SC-200 Respond to security incidents Practice Test 8 — 15 Questions

Question 1

A security analyst is investigating a Microsoft Defender for Cloud Apps alert about a suspicious OAuth app that has high permissions. The analyst needs to disable the app immediately. What is the correct action?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

From the Microsoft Defender for Cloud Apps alert, select 'Disable app'.. Microsoft Defender for Cloud Apps provides a built-in 'Disable app' action directly from the alert, which immediately revokes the OAuth app's permissions and prevents further access without deleting the app registration. This is the fastest way to mitigate the threat while preserving the app for potential forensic analysis.

Answer

Revoke all tokens for the app in Microsoft Entra ID.

Answer

Generate a new client secret for the app.

Answer

Go to Microsoft Entra ID admin center and delete the app registration.

Question 2

A SOC analyst is using Microsoft Sentinel to respond to an incident involving multiple compromised user accounts. The analyst needs to quickly see the timeline of all related events. Which feature should the analyst use?

Accepted Answer

Incident timeline.. The Incident timeline (option D) is the correct feature because it provides a chronological view of all events, alerts, and actions associated with a specific incident in Microsoft Sentinel. This allows the SOC analyst to quickly see the sequence of events related to the compromised user accounts without navigating away from the incident investigation page.

Answer

Entity behavior page.

Answer

Analytics rule page.

Answer

Workbook.

Question 3

A security analyst in your organization receives an alert from Microsoft Defender for Cloud Apps indicating that a user has installed a third-party app with high permissions in Microsoft 365. The analyst suspects a consent phishing attack. Which playbook in Microsoft Sentinel should the analyst use to automate the investigation and remediation?

Accepted Answer

Automation rule. The correct playbook to use for automating investigation and remediation of a suspected consent phishing attack is an Automation rule. In Microsoft Sentinel, an Automation rule can be configured to trigger specific actions, such as revoking permissions or isolating accounts, based on alerts like those from Microsoft Defender for Cloud Apps. This allows for automated response without manual intervention.

Answer

Hunting query

Answer

Entity page

Answer

Workbook

Question 4

You are responding to a ransomware incident in Microsoft Defender XDR. You have identified that the malware encrypted files on several devices and then deleted the volume shadow copies. Which of the following actions should you take first to contain the incident?

Accepted Answer

Isolate affected devices using Microsoft Defender for Endpoint. Isolating affected devices using Microsoft Defender for Endpoint is the correct first action because it immediately cuts off network communication, preventing the ransomware from spreading laterally to other devices and stopping further encryption or deletion of shadow copies. Containment must precede remediation to limit the blast radius, and Defender for Endpoint's device isolation feature achieves this at the network level without requiring physical disconnection.

Answer

Run a remediation action to delete the detected malware

Answer

Restore encrypted files from backup

Answer

Run a full antivirus scan on all devices

Question 5

Your organization uses Microsoft Sentinel and Microsoft Defender for Cloud. You receive an alert from Defender for Cloud indicating that a virtual machine has a high severity vulnerability (CVE-2023-XXXX). You need to create an incident in Microsoft Sentinel and trigger a playbook to remediate the vulnerability. However, the incident is not being created automatically. What is the most likely cause?

Accepted Answer

The Microsoft Defender for Cloud connector in Microsoft Sentinel is not enabled or misconfigured. The Microsoft Defender for Cloud connector in Microsoft Sentinel is the bridge that forwards security alerts from Defender for Cloud to Sentinel. If this connector is not enabled or is misconfigured, Defender for Cloud alerts—including vulnerability alerts for VMs—will never reach Sentinel, so no incident can be created automatically. Without the connector, the data source is disconnected, and Sentinel has no trigger to generate an incident or invoke a playbook.

Answer

An analytics rule with a matching severity threshold has not been created

Answer

The free trial of Microsoft Sentinel has expired

Answer

The playbook does not have the correct permissions on the target VM

Question 6

Your organization uses Microsoft Defender for Identity. You receive an alert about a suspicious Kerberos activity that may indicate a golden ticket attack. Which of the following actions should you take to investigate this alert?

Accepted Answer

Review the alert details in the Microsoft Defender for Identity portal and analyze related events. The first step in investigating a golden ticket attack alert from Microsoft Defender for Identity is to review the alert details and analyze the related events within the Defender for Identity portal. This allows you to understand the scope of the suspicious Kerberos activity, identify the affected accounts, and correlate the alert with other security signals before taking any remediation actions.

Answer

Immediately reset the krbtgt account password twice

Answer

Export the Active Directory event logs to Microsoft Sentinel for analysis

Answer

Disable the user account that triggered the alert

Question 7

Your organization uses Microsoft Sentinel with the UEBA (User and Entity Behavior Analytics) feature enabled. A security analyst notices that a user account has been flagged with an anomaly indicating a possible compromised credential. Which entity type in Microsoft Sentinel's UEBA is most relevant for this alert?

Accepted Answer

User account. The UEBA anomaly alert for a possible compromised credential is specifically tied to the User account entity because UEBA profiles user behavior over time and detects deviations from established baselines, such as unusual logon times, locations, or impossible travel. The alert directly reflects a risk to the user's identity, making the User account the most relevant entity type for this scenario.

Answer

Device

Answer

Application

Answer

IP address

Question 8

Your organization has deployed Microsoft Sentinel and uses the Microsoft 365 connector to ingest audit logs. You receive an alert from Microsoft Defender for Office 365 about a phishing email that was delivered to a user's inbox. You need to create an incident in Sentinel and automatically quarantine the email. What is the most efficient way to achieve this?

