SC-200 Respond to security incidents Practice Test 9 — 15 Questions

Question 1

During an incident response, a security engineer needs to block an attacker's IP address at the network level for all devices in the organization. The organization uses Microsoft Defender for Endpoint and Microsoft Intune for device management. What is the most efficient way to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a custom indicator (IOC) for the IP address in Microsoft Defender for Endpoint. Creating a custom indicator (IOC) for the IP address in Microsoft Defender for Endpoint is the most efficient way to block the IP across all devices managed by Defender. IOCs are enforced by Defender's security intelligence and can block network connections, files, or processes organization-wide. This leverages the existing Defender deployment without additional infrastructure.

Answer

Add the IP address to a blocklist in Microsoft Sentinel

Answer

Create a device configuration policy in Microsoft Intune to block the IP

Answer

Configure Azure Firewall to block the IP

Question 2

Which TWO actions should a security analyst take to contain a ransomware outbreak on a Windows server that has Microsoft Defender for Endpoint installed?

Accepted Answer

Run a full scan with Microsoft Defender Antivirus. Option C is correct because initiating device isolation in Microsoft Defender for Endpoint immediately cuts the compromised server off from the network while still allowing Defender's own management and remediation channel, which stops lateral spread and further encryption activity during containment. Option A is correct because running a full scan with Microsoft Defender Antivirus detects and removes the ransomware binaries, malicious scripts, and persistence artifacts on the host, which is a necessary containment/remediation step after isolating the device. Option B is not appropriate here because resetting the local administrator password does not stop an active ransomware process and is a credential-hardening action rather than containment. Option D is wrong because uninstalling and reinstalling Defender for Endpoint removes the very telemetry and response capability needed to contain the outbreak and is not a valid containment action. Option E is wrong because restoring from backup is a recovery action performed after containment and eradication, not a containment step, and restoring too early could reintroduce the infection.

Answer

Reset the local administrator password

Answer

Uninstall Microsoft Defender for Endpoint and reinstall

Answer

Restore the system from a backup

Question 3

Which TWO options are valid ways to create an incident in Microsoft Sentinel?

Accepted Answer

From an alert generated by an analytics rule. Options B and E are correct. Analytics rules generate alerts that become incidents automatically when configured. Microsoft Defender XDR incidents are synchronized to Sentinel by default (or via connector). Option A is wrong because workbooks are read-only visualizations, not incident creation tools. Option C is wrong because watchlists are used for enrichment and correlation, not to create incidents. Option D is wrong because hunting queries only surface results; incidents must be created manually from them.

Answer

By creating a workbook

Answer

By importing data from a watchlist

Answer

By running a hunting query

Question 4

Your organization has Microsoft Sentinel deployed in a central Log Analytics workspace. You have a custom analytics rule that detects brute-force attacks against Azure AD by counting failed sign-ins from the same IP address within 5 minutes. The rule currently generates an incident for every 10 failed attempts. During a recent incident, a single IP address generated over 200 failed sign-ins in 10 minutes, resulting in 20 separate incidents. The SOC team is overwhelmed and wants to reduce the number of incidents without lowering the detection threshold. You need to modify the rule to generate only one incident per IP address within a 1-hour window. What should you do?

Accepted Answer

Modify the analytics rule to group alerts by IP address with a 1-hour window. Grouping alerts by IP address with a 1-hour window is the correct approach because Microsoft Sentinel analytics rules support 'event grouping' configuration, which aggregates multiple alerts matching the same entity (such as an IP address) into a single incident within a defined time window. This preserves the detection threshold (10 failed attempts) while consolidating the resulting incidents, directly addressing the SOC's need to reduce incident volume without weakening detection.

