Courseiva

CCNA Respond to security incidents Questions

18 questions · Respond to security incidents · All types, answers revealed

Practice these questionsDomain overviewAll questions
1
MCQmedium

A Microsoft Defender for Endpoint alert indicates that a device has been communicating with a known command-and-control (C2) server. The device is critical for production. What is the most appropriate response?

A.Disconnect the network cable of the device.
B.Run a full antivirus scan on the device.
C.Block the C2 server URL in the firewall.
D.Isolate the device using Microsoft Defender for Endpoint's device isolation feature.
AnswerD

Isolating the device with Microsoft Defender for Endpoint's device isolation feature is the correct initial response because it severs all inbound and outbound communication except to the Defender service, immediately containing the threat while keeping the device powered on. When forensic preservation mode is enabled, the device remains in a state that preserves volatile evidence and prevents file system changes, allowing security analysts to investigate the compromise, collect artifacts, and remediate without losing critical data—all through a centrally managed, reversible action.

Why this answer

Microsoft Defender for Endpoint's device isolation feature is designed to contain a compromised device while preserving forensic data and minimizing disruption. For a critical production device, full isolation (blocking all network traffic except to the Defender service) stops C2 communication without physically disconnecting the device, allowing the security team to investigate and remediate remotely.

Exam trap

The trap here is that candidates often choose 'Block the C2 server URL in the firewall' (Option C) because it seems like a quick network fix, but they fail to recognize that the device itself is already compromised and must be contained at the endpoint level to prevent lateral movement or data exfiltration.

How to eliminate wrong answers

Option A is wrong because physically disconnecting the network cable is a brute-force containment that may cause abrupt service disruption, loss of remote management, and potential data corruption on a critical production device; it also prevents the security team from performing remote investigation or applying updates. Option B is wrong because running a full antivirus scan is a detection and remediation step, not a containment action; it does not stop active C2 communication and may allow the attacker to exfiltrate data or execute further commands during the scan. Option C is wrong because blocking the C2 server URL in the firewall only prevents future connections to that specific URL, but the device may still be compromised and could communicate with other C2 endpoints or use IP-based fallback; it does not contain the device itself.

Practice this question →
2
MCQmedium

Your organization uses Microsoft Sentinel with Microsoft Defender XDR integrated. A critical incident has been raised involving a user account that was used to access a confidential SharePoint site from an unusual location at 2:00 AM. The incident includes alerts from Microsoft Defender for Cloud Apps, Microsoft Defender for Identity, and Microsoft Defender for Office 365. The analyst needs to contain the incident, investigate the scope, and begin remediation. The environment has the following: Microsoft Entra ID with conditional access policies, Microsoft Intune for device management, and Microsoft Defender for Endpoint on all devices. The analyst has identified the user account and the device used. Which course of action should the analyst take first?

A.Create a conditional access policy to block the user.
B.Isolate the user's device using Microsoft Defender for Endpoint.
C.Run a KQL query to find all resources accessed by the user.
D.Disable the user account in Microsoft Entra ID and revoke all sessions.
AnswerD

Immediately stops the user from accessing any resources.

Why this answer

Disabling the user account in Microsoft Entra ID and revoking all sessions is the immediate containment step because it stops the compromised account from being used for any further access, including the suspicious SharePoint access and any lateral movement. This action directly addresses the core of the incident—the user account—and is the fastest way to cut off the attacker's current authentication tokens and sessions, preventing further damage while the investigation proceeds.

Exam trap

The trap here is that candidates often prioritize device isolation (Option B) because they think of endpoint compromise first, but the incident is about a user account used from an unusual location, meaning the account itself is the primary vector—disabling the account is the fastest and most effective containment step before any device or investigation actions.

How to eliminate wrong answers

Option A is wrong because creating a conditional access policy to block the user is a slower, more complex approach that requires policy propagation time and may not immediately revoke existing sessions or tokens, leaving the attacker with active access. Option B is wrong because isolating the user's device using Microsoft Defender for Endpoint contains the device but does not prevent the attacker from using the same compromised user account from another device or via web-based access (e.g., SharePoint Online). Option C is wrong because running a KQL query to find all resources accessed by the user is a forensic investigation step that should occur after containment; performing it first delays the critical containment action and allows the attacker more time to exfiltrate data or move laterally.

Practice this question →
3
Multi-Selecteasy

Your organization uses Microsoft Sentinel. You are investigating an incident and need to gather additional context about a suspicious IP address. Which TWO Microsoft Sentinel features can you use to enrich the investigation?

