Entra ID

Answer

Create a new email rule to forward emails

Answer

Add the user to a privileged role

Answer

Run a full antivirus scan on the user's device

Question 6

A security analyst receives an alert in Microsoft Defender XDR indicating a possible credential theft attempt from an external IP. The analyst wants to isolate the affected device immediately while preserving forensic data. What should the analyst do?

Accepted Answer

Initiate a live response session on the device and run the 'isolate device' command.. Option B is correct because initiating a 'real-time response' session with 'isolate device' allows forensic data to be collected before isolation. Option A is wrong because disabling the user account does not prevent lateral movement from the device. Option C is wrong because resetting the password does not isolate the device. Option D is wrong because 'contain device' in Microsoft Defender for Endpoint is for network containment, not full isolation.

Answer

Use Microsoft Defender for Endpoint to 'contain device' from the device inventory.

Answer

Disable the user account in Microsoft Entra ID.

Answer

Reset the user's password and enforce sign-out.

Question 7

During an incident response, a SOC analyst needs to automatically collect relevant evidence from multiple Microsoft 365 services. Which Microsoft Sentinel playbook trigger should the analyst configure?

Accepted Answer

Microsoft Sentinel Incident trigger with action 'Collect evidence'.. Option C is correct because 'When an incident is triggered' allows automation based on Sentinel incidents. Option A is wrong because 'When a new alert is created' is too granular and not designed for multi-service evidence collection. Option B is wrong because 'When a response action is executed' is not a standard trigger. Option D is wrong because a scheduled query is for hunting, not for automated response.

Answer

Microsoft Sentinel Playbook trigger 'When a response action is executed'.

Answer

Microsoft Sentinel Scheduled Analytics rule trigger.

Answer

Microsoft Sentinel Alert trigger.

Question 8

Your organization uses Microsoft Sentinel and Microsoft Defender for Cloud. A critical server in Azure was compromised by ransomware. The incident response team needs to ensure that no other resources in the same resource group are affected. What is the most immediate containment action?

Accepted Answer

Disable the public IP address and apply an NSG rule to block all inbound/outbound traffic to the server's subnet.. Option A is correct because disabling the public IP and applying a network security group (NSG) block isolates the server while preserving the disk. Option B is wrong because deleting the VM destroys evidence. Option C is wrong because moving the VM to a different subnet does not prevent lateral movement from the original IP. Option D is wrong because changing the administrator password does not stop ransomware from running.

Answer

Delete the virtual machine immediately to stop the ransomware.

Answer

Change the local administrator password on the VM.

Answer

Move the VM to a different virtual network and subnet.

Question 9

Refer to the exhibit. You are reviewing a Microsoft Sentinel scheduled analytics rule configured as above. An incident was created for multiple alerts triggering within a 5-hour window. The SOC team needs to investigate each alert separately because they involve different user accounts. What should the analyst do to ensure each alert generates a separate incident?

Accepted Answer

Set 'enabled' to false under groupingConfiguration.. Option D is correct because setting 'enabled' to false under groupingConfiguration disables grouping, so each alert becomes its own incident. Option A is wrong because increasing lookbackDuration would group more alerts. Option B is wrong because changing matchingMethod to 'AllEntities' is already set and does not affect grouping behavior. Option C is wrong because enabling 'reopenClosedIncident' is for reopening, not for separating alerts.

Answer

Change the matchingMethod to 'AnyAlert'.

Answer

Set 'reopenClosedIncident' to true.

Answer

Change the lookbackDuration to PT0H.

Question 10

A SOC analyst is investigating a phishing campaign that targets Microsoft 365 users. The analyst needs to collect email message headers from multiple users' mailboxes. Which Microsoft 365 Defender action should the analyst use?

Accepted Answer

Use Microsoft 365 Defender > Email & collaboration > Explorer to query email headers.. Option C is correct because 'Email & collaboration > Explorer' allows hunting for email messages and collecting headers. Option A is wrong because 'Threat hunters' is a Microsoft Defender XDR role, not a specific action. Option B is wrong because 'Actions & submissions' is for submitting suspicious items, not for collecting headers. Option D is wrong because 'Attack simulation training' is for testing, not investigation.