Answer

Enable alert suppression in the analytics rule for 1 hour

Answer

Create a new analytics rule that triggers only when failed sign-ins exceed 200 in 5 minutes

Answer

Create an automation rule that closes duplicate incidents from the same IP

Question 5

Your organization uses Microsoft Sentinel. An incident with severity Medium is created from an analytics rule that detects brute-force attempts against on-premises domain controllers. The incident contains alerts from multiple machines. You need to automatically run a playbook that collects evidence from affected machines and then changes the incident severity to High. What should you configure?

Accepted Answer

Create an automation rule that triggers on incident creation with severity Medium, runs the playbook, and then changes severity to High.. An automation rule in Microsoft Sentinel can trigger on incident creation, run a playbook, and then change the incident severity. Automation rules support conditions (severity = Medium) and actions including 'Run playbook' and 'Change severity', making them the correct mechanism to orchestrate the response and update severity in one flow. This satisfies both the evidence collection and severity escalation requirements.

Answer

Configure the incident creation settings to enrich the incident with the playbook output.

Answer

Modify the analytics rule to include the playbook as an automated response.

Answer

Edit the playbook to include a step that changes incident severity after collecting evidence.

Question 6

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. An incident in Microsoft Defender XDR is automatically synchronized to Microsoft Sentinel. The incident in Sentinel is closed by the SOC team, but the corresponding incident in Defender remains open. What should you do to ensure that closing an incident in Sentinel also closes its linked incident in Defender?

Accepted Answer

Configure an automation rule in Microsoft Sentinel that triggers on incident closure and runs a playbook that closes the corresponding incident in Microsoft Defender XDR.. Microsoft Sentinel and Defender XDR incidents are linked but not bi-directionally synchronized for status changes by default. To close the Defender incident when the Sentinel incident closes, you must build an automation rule in Sentinel that triggers on incident closure and runs a playbook (Logic App) calling the Defender XDR API to update the linked incident. This is the documented approach for one-way status propagation.

Answer

In the Microsoft Defender XDR portal, enable the setting to automatically close incidents when the linked Sentinel incident is closed.

Answer

Use the Microsoft Defender XDR API to set up a webhook that listens for Sentinel incident closure.

Answer

Enable the bi-directional sync in the Microsoft Sentinel data connector for Microsoft Defender XDR.

Question 7

Your organization uses Microsoft Sentinel. You need to design a solution that automatically responds to incidents with severity High and enriches them with threat intelligence from Microsoft Defender Threat Intelligence. Which TWO actions should you include?

Accepted Answer

Create an automation rule that triggers when an incident is created with severity High and runs a playbook to enrich the incident with threat intelligence.. Option A is correct because Microsoft Sentinel automation rules are the native mechanism for triggering conditional responses based on incident attributes such as severity, and they can invoke a playbook (Logic App) that enriches the incident with Microsoft Defender Threat Intelligence. Option E is correct because automation rules support multiple actions, including changing incident severity, so after the playbook enriches the incident you can add an action to update the severity as part of the automated response workflow. Option B is incorrect because automation rules cannot modify an analytics rule's KQL query; threat intelligence enrichment is applied to incidents, not by rewriting detection queries. Option C is incorrect because playbooks are not run directly from analytics rules in that manner; automation rules (or the analytics rule's automated response setting) invoke playbooks, and the scenario specifically calls for an automation rule. Option D is incorrect because the analytics rule's incident configuration can trigger a playbook but does not provide the conditional severity-based automation rule logic required here, and it is not the mechanism that performs the enrichment action described.

Answer

Set the automation rule to modify the analytics rule's query to include threat intelligence.

Answer

Configure the playbook to run directly from the analytics rule that generates the incident.

Answer

Use the analytics rule's incident configuration to automatically run the playbook.

Question 8

A SOC analyst in your organization is investigating an incident in Microsoft Defender XDR that involves a compromised user account. The analyst needs to gather more information about the user's recent activities. Which THREE actions can the analyst take directly from the incident page?