Accepted Answer

Create an automation rule in Microsoft Sentinel that is triggered when this specific alert is generated, and associate a playbook that uses the Microsoft 365 Defender connector to quarantine the email. Automation rules in Microsoft Sentinel can be triggered by specific alert generation (e.g., from Microsoft Defender for Office 365) and can execute a playbook. The playbook uses the Microsoft 365 Defender connector, which includes the 'Quarantine email' action, enabling automated quarantine without manual intervention. This is the most efficient method as it combines automatic incident creation with immediate remediation.

Answer

Use Microsoft Defender for Cloud Apps to investigate the alert and manually quarantine the email

Answer

Create a custom analytics rule that triggers when an alert is generated, and configure the rule to run a playbook that quarantines the email

Answer

Manually create an incident in Microsoft Sentinel and then run a playbook to quarantine the email

Question 9

Your organization uses Microsoft Defender for Cloud to protect hybrid cloud workloads. An alert indicates that a container in Azure Kubernetes Service (AKS) is running a privileged container. Which response action should you take first?

Accepted Answer

Investigate the alert details in Microsoft Defender for Cloud. When a Microsoft Defender for Cloud alert indicates a privileged container in AKS, the first response action should be to investigate the alert details within Defender for Cloud. This allows you to assess the scope, impact, and context of the alert—such as which container, namespace, and pod is involved, and whether it is a false positive—before taking any disruptive remediation steps. Prematurely disabling, deleting, or restarting resources could destroy forensic evidence and escalate the incident unnecessarily.

Answer

Disable the container immediately

Answer

Restart the AKS cluster

Answer

Delete the container and its image

Question 10

Your organization has Microsoft Defender for Endpoint deployed. A security analyst receives an alert about a suspicious PowerShell command executed on a device. The analyst needs to investigate the process tree. Which feature should the analyst use?

Accepted Answer

Timeline (process timeline). The Timeline (process timeline) feature in Microsoft Defender for Endpoint allows analysts to view the full process tree, including parent-child relationships, command lines, and timestamps for events like PowerShell execution. This is the correct tool for investigating how a suspicious command was launched and what processes preceded it.

Answer

Device isolation

Answer

Live response

Answer

Advanced hunting

Question 11

Your organization uses Microsoft Sentinel and has enabled the Microsoft 365 Defender connector. You want to automatically assign incidents to a specific analyst team based on the incident severity and type. Which component should you configure?

Accepted Answer

Automation rule in Microsoft Sentinel. Automation rules in Microsoft Sentinel allow you to automatically assign incidents to specific teams based on conditions like severity and type. This is the correct component because it provides a no-code, rule-based engine for incident management tasks, including assignment, without requiring custom logic or external automation.

Answer

Analytics rule in Microsoft Sentinel

Answer

Workbook in Microsoft Sentinel

Answer

Custom playbook in Microsoft Sentinel

Question 12

Which TWO of the following are valid response actions that can be taken on a device from Microsoft Defender for Endpoint? (Choose two.)

Accepted Answer

Run antivirus scan. Microsoft Defender for Endpoint includes a 'Run antivirus scan' response action that initiates a Microsoft Defender Antivirus scan on the device. This action can be triggered from the Microsoft 365 Defender portal to detect and remediate malware or suspicious files without requiring user interaction.

Answer

Quarantine email

Answer

Disable user account

Answer

Reset user password

Question 13

Which THREE of the following are valid incident management capabilities in Microsoft Sentinel? (Choose three.)

Accepted Answer

Assign incidents to analysts or teams. A is correct because Microsoft Sentinel allows incident owners to be assigned directly to an analyst or a team via the 'Owner' field in the incident details pane. This assignment is used for tracking responsibility, SLA enforcement, and escalation workflows within the Security Operations (SecOps) lifecycle.

Answer

Create playbooks to automate incident response

Answer

Create workbooks to visualize incident trends

Question 14

Which TWO of the following are valid sources for creating incidents in Microsoft Sentinel? (Choose two.)

Accepted Answer

Microsoft 365 Defender alerts. Microsoft 365 Defender alerts are a valid source for creating incidents in Microsoft Sentinel because Sentinel can ingest alerts from Microsoft 365 Defender (which includes Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps) via the Microsoft 365 Defender connector. When these alerts are ingested, Sentinel can automatically create incidents based on them, enabling unified incident management across the Microsoft security ecosystem.

Answer

Hunting query results

Answer

Workbook creation

Answer

Playbook execution

Question 15

Refer to the exhibit. You are investigating incidents related to suspicious process injection. The KQL query above is run in Microsoft Sentinel. What is the purpose of this query?

Accepted Answer

To get a count of 'Suspicious process injection' alerts grouped by compromised entity and severity, sorted by count. The query uses `summarize` with `count()` to aggregate alerts by `CompromisedEntity` and `Severity`, then sorts by the count in descending order. This directly produces a count of 'Suspicious process injection' alerts grouped by compromised entity and severity, sorted by count. The `where` clause filters for the specific alert name, and the time range is implicitly the last 7 days (as shown in the exhibit's query editor).

Answer

To find alerts that occurred within a specific time range

Answer

To list all alerts of type 'Suspicious process injection' in the last 7 days

Answer

To identify the compromised entities with the highest severity alerts