SC-200 Respond to security incidents Practice Test 9 — 15 Questions

Question 1

Refer to the exhibit. You are configuring an automation rule in Microsoft Sentinel. The JSON snippet defines an automation rule. What is the expected behavior of this rule?

Accepted Answer

It runs a playbook to quarantine an email when a specific alert is generated. The automation rule is triggered when a specific alert is generated (as defined by the trigger condition), and it runs a playbook that contains logic to quarantine an email. In Microsoft Sentinel, automation rules can be configured to trigger on alert creation and execute a playbook, which in this case performs the quarantine action.

Answer

It creates an incident when a phishing email is detected

Answer

It sends an email to the security team when an incident is created

Answer

It modifies the incident severity when a playbook runs

Question 2

A SOC analyst receives an alert from Microsoft Defender for Cloud Apps indicating that a user downloaded 500 GB of data from SharePoint to an unmanaged device. The user has no history of such behavior. What is the best first step in the incident response process?

Accepted Answer

Disable the user account in Microsoft Entra ID.. The immediate priority in an incident response process for a potential data exfiltration scenario is to contain the threat. Disabling the user account in Microsoft Entra ID (formerly Azure AD) is the fastest way to revoke access to SharePoint and other cloud resources, preventing further unauthorized data transfer. This aligns with the 'containment' phase of the NIST incident response lifecycle, before any investigation or remediation steps.

Answer

Run a full antivirus scan on the unmanaged device.

Answer

Contact the user to verify if the download was intentional.

Answer

Create a detection rule for similar behavior in Microsoft Sentinel.

Question 3

During an incident investigation, you find that a compromised account was used to log into a virtual machine via RDP from an IP address in a sanctioned country. The VM has Microsoft Defender for Endpoint installed. Which data source in Microsoft Sentinel would you query to see the RDP connection events?

Accepted Answer

SecurityEvent. The SecurityEvent table in Microsoft Sentinel collects Windows security events from machines with the Log Analytics agent or Azure Monitor Agent, including Event ID 4625 (failed logon) and Event ID 4624 (successful logon). Since the compromised account used RDP to log into a VM with Defender for Endpoint installed, the RDP connection events are captured as Windows security log events and stored in the SecurityEvent table. This is the correct data source for querying local authentication events on the VM itself.

Answer

DeviceLogonEvents (Microsoft Defender XDR)

Answer

CommonSecurityLog

Answer

SigninLogs (Microsoft Entra ID)

Question 4

You have been tasked with creating an automated response in Microsoft Sentinel for incidents involving lateral movement. Which Azure service allows you to run a playbook to automatically isolate a compromised VM?

Accepted Answer

Azure Logic Apps. Azure Logic Apps is the correct answer because it provides the workflow automation engine that powers Microsoft Sentinel playbooks. When a lateral movement incident is detected, a Logic Apps-based playbook can execute automated actions such as isolating a compromised VM via Azure Network Security Groups (NSGs) or Azure Firewall rules, using connectors like the Azure VM or Azure Resource Manager. This enables a no-code or low-code response directly from Sentinel without manual intervention.

Answer

Kusto Query Language (KQL)

Answer

Microsoft Defender XDR advanced hunting

Answer

Azure Event Hubs

Question 5

Which TWO actions should you take when handling a confirmed ransomware incident in an environment protected by Microsoft Defender for Endpoint?

Accepted Answer

Block the ransomware file hash using threat intelligence indicators in Microsoft Defender.. Blocking the ransomware file hash via threat intelligence indicators in Microsoft Defender for Endpoint (MDE) immediately prevents further execution of that known malicious file across all endpoints in the environment, leveraging the built-in TI indicator feature. Option B is correct because initiating device isolation from the MDE console disconnects the affected device from the network while maintaining connectivity to the MDE service, containing the spread of ransomware without losing visibility or control.

Answer

Disable Windows Defender real-time protection.

Answer

Submit the ransomware sample to Microsoft for analysis.

Answer

Reimage all affected servers immediately.

Question 6

Which TWO components are required to enable automated investigation and response (AIR) in Microsoft Defender for Office 365?

Accepted Answer

Microsoft Defender for Endpoint integration. Automated investigation and response (AIR) in Microsoft Defender for Office 365 requires two components: Option A (Microsoft Defender for Endpoint integration) enables correlation between email threats and endpoint telemetry, and Option D (Office 365 Advanced Threat Protection Plan 2) provides the automation capabilities including playbooks and incident response workflows. Attack simulation training (B) is not a prerequisite; it is a separate tool for user awareness. The other options are not required: Microsoft Defender for Cloud Apps (C) is a different service, and Microsoft Entra ID P2 (E) is not needed for AIR in Defender for Office 365.

Answer

Attack simulation training

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Entra ID P2 license

Question 7

Which TWO are legitimate sources of threat intelligence that can be ingested into Microsoft Sentinel?

Accepted Answer

STIX/TAXII threat intelligence feeds. A is correct because STIX/TAXII is an open-source standard for sharing cyber threat intelligence (CTI). Microsoft Sentinel can ingest threat indicators from any TAXII 2.0 or 2.1 server using the built-in Threat Intelligence - TAXII data connector, allowing organizations to consume structured threat feeds (e.g., from MITRE ATT&CK or third-party providers) directly into Sentinel for correlation and alerting.

Answer

Exchange Online Protection

Answer

Microsoft Intune

Answer

Microsoft Purview Compliance Manager

Question 8

Refer to the exhibit. The KQL query is used in a Microsoft Sentinel scheduled alert rule. What scenario does this query detect?