Accepted Answer

Run an advanced hunting query related to the user.. From the Microsoft Defender XDR incident page, an analyst can pivot directly into investigation actions for a compromised user. Option A is correct because the incident page provides a link to Go hunt, which opens Advanced hunting with a pre-populated KQL query scoped to the affected user, allowing the analyst to search raw telemetry across Defender XDR workloads. Option B is correct because the incident page exposes the ability to run a playbook (via the Action center / automated investigation and response integration with Microsoft Sentinel or Power Automate), letting the analyst trigger a predefined investigation workflow against the user. Option C is correct because the incident page includes a user entity page with an activity timeline that aggregates the user's related alerts, events, and sign-ins for review. Option D is not correct because deleting a user account is an identity-management action performed in Microsoft Entra ID (or via Graph/Entra admin center), not a direct action on the Defender XDR incident page. Option E is not correct because resetting a password is likewise an Entra ID administrative action and is not offered as a direct incident-page action in Defender XDR.

Answer

Delete the user account.

Answer

Reset the user's password directly from the incident.

Question 9

Your organization uses Microsoft Sentinel. You are investigating an incident that involves multiple alerts. Which TWO actions can you perform from the incident details page to consolidate the investigation?

Accepted Answer

Create a bookmark to capture relevant evidence.. Option A is correct because creating a bookmark from the incident details page lets you capture specific query results, entities, or investigation findings as evidence and attach them to the incident, which consolidates the investigative context in one place. Option C is correct because Microsoft Sentinel allows you to add related alerts (from the same or other incidents) to an existing incident, grouping them so they are triaged and investigated together as a single consolidated case. Deleting alerts (B) is not a consolidation action and would destroy investigative data rather than group it. Creating a new playbook (D) is an automation/response task, not a way to consolidate alerts into the incident. Modifying the analytics rule (E) changes future detection behavior and does not consolidate the current investigation.

Answer

Delete alerts that are not relevant.

Answer

Create a new playbook from the incident page.

Answer

Modify the analytics rule that generated the incident.

Question 10

Your organization uses Microsoft Sentinel and has deployed the Microsoft Defender XDR connector. You notice that some incidents from Defender XDR are not being synchronized to Sentinel. You verify that the connector is enabled and healthy. You also check that the relevant Defender XDR alerts are being generated. What could be the cause of the missing incidents?

Accepted Answer

The Microsoft Defender XDR connector has a filter that only syncs incidents with severity High or Medium, and the missing incidents are Low severity.. The Microsoft Defender XDR connector in Microsoft Sentinel has a built-in filter that only syncs incidents with severity High or Medium by default. Low severity incidents are not synchronized unless the filter is adjusted. Since the connector is healthy and alerts are generated, the missing incidents are likely Low severity and thus filtered out.

Answer

The Microsoft Defender XDR connector is configured to group alerts by entity, which prevents individual incidents from being created.

Answer

The diagnostic settings in Microsoft Defender XDR are not configured to send incidents to Sentinel.

Answer

The data connector is set to ingestion mode 'Raw data' instead of 'Incidents'.

Question 11

Fabrikam has a hybrid environment with on-premises Active Directory synced to Microsoft Entra ID. They use Microsoft Sentinel and Microsoft Defender XDR. A critical incident is opened: 'Credential theft detected - domain admin account compromised.' The incident includes alerts from Microsoft Defender for Identity (MDI) showing anomalous Kerberos ticket requests and from Microsoft Defender for Endpoint showing a process dump on a domain controller. You need to contain the incident immediately. The organization has a strict policy of not disabling the domain admin account without approval due to critical dependencies. Which of the following is the BEST course of action?

Accepted Answer

Reset the krbtgt account password twice to force Kerberos ticket invalidation.. Resetting the krbtgt account password twice is the best course of action because it invalidates all Kerberos tickets in the domain, effectively containing the credential theft without disabling the domain admin account. This addresses the compromised domain admin's ability to use Kerberos tickets, including golden tickets, while respecting the policy against disabling the account.

Answer

Reset the domain admin password and revoke sessions in Microsoft Entra ID.

Answer

Disable the domain admin account temporarily.