Select 2 answers
A.Threat intelligence
B.Watchlist
C.Hunting
D.Entity behavior analytics
E.User and Entity Behavior Analytics (UEBA)
AnswersA, D

Threat intelligence can indicate if the IP is known malicious.

Why this answer

Threat intelligence is correct because it allows you to cross-reference the suspicious IP address against known threat intelligence feeds (e.g., Tor exit nodes, known C2 servers) directly within Microsoft Sentinel. This enriches the investigation by providing context such as reputation scores, associated malware families, and geographic origin, helping you assess the IP's maliciousness.

Exam trap

The trap here is that candidates often confuse UEBA (Option E) with entity behavior analytics (Option D), but UEBA is a broader analytics framework that does not directly enrich a specific IP address with external threat context, whereas entity behavior analytics is the correct feature for enriching investigation by providing entity-specific behavioral insights.

Practice this question →
4
MCQmedium

You are a security analyst investigating a detected phishing campaign targeting users in your organization. The Microsoft Defender for Office 365 alert indicates that several users clicked on a malicious link. Which action should you take first to prevent further compromise?

A.Add the malicious URL to the Microsoft Defender for Endpoint custom threat indicator list.
B.Isolate all affected users' devices from the network.
C.Report the email to Microsoft for analysis.
D.Block the sender email address in the tenant.
AnswerA

Creating a custom threat intelligence indicator for the malicious URL in Microsoft Defender for Endpoint triggers an immediate Alert/Block enforcement action on all onboarded endpoints via the built-in Network Protection component. When any user clicks the link, the endpoint blocks outbound connectivity to that URL before the content loads, regardless of the fact that the phishing email is already sitting in their mailbox. This is the fastest operational control because it addresses the actual click vector across all affected devices, not just the email envelope, and can also generate an alert for incident investigation.

Why this answer

Adding the malicious URL to the Microsoft Defender for Endpoint custom threat indicator list is the correct first action because it immediately blocks future access to that URL across all endpoints protected by Defender for Endpoint, preventing further compromise from users clicking the same link. This leverages the threat intelligence feed to enforce a block action at the network level, stopping the attack vector proactively without disrupting user productivity or requiring device isolation.

Exam trap

The trap here is that candidates often confuse incident response containment steps (like device isolation) with the most immediate preventive action, failing to recognize that blocking the malicious URL at the endpoint level stops the attack vector for all users without the operational impact of isolating devices.

How to eliminate wrong answers

Option B is wrong because isolating all affected users' devices from the network is an extreme containment step that disrupts operations and should only be taken after confirming active compromise or lateral movement, not as the first action when the primary threat is the URL itself. Option C is wrong because reporting the email to Microsoft for analysis is a reactive, long-term feedback action that does not immediately prevent further users from clicking the malicious link. Option D is wrong because blocking the sender email address is ineffective against phishing campaigns that often use spoofed or disposable addresses, and it does not block the malicious URL which could be delivered via other senders or methods.

Practice this question →
5
MCQmedium

Your organization uses Microsoft Sentinel. You receive an incident that involves a potential lateral movement detected by Microsoft Defender for Identity. You need to investigate the timeline of the attack. Which Microsoft Sentinel feature should you use?

A.Workbooks
B.Automation rules
C.Investigation graph
D.Analytics rules
AnswerC

Visual timeline for investigation.

Why this answer

The Investigation graph in Microsoft Sentinel is specifically designed to explore the scope and timeline of an attack by visually mapping entities (e.g., users, devices, IPs) and their connections. For a lateral movement incident detected by Defender for Identity, the graph automatically surfaces related alerts, entities, and activities in a chronological view, enabling you to trace the attacker's path across resources. This makes it the correct tool for investigating the attack timeline.

Exam trap

The trap here is that candidates confuse the Investigation graph with Workbooks, assuming any visual tool for analysis is a Workbook, but Workbooks are for aggregated reporting, not for per-incident entity timeline exploration.

How to eliminate wrong answers

Option A is wrong because Workbooks are used for creating custom dashboards and reports from pre-defined queries, not for interactive, entity-based timeline investigation of a specific incident. Option B is wrong because Automation rules are designed to trigger automated responses (e.g., closing incidents, assigning tasks) based on conditions, not to explore the historical sequence of an attack. Option D is wrong because Analytics rules define detection logic to generate alerts from data sources, but they do not provide a visual, entity-centric timeline for investigating an already-triggered incident.