Accepted Answer

Attempts to sign in with disabled user accounts.. The KQL query filters for `ResultType == 50057`, which specifically indicates a sign-in attempt by a disabled user account in Azure AD. This result type is unique to disabled accounts and does not cover MFA denials (53003), invalid password attempts (50126), or brute force patterns. Therefore, the query detects attempts to sign in with disabled user accounts.

Answer

Multiple MFA denial events from a single user.

Answer

Brute force attacks against Azure AD accounts using invalid passwords.

Answer

Brute force attacks from a single IP address against multiple accounts.

Question 9

Refer to the exhibit. This is a snippet from an automation rule in Microsoft Sentinel. What is the purpose of the 'RunQuery' action?

Accepted Answer

To retrieve sign-in logs for the user involved in the incident.. The 'RunQuery' action in Microsoft Sentinel automation rules executes a Kusto Query Language (KQL) query against the Log Analytics workspace. In this context, it retrieves sign-in logs for the user involved in the incident, enabling automated enrichment of incident data with relevant authentication details. This is a common pattern for gathering additional evidence without manual investigation.

Answer

To automatically update the incident status to 'Active'.

Answer

To run a PowerShell script on the affected endpoint.

Answer

To trigger a playbook that isolates the user's device.

Question 10

An incident in Microsoft Sentinel has been classified as a true positive. According to the incident response process, what should the analyst do next?

Accepted Answer

Contain the incident to prevent further damage.. After classifying an incident as a true positive in Microsoft Sentinel, the immediate next step in the incident response process is to contain the incident to prevent further damage or lateral movement. This aligns with the NIST SP 800-61 incident response lifecycle, where containment follows identification and classification. In Sentinel, containment actions might involve disabling compromised accounts, blocking IPs via Azure Firewall, or isolating affected resources using Microsoft Defender for Cloud or Azure policies.

Answer

Perform a root cause analysis.

Answer

Create a new analytic rule to detect similar activity.

Answer

Document the incident in a detailed report.

Question 11

During an investigation, you need to check if any user has been assigned privileged roles in Microsoft Entra ID outside of normal business hours. Which data source would provide this information?

Accepted Answer

AuditLogs (Microsoft Entra ID). AuditLogs in Microsoft Entra ID (formerly Azure AD) capture all directory-level changes, including privileged role assignments (e.g., Global Administrator, Privileged Role Administrator) along with the timestamp and user who performed the action. This allows you to filter for role assignments occurring outside normal business hours, making it the correct data source for this investigation.

Answer

OfficeActivity (Office 365)

Answer

SecurityEvent (Windows Event Logs)

Answer

SigninLogs (Microsoft Entra ID)

Question 12

You receive an incident in Microsoft Sentinel that is a low-confidence alert from Microsoft Defender for Identity. What should be your first step?

Accepted Answer

Investigate the alert by reviewing related entities and logs.. A low-confidence alert from Microsoft Defender for Identity indicates a potential but uncertain threat. The first step should always be to investigate the alert by reviewing related entities and logs to gather context and determine if the alert is a true positive or false positive. Prematurely closing, escalating, or isolating without investigation risks missing a real threat or causing unnecessary disruption.

Answer

Close the incident as a false positive.

Answer

Escalate to senior management.

Answer

Isolate the affected account immediately.

Question 13

After a security incident, you need to collect forensic evidence from a Windows 10 machine. Which Microsoft tool should you use to create a memory dump?

Accepted Answer

Microsoft Defender for Endpoint Live Response. Microsoft Defender for Endpoint Live Response provides a `dump` command that can capture a full memory dump from a live Windows 10 system without causing a crash. This preserves volatile forensic evidence such as running processes, network connections, and encryption keys. In contrast, the Microsoft Crash Dump Tool (NotMyFault or Sysinternals) is designed to trigger a system crash (BSOD) for debugging purposes, which is destructive and not appropriate for forensic collection. Therefore, for a security incident requiring a memory dump without system disruption, Live Response is the correct tool.

Answer

Remote Desktop Protocol (RDP)

Answer

Microsoft Crash Dump Tool (e.g., NotMyFault or Sysinternals tools)

Answer

Microsoft Defender for Cloud Apps

Question 14

Refer to the exhibit. This JSON snippet is from an Azure Web Application Firewall (WAF) policy. What does this rule do?

Accepted Answer

Blocks traffic originating from IP address 10.0.0.1.. The JSON snippet defines a WAF rule with a match condition that checks if the client IP address equals 10.0.0.1. The action is set to 'Block', meaning any request from that specific IP address will be denied. Option B correctly identifies this behavior.

Answer

Blocks traffic from the entire 10.0.0.0/24 subnet.

Answer

Logs traffic from IP address 10.0.0.1 without blocking.

Answer

Allows traffic from IP address 10.0.0.1.

Question 15

You are responding to an incident where a user's credentials were stolen via a phishing email. The attacker used the credentials to access Microsoft Entra ID and then tried to perform privileged role escalation. Which Microsoft Sentinel solution should you use to detect this type of attack?

Accepted Answer

UEBA (User and Entity Behavior Analytics). UEBA (User and Entity Behavior Analytics) is the correct solution because it uses machine learning to establish baseline behavioral patterns for users and entities, then detects anomalies such as a user logging in from an unusual location and immediately attempting privileged role escalation. This directly identifies the credential theft and privilege escalation chain described in the incident, whereas other options focus on network traffic, generic syslog ingestion, or threat intelligence matching, which would not catch the behavioral anomaly of a stolen credential being used for role escalation.

Answer

Network Security Group flow logs

Answer

Syslog data connector

Answer

Threat intelligence connectors