Answer

Isolate the domain controller using Microsoft Defender for Endpoint.

Question 12

Your company uses Microsoft Sentinel with the Microsoft Defender XDR connector. You receive an incident: 'Suspicious mailbox forwarding rule created.' The incident indicates that a user's mailbox in Exchange Online has a forwarding rule to an external email address. The user's account shows no other suspicious activity. You need to respond to the incident. The company policy requires preserving evidence for 30 days. Which action should you take FIRST?

Accepted Answer

Remove the mailbox forwarding rule.. The first action should be to remove the mailbox forwarding rule to immediately stop the potential data exfiltration. The incident indicates a suspicious forwarding rule to an external address, which is a common attacker technique for data theft. While preserving evidence is required, the immediate threat must be mitigated first. Other actions like resetting password or blocking domain can follow, but removing the rule is the most direct response to the incident.

Answer

Run an automated playbook to collect additional evidence.

Answer

Reset the user's password and require MFA.

Answer

Block the external email domain in Exchange Online.

Question 13

Contoso uses Microsoft Sentinel with the Microsoft Defender for Cloud Apps connector. An incident is generated: 'Unusual file download by user - possible data exfiltration.' The incident shows that a user downloaded 500 files from SharePoint Online within 10 minutes, which is abnormal for that user. The user's account shows no other suspicious activity. You need to respond. Which of the following is the BEST first action?

Accepted Answer

Suspend the user account in Microsoft Entra ID.. Suspending the user account in Microsoft Entra ID immediately stops any further downloads and prevents potential data exfiltration. Option A is wrong: blocking SharePoint Online for all users is too disruptive and may not be necessary. Option B is wrong: creating an anomaly detection policy is a long-term improvement, not an immediate response. Option D is wrong: investigating logs is important but should be done after stopping the active threat.

Answer

Block SharePoint Online access for all users temporarily.

Answer

Create an anomaly detection policy for such downloads.

Answer

Investigate the user's recent activity logs.

Question 14

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You receive an incident: 'Malicious PowerShell command executed on endpoint.' The incident shows that a PowerShell command was executed on a server that attempted to download a payload from a known malicious IP. The process was terminated by MDE, but the server may still be compromised. You need to respond to the incident. Which of the following actions should you take FIRST?

Accepted Answer

Isolate the server using Microsoft Defender for Endpoint.. The server executed a malicious PowerShell command that attempted to download a payload from a known malicious IP, and although MDE terminated the process, the host may still be compromised. The first priority in incident response is containment, and isolating the endpoint via Microsoft Defender for Endpoint immediately prevents further command-and-control, lateral movement, or additional payload downloads while investigation proceeds.

Answer

Run a Microsoft Sentinel playbook to collect forensic data.

Answer

Reset the local administrator password on the server.

Answer

Block the malicious IP address at the firewall.

Question 15

Fabrikam uses Microsoft Sentinel, Microsoft Defender XDR, and Microsoft Purview Compliance Manager. An incident is generated: 'Insider risk - user deleting large volumes of files from SharePoint Online.' The incident is from Microsoft Purview Insider Risk Management. The user is a senior executive, and disabling the account is not an option without board approval. You need to contain the data deletion. Which of the following is the BEST immediate action?

Accepted Answer

Apply a retention hold to the user's OneDrive and SharePoint sites.. The best immediate action because applying a retention hold to the user's OneDrive and SharePoint sites preserves the data from deletion without affecting the user's access, which is important for a senior executive. Option A is incorrect: removing permissions may not stop deletion if the user is the owner, and it disrupts work. Option B is incorrect: blocking access in Entra ID disrupts work and may require board approval. Option D is incorrect: creating a DLP policy does not stop current deletion, only prevents future occurrences.

Answer

Remove the user's permissions to the SharePoint sites.

Answer

Block the user's access in Microsoft Entra ID temporarily.

Answer

Create a DLP policy to block deletion of files.