Practice this question →
6
MCQeasy

Refer to the exhibit. You are reviewing an alert in Microsoft Defender for Endpoint. The alert details are shown. Which of the following actions should you take first?

A.Investigate the device and the alert details
B.Mark the alert as a false positive
C.Initiate device isolation to contain the threat
D.Run a full antivirus scan on the device
AnswerA

Investigation is the first step.

Why this answer

The first step in incident response is to investigate the alert details and the affected device to understand the scope and severity of the threat. Without investigation, you cannot determine whether the alert is a true positive, whether isolation is appropriate, or which remediation steps are needed. Microsoft Defender for Endpoint provides a rich investigation experience, including the alert story, device timeline, and related events, which must be reviewed before taking any containment or remediation actions.

Exam trap

The trap here is that candidates often jump to containment (isolation) or remediation (scan) because they think speed is critical, but the SC-200 exam emphasizes that investigation must always come first to avoid disrupting business operations or misclassifying alerts.

How to eliminate wrong answers

Option B is wrong because marking an alert as a false positive without investigation risks ignoring a real threat; you must first analyze the alert to confirm it is indeed benign. Option C is wrong because initiating device isolation should only be done after confirming the alert is a true positive and understanding the threat's behavior, as premature isolation can disrupt legitimate operations and lose forensic data. Option D is wrong because running a full antivirus scan is a remediation step that should follow investigation and containment, not precede them; scanning without context may miss advanced threats or alert on known good files.

Practice this question →
7
Multi-Selecthard

Which THREE are valid methods to collect forensic evidence from a compromised Windows machine during incident response in Microsoft Defender XDR? (Choose three.)

Select 3 answers
A.Reset the device to a clean state
B.Collect a memory dump from the device using Live Response
C.Perform a full disk image using Microsoft Defender for Endpoint
D.Run Live Response commands to collect files and run scripts
E.Export Windows Event Logs using Live Response
AnswersB, D, E

Memory dump captures running processes and network connections.

Why this answer

Options B, D, and E are correct: Live Response allows script execution and file collection; collecting a memory dump captures volatile evidence necessary for forensic analysis; exporting Windows Event Logs provides a timeline of events. Option A is incorrect because resetting the device destroys evidence instead of preserving it. Option C is incorrect because full disk imaging is not natively supported in Microsoft Defender XDR; it requires external tools.

Practice this question →
8
Multi-Selectmedium

Which TWO actions should a security analyst take when responding to a confirmed malware outbreak in Microsoft Defender for Endpoint?

Select 2 answers
A.Isolate the affected device
B.Run a full scan on the device
C.Create a custom detection rule for the malware
D.Delete the user account
E.Reset the user's password
AnswersA, B

Isolation stops the malware from spreading.

Why this answer

Options A and B are correct. Option A: Isolating the affected device immediately contains the outbreak and prevents lateral movement to other endpoints. Option B: Running a full scan ensures all malware components and artifacts are identified and removed.

Option C is wrong because creating a custom detection rule is a proactive measure for future detections, not an immediate response to a confirmed outbreak. Option D is wrong because deleting the user account is extreme and does not address the malware on the device. Option E is wrong because resetting the user's password helps with credential compromise but does not stop active malware.

Practice this question →
9
Multi-Selecthard

Which THREE steps are part of the containment phase of incident response in Microsoft Sentinel? (Select THREE.)

Select 3 answers
A.Disable compromised user accounts in Microsoft Entra ID.
B.Isolate affected devices using Microsoft Defender for Endpoint.
C.Collect forensic data from affected endpoints.
D.Block malicious IP addresses and domains in Microsoft Defender for Cloud Apps.
E.Restore encrypted files from backup.
AnswersA, B, D

Disabling accounts stops further misuse.

Why this answer

Disabling compromised user accounts in Microsoft Entra ID is a containment step because it immediately revokes the account's access tokens and prevents further authentication, stopping an attacker from using that identity to move laterally or access resources. This aligns with the containment phase's goal of limiting the blast radius of an incident.

Exam trap

The trap here is confusing containment actions (stopping the attack) with investigation (collecting evidence) or recovery (restoring data), leading candidates to select forensic collection or backup restoration as containment steps.