Answer

Use Microsoft 365 Defender > Actions & submissions to view email headers.

Answer

Use Microsoft 365 Defender > Threat hunters to search for email headers.

Answer

Use Microsoft 365 Defender > Attack simulation training to collect headers.

Question 11

During an incident involving a compromised Azure VM, the security team wants to capture a memory dump for forensic analysis. The VM is running Windows Server 2022. What is the recommended approach?

Accepted Answer

Initiate a live response session on the VM and run the 'dump memory' command.. Option B is correct because initiating a live response session in Microsoft Defender for Endpoint allows running a memory dump collection command. Option A is wrong because taking a snapshot captures the disk, not memory. Option C is wrong because PowerShell remoting may not work if the VM is isolated. Option D is wrong because Azure Backup captures disk state, not memory.

Answer

Use Azure Backup to create a VM snapshot.

Answer

Establish a PowerShell remote session and run 'Get-Process | Export-CliXML'.

Answer

Use Azure Disk Encryption to export the disk.

Question 12

Your organization uses Microsoft Sentinel and Microsoft Defender for Identity. An alert fires for a potential DCSync attack. The incident response team needs to immediately block the source account from performing directory replication. Which action should be taken?

Accepted Answer

Disable the account in Microsoft Entra ID (if synced) or Active Directory.. Option D is correct because disabling the account in Microsoft Entra ID (formerly Azure AD) is the quickest way to stop the account from performing any actions, including DCSync. Option A is wrong because removing from Domain Admins does not remove the 'Replicate Directory Changes' permission if it was delegated. Option B is wrong because resetting the password does not terminate existing sessions immediately. Option C is wrong because the Microsoft Defender for Identity alert provides details but does not directly block the account.

Answer

Use Microsoft Defender for Identity to disable the account.

Answer

Reset the account password and enforce a sign-out.

Answer

Remove the account from the Domain Admins group.

Question 13

A SOC analyst is triaging an incident in Microsoft Sentinel and needs to assign it to a senior analyst for further investigation. What is the correct action?

Accepted Answer

Open the incident and change the Owner field to the senior analyst.. Option A is correct because the incident details blade allows changing the owner. Option B is wrong because creating a new incident is not necessary. Option C is wrong because closing the incident would stop investigation. Option D is wrong because the playbook is for automation, not for assignment.

Answer

Create a new incident and manually add the senior analyst as a comment.

Answer

Close the incident and reopen it under the senior analyst's name.

Answer

Run a playbook that sends an email to the senior analyst.

Question 14

Refer to the exhibit. A Microsoft Sentinel scheduled rule is configured as shown. The rule generates an alert, but the incident created contains only the first alert, and subsequent alerts do not update the incident. What is the most likely cause?

Accepted Answer

The rule does not have incident grouping enabled.. Option B is correct because the rule does not have incident grouping configured (no incidentConfiguration), so each alert creates a new incident by default. Option A is wrong because the query is valid and returns results. Option C is wrong because the trigger operator and threshold are correct for alerting. Option D is wrong because the severity is set correctly.

Answer

The triggerOperator and triggerThreshold are misconfigured.

Answer

The KQL query is missing a join to include more data.

Answer

The severity is set to High, which prevents incident updates.

Question 15

Which TWO actions can be performed using Microsoft Sentinel's automation rules? (Choose two.)

Accepted Answer

Change the severity of an incident.. Option A and D are correct. Automation rules can trigger playbooks and change incident severity. Option B is wrong because automation rules cannot directly block IP addresses; that requires a playbook. Option C is wrong because automation rules run on incidents, not on queries. Option E is wrong because automation rules do not manage user permissions.

Answer

Block an IP address in Azure Firewall.

Answer

Assign a user to an incident owner.

Answer

Run a KQL query against a Log Analytics workspace.