SC-200 Respond to security incidents Practice Test 8 — 15 Questions

Question 1

You run the above KQL query in Microsoft Sentinel to detect encoded PowerShell commands. The query returns no results, even though you know that some devices have executed encoded PowerShell commands. What is the most likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The query only looks for 'powershell.exe', but the command might have been run using 'pwsh.exe' or 'powershell_ise.exe'.. The query filters where FileName == 'powershell.exe', but encoded PowerShell commands can also be run using 'pwsh.exe' (PowerShell Core) or 'powershell_ise.exe'. If the process name is different, the query will not return results. Option A is incorrect because the DecodedCommand column could be empty if the query's logic is flawed, but the main issue is the process name filter. Option B is incorrect because base64_decode_tostring can decode PowerShell encoded commands. Option D is incorrect because DeviceProcessEvents does capture PowerShell process events.

Answer

The DecodedCommand column is empty because the ProcessCommandLine does not contain an encoded command.

Answer

The base64_decode_tostring function cannot decode PowerShell encoded commands.

Answer

The DeviceProcessEvents table does not contain PowerShell process events.

Question 2

You are investigating an incident where a user reported receiving a suspicious email with an attachment. The attachment is a .docm file that contains macros. The email was not blocked by Exchange Online Protection. You need to ensure that similar emails are blocked in the future. What should you configure?

Accepted Answer

Create a Safe Attachments policy that blocks .docm files.. A Safe Attachments policy in Microsoft Defender for Office 365 will scan attachments and block malicious ones, including .docm files with macros. Option A is wrong because Safe Links scans URLs, not attachments. Option C is wrong because anti-phishing policies protect against impersonation, not malicious attachments. Option D is wrong because transport rules can block attachments but are less effective than Safe Attachments for macro-based malware.

Answer

Create a Safe Links policy to block links in the email.

Answer

Create an anti-phishing policy to block the sender's domain.

Answer

Create a transport rule to block emails with .docm attachments.

Question 3

During a security incident response, you need to collect forensic data from multiple endpoints. Which TWO tools can be used to remotely collect forensic data from Windows devices in a Microsoft Defender for Endpoint environment? (Choose two.)

Accepted Answer

Microsoft Defender for Endpoint live response. Microsoft Defender for Endpoint live response (B) provides remote forensic data collection capabilities through its live response session. The Microsoft 365 Defender portal (C) aggregates alerts and incidents from Defender for Endpoint and allows access to live response from within the portal. Microsoft Sentinel UEBA (A) is for user and entity behavioral analytics, not data collection from endpoints. Microsoft Intune (D) is for device management and compliance. Microsoft Purview eDiscovery (E) is for legal discovery, not real-time forensic data collection from endpoints.

Answer

Microsoft Sentinel UEBA

Answer

Microsoft Intune

Answer

Microsoft Purview eDiscovery

Question 4

You are investigating a potential data exfiltration incident in Microsoft Purview. A user has been downloading large amounts of data from a SharePoint site to an unmanaged device. Which TWO actions should you take to contain the exfiltration? (Choose two.)

Accepted Answer

Remove the user's permissions to the SharePoint site.. Option A is correct because removing the user's permissions to the SharePoint site immediately revokes their access, stopping any further downloads from that site—this is a direct, targeted containment action against the suspected exfiltration. Option C is correct because a DLP policy in Microsoft Purview can block downloads from unmanaged devices, preventing the user (and others) from pulling data to non-compliant endpoints and enforcing the organization's data-handling rules. Option B is not correct because applying a sensitivity label alone does not instantly revoke access or block downloads; labels drive encryption and policy but are not a containment action here. Option D is not correct because disabling the user's device in Intune does not stop access from an unmanaged device (which by definition is not enrolled in Intune). Option E is not correct because a retention policy governs how long content is kept or deleted, not who can access or download it, so it does nothing to contain the exfiltration.

Answer

Apply a sensitivity label to the SharePoint site to restrict access.

Answer

Disable the user's device in Microsoft Intune.

Answer

Create a retention policy for the SharePoint site.

Question 5

Your organization uses Microsoft Defender for Office 365. A user reports receiving a phishing email that was not blocked by the service. You need to improve detection of similar phishing emails. Which TWO actions should you take? (Choose two.)

Accepted Answer

Submit the email to Microsoft for analysis using the Submissions page in Microsoft 365 Defender.. Option C is correct because submitting the missed phishing email via the Submissions page in Microsoft 365 Defender sends it to Microsoft for analysis, allowing the service to learn from the false negative and tune its filters to detect similar messages in the future. Option E is correct because configuring an anti-phishing policy with user impersonation protection (and typically impersonation of domains and protected users) hardens detection against spoofed senders, which is a common characteristic of phishing emails that evade default filtering. Option A is not appropriate because Attack Simulation Training is a user-awareness and training tool, not a detection-tuning mechanism. Option B is not appropriate because Safe Links only rewrites and detonates URLs at click time; it does not improve the underlying detection of phishing emails that already bypassed filtering. Option D is not appropriate because a mailbox rule is a manual client-side workaround that does not enhance Defender for Office 365's detection capabilities.