Practice this question →
10
MCQeasy

An analyst is investigating a phishing campaign that targeted multiple users. The analyst needs to identify if any users clicked a malicious link in the email. Which Microsoft Defender for Office 365 feature should be used?

A.Safe Attachments
B.Threat Explorer
C.Attack Simulator
D.Safe Links
AnswerB

Threat Explorer provides URL click data.

Why this answer

Threat Explorer (also known as Explorer) in Microsoft Defender for Office 365 provides a real-time, interactive view of threat data, including email delivery status and user actions such as clicks on malicious links. It allows analysts to filter by 'Click action' to identify users who clicked a URL that was determined to be malicious, making it the correct tool for this investigation.

Exam trap

The trap here is that candidates often confuse the protection features (Safe Links and Safe Attachments) with the investigation tool (Threat Explorer), assuming that because Safe Links blocks malicious clicks, it also provides historical click reports, when in fact Threat Explorer is the dedicated hunting and investigation tool for analyzing user actions.

How to eliminate wrong answers

Option A is wrong because Safe Attachments is a protection feature that detonates email attachments in a sandbox environment to detect malware, but it does not track or report user clicks on links. Option C is wrong because Attack Simulator is a training and simulation tool used to launch simulated phishing attacks to test user awareness, not to investigate past real-world phishing campaigns. Option D is wrong because Safe Links is a protection feature that rewrites URLs and checks them at time of click to block malicious destinations, but it does not provide a historical log or report of which users clicked a specific malicious link in a past campaign.

Practice this question →
11
MCQeasy

Refer to the exhibit. An admin creates this activity policy in Microsoft Defender for Cloud Apps. What will happen when a user fails to log in from 3 different IP addresses within 10 minutes?

A.The policy will generate an alert but not block the user.
B.The user will be blocked immediately after the third failed login from any IP.
C.The user will be blocked after 10 minutes regardless of the number of IPs.
D.The user will be blocked only if the third IP is different from the first two.
AnswerD

The policy requires 3 distinct IP addresses; after the third distinct IP, the user is blocked.

Why this answer

The policy triggers when the count of different IPs for failed logins reaches 3 within 10 minutes. The action is to block the user. 'DifferentCount' means distinct IPs, not total attempts. So exactly 3 different IPs trigger it.

Practice this question →
12
MCQhard

A company uses Microsoft Sentinel with Microsoft Defender for Cloud Apps. An incident is created when a user downloads 500 GB from SharePoint in one hour. The analyst wants to create a playbook that automatically suspends the user in Microsoft Entra ID when such activity is detected. Which connector and action should the analyst use in the playbook?

A.Microsoft Teams connector with 'Post message' action to notify admin.
B.Microsoft Entra ID connector with 'Update user' action to set accountEnabled to false.
C.Microsoft 365 Defender connector with 'Run advanced hunting' action.
D.Exchange Online connector with 'Set mailbox' action.
AnswerB

Directly disables the user account in Entra ID.

Why this answer

The Microsoft Entra ID connector provides the 'Update user' action, which can set the 'accountEnabled' property to false, effectively suspending the user in Microsoft Entra ID. This directly addresses the requirement to automatically disable a user account when a high-volume SharePoint download incident is detected in Microsoft Sentinel. The playbook can be triggered by the incident and use this action to perform the suspension without manual intervention.

Exam trap

The SC-200 exam often tests the distinction between notification actions (like Teams posts) and remediation actions (like disabling a user account), and the trap here is that candidates may choose a notification option (A) because it seems proactive, but the question explicitly requires automatic suspension, not just alerting.

How to eliminate wrong answers

Option A is wrong because the Microsoft Teams connector with 'Post message' action only sends a notification to an admin; it does not suspend the user or perform any account modification, so it fails to meet the requirement of automatically suspending the user. Option C is wrong because the Microsoft 365 Defender connector with 'Run advanced hunting' action is used to query threat data for investigation, not to modify user account status; it cannot suspend a user in Microsoft Entra ID. Option D is wrong because the Exchange Online connector with 'Set mailbox' action modifies mailbox settings (e.g., forwarding, quotas) but does not disable the user account in Microsoft Entra ID; suspending a user requires disabling the identity, not just the mailbox.

Practice this question →
13
Multi-Selecteasy

Which TWO Microsoft 365 Defender portals provide automated investigation and response capabilities? (Choose two.)

Select 2 answers
A.Microsoft Purview compliance portal
B.Microsoft Sentinel (portal.azure.com)
C.Microsoft Intune admin center
D.Microsoft Defender for Endpoint (security.microsoft.com)
E.Microsoft 365 Defender (security.microsoft.com)
AnswersD, E

Defender for Endpoint has automated investigation and response for endpoint threats.

Why this answer

Microsoft Defender for Endpoint (D) and Microsoft 365 Defender (E) both provide automated investigation and response (AIR) capabilities. Defender for Endpoint uses AIR to automatically investigate alerts on endpoints and take remediation actions, while Microsoft 365 Defender orchestrates AIR across email, identity, endpoints, and cloud apps. These portals are accessed via security.microsoft.com and offer built-in playbooks for automated response.

Exam trap

The trap here is that candidates may confuse Microsoft Sentinel's SOAR capabilities with the built-in AIR features of Microsoft 365 Defender portals, or mistakenly think the Purview compliance portal includes automated incident response.

Practice this question →
14
MCQeasy

Your organization uses Microsoft Sentinel. An incident is created for a possible data exfiltration via an unapproved external IP address. Which type of Microsoft Sentinel automation should you use to automatically block the IP address in the firewall?

A.Data connector.
B.Analytics rule.
C.Watchlist.
D.Playbook.
AnswerD

Playbooks automate response actions; they can be triggered from automation rules to block IPs.

Why this answer

Playbooks in Microsoft Sentinel are automated workflows based on Azure Logic Apps that can perform response actions, such as blocking an IP address in a firewall. When an incident indicates data exfiltration via an unapproved external IP, a playbook can be triggered automatically or manually to execute the block action via integration with firewall APIs or management tools.

Exam trap

The SC-200 exam often tests the distinction between detection (analytics rules) and response (playbooks), so candidates may confuse an analytics rule's ability to generate alerts with the capability to perform automated remediation actions.

How to eliminate wrong answers

Option A is wrong because a data connector is used to ingest logs and events from various sources into Sentinel, not to perform automated response actions like blocking an IP. Option B is wrong because an analytics rule generates alerts or incidents based on query logic; it does not execute remediation actions such as firewall changes. Option C is wrong because a watchlist is a collection of data (e.g., known malicious IPs) for correlation in queries, but it cannot directly trigger a block action in a firewall.

Practice this question →
15
MCQmedium

Your organization uses Microsoft Sentinel. A security analyst reports that an incident was automatically closed by a playbook before the investigation was complete. What should you do to prevent automatic closure in the future?

A.Disable the playbook
B.Remove the playbook from the automation rule
C.Modify the analytics rule to not automatically close incidents
D.Disable the automation rule that triggers the playbook
AnswerC

This prevents the playbook from closing incidents automatically.

Why this answer

The analytics rule that generates the incident includes a setting to automatically close incidents when an alert is triggered again. Modifying this setting prevents the incident from being closed prematurely, regardless of any playbook or automation rule. This ensures that incidents remain open for investigation until manually resolved.

Exam trap

The trap here is that candidates often focus on the playbook or automation rule as the cause of the closure, overlooking the analytics rule's built-in auto-close setting, which is the actual source of the behavior.

How to eliminate wrong answers

Option A is wrong because disabling the playbook would stop all its actions, not just the automatic closure, and may break other necessary automations. Option B is wrong because removing the playbook from the automation rule would prevent the playbook from running at all, but the underlying analytics rule setting would still automatically close the incident. Option D is wrong because disabling the automation rule would stop all triggers for that rule, including any other actions or playbooks, and does not address the analytics rule's auto-close setting.

Practice this question →
16
MCQeasy

Which Microsoft Sentinel feature allows you to automatically respond to incidents by running a playbook when an incident is created?

A.Analytics rules
B.Playbooks
C.Watchlists
D.Workbooks
E.Automation rules
AnswerE

Automation rules can trigger playbooks on incident creation.

Why this answer

Automation rules in Microsoft Sentinel allow you to define automated responses to incidents, including running a playbook when an incident is created. They provide a centralized way to trigger actions based on incident properties such as severity, status, or specific tactics, without needing to embed automation logic directly in analytics rules.

Exam trap

The trap here is that candidates often confuse playbooks with automation rules, thinking playbooks themselves automatically respond to incidents, when in fact playbooks are the action components that must be triggered by an automation rule or manual invocation.

How to eliminate wrong answers

Option A is wrong because analytics rules generate alerts or incidents based on data queries, but they do not directly run playbooks; automation rules are the