Answer

Create an Attack Simulation Training campaign.

Answer

Enable Safe Links for all users to block malicious URLs.

Answer

Create a mailbox rule to move similar emails to the Junk folder.

Question 6

During a security incident, the Microsoft Sentinel workspace is receiving high volume of low-severity alerts causing analyst fatigue. You need to reduce noise while ensuring critical alerts are not missed. What should you configure?

Accepted Answer

Modify the incident creation rule to only create incidents for alerts with severity High or Medium. Incident creation rules can be configured to only create incidents for alerts with severity High or Medium, effectively filtering out low-severity noise while ensuring critical alerts are captured. Option A is wrong because disabling analytics rules would stop all alerts, including critical ones. Option B is wrong because changing severity to Informational would still create incidents if the rule is set to create incidents for all severities, and it does not reduce noise in the incident queue. Option C is wrong because automation rules trigger after incident creation, so they would not prevent the initial incident from being created, and automatically closing incidents can lead to missed critical alerts if not carefully scoped.

Answer

Disable analytics rules for low-severity alerts

Answer

Change the severity of low-severity alerts to Informational in the analytics rule

Answer

Create an automation rule to close low-severity incidents automatically

Question 7

You receive a Microsoft Defender XDR incident alert about a suspicious sign-in from an unfamiliar location. The user confirms they did not perform the sign-in. What should you do to immediately secure the account?

Accepted Answer

Disable the user account in Microsoft Entra ID. Disabling the account in Microsoft Entra ID immediately blocks all sign-ins and invalidates existing sessions, which is the fastest way to contain a confirmed compromised account. Since the user confirmed the sign-in was not theirs, containment takes priority over remediation. Disabling also preserves the account and its data for forensic investigation, unlike deletion.

Answer

Reset the user's password

Answer

Block the IP address used for the suspicious sign-in

Answer

Require the user to register for Microsoft Entra Multi-Factor Authentication

Question 8

You are investigating an incident in Microsoft Sentinel where a PowerShell script was executed on multiple servers with suspicious parameters. The incident is high severity. You need to determine if the script is malicious and if lateral movement occurred. What should you do?

Accepted Answer

Run a custom KQL hunting query to find similar script executions on other machines. A custom KQL hunting query in Microsoft Sentinel lets the analyst search across all connected machines for the same suspicious PowerShell parameters, script hashes, or command-line patterns. This directly answers the question of whether the script executed elsewhere and whether lateral movement occurred, by correlating events across the environment rather than just the machines already in the incident.

Answer

Use Microsoft Defender for Endpoint live response to collect forensic data

Answer

Restart the affected servers to stop the script

Answer

Review the incident timeline in Microsoft Sentinel

Question 9

Your organization uses Microsoft Sentinel. A security analyst reports that an incident was created for a sign-in from an unfamiliar location, but after investigation, it was determined to be a false positive. You need to ensure that similar sign-ins do not generate incidents in the future. What should you do?

Accepted Answer

Create a custom analytics rule with an alert suppression condition matching the sign-in attributes.. The correct approach is to create a custom analytics rule with an alert suppression condition that matches the sign-in attributes (e.g., location, user, IP) so that future similar sign-ins do not generate incidents. This directly addresses the requirement to prevent recurrence without altering built-in rules or relying on post-incident closure. Suppression conditions are evaluated at rule execution time, preventing alert and incident creation for matching events.

Answer

Modify the built-in Microsoft analytics rule to exclude the sign-in location.

Answer

Close the incident with a classification of False Positive.

Answer

Create an automation rule that automatically closes similar incidents.

Question 10

Your organization is responding to a security incident in Microsoft Defender XDR. You need to contain a compromised on-premises Exchange server. Which TWO actions are appropriate? (Choose two.)

Accepted Answer

Disconnect the server from the network.. Option A is correct because physically or logically disconnecting the compromised on-premises Exchange server from the network immediately stops lateral movement, command-and-control communication, and further data exfiltration, which is the primary containment goal during an active incident. Option C is correct because blocking the compromised user account in Microsoft Entra ID revokes the identity's access to cloud resources and prevents the attacker from using that account to pivot into Microsoft 365 services or re-enter the environment. Options B, D, and E are not containment actions: collecting an investigation package, updating antivirus definitions, and running a full antivirus scan are forensic or remediation steps that should be performed after containment, and running them on a still-connected compromised server could allow the attacker to continue operating or destroy evidence.

Answer

Collect an investigation package from the server.

Answer

Update the antivirus definitions on the server.

Answer

Run a full antivirus scan on the server.

Question 11

Your organization uses Microsoft Defender for Office 365. A user reports receiving a phishing email. You need to investigate the email and take action. Which TWO actions can you perform? (Choose two.)

Accepted Answer

Use the email entity page to take action like 'Soft delete'.. Options A and B are correct. The email entity page in Microsoft Defender for Office 365 allows you to take actions like soft delete on a specific email. Threat Explorer (now part of the Microsoft 365 Defender portal) enables you to search for emails and take actions such as deleting them. Option C is incorrect because creating a mail flow rule is a longer-term preventive measure, not an immediate investigative action. Option D is incorrect because submitting the email to Microsoft is for analysis, not for taking direct action on the email. Option E is incorrect because blocking the sender is possible but not a direct action from the incident investigation; it is a separate action.

Answer

Create a mail flow rule to block similar emails.

Answer

Submit the email to Microsoft for analysis.

Answer

Block the sender's email address.

Question 12

Your organization uses Microsoft Defender XDR. You are investigating an incident that involves a malware infection on a Windows 10 device. The device is currently isolated from the network. The incident shows that the malware attempted to communicate with a command-and-control (C2) server. You have collected an investigation package. Now you need to remediate the device and bring it back to a clean state. The device has critical data that must not be lost. Which remediation action should you take? A) Run a full antivirus scan and remove threats. B) Perform a factory reset of the device. C) Reimage the device from a clean backup. D) Initiate a live response to manually remove the malware. Which option best balances thorough remediation with data preservation?

Accepted Answer

Reimage the device from a clean backup.. Reimaging from a clean backup ensures the malware is completely removed while preserving data from the backup. Option A (Full scan) may not detect all malware. Option B (Factory reset) loses all data. Option D (Live response) may miss persistent threats and is not as thorough as reimaging.

Answer

Initiate a live response to manually remove the malware.

Answer

Run a full antivirus scan and remove threats.

Answer

Perform a factory reset of the device.

Question 13

Your organization uses Microsoft Sentinel and Microsoft Defender for Identity. An incident is generated for a potential lateral movement attack. The incident is linked to multiple alerts involving a domain controller and several workstations. You need to understand the attack path and identify the initial compromised account. Which feature should you use to visualize the attack chain? A) The incident graph in Microsoft Sentinel. B) The entity timeline in Microsoft Defender for Identity. C) The Microsoft 365 Defender attack story. D) The Microsoft Purview compliance portal. Which option provides the best visual representation of the attack path?

Accepted Answer

The incident graph in Microsoft Sentinel.. The Microsoft Sentinel incident graph provides a visual representation of entities and their relationships, showing the attack path. Option B (Entity timeline) is linear and not a graph. Option C (Attack story) is in Defender XDR but focuses on alerts. Option D (Purview) is for compliance, not security incidents.

Answer

The Microsoft Purview compliance portal.

Answer

The entity timeline in Microsoft Defender for Identity.

Answer

The Microsoft 365 Defender attack story.

Question 14

After a security incident, the SOC team needs to preserve forensic evidence from a compromised Microsoft Entra ID joined Windows 10 device. The device is still online. Which tool should the team use to collect a forensic image of the hard drive?

Accepted Answer

Microsoft Defender for Endpoint. Microsoft Defender for Endpoint is the correct tool because its Live Response feature gives a SOC analyst a remote shell to the device and supports the built-in 'Collect investigation package' action, which gathers key forensic artifacts (running processes, autoruns, scheduled tasks, network connections, prefetch files, and more) for offline analysis without altering the device. For a true full-disk forensic image, analysts commonly use Live Response's file-push and run capabilities to deploy a dedicated forensic/triage tool (e.g., KAPE, Magnet RESPONSE) to the device and pull the resulting collection back through the console — MDE does not have a single native 'forensic' command that produces a full raw disk image on its own. Regardless, of the four choices, only Defender for Endpoint provides device-level forensic acquisition capability; BitLocker Administration and Monitoring only manages encryption keys, Microsoft Entra ID is identity-only, and Intune is a management/configuration plane with no forensic collection feature.

Answer

Microsoft BitLocker Administration and Monitoring

Answer

Microsoft Entra ID

Answer

Microsoft Intune

Question 15

A security analyst uses Microsoft Sentinel to investigate an incident involving data exfiltration from Azure Blob Storage. The analyst needs to determine which user accessed the storage account and from which IP address. Which data source should the analyst query?

Accepted Answer

Azure Activity logs. Azure Activity logs storage account management events, including access logs. Option A is wrong because Microsoft Entra ID sign-in logs only show authentication to Microsoft Entra ID, not storage access. Option C is wrong because Azure Monitor metrics are aggregated and don't show per-user access. Option D is wrong because Azure Security Center provides security recommendations, not access logs.

Answer

Azure AD sign-in logs

Answer

Azure Security Center alerts

Answer

Azure Monitor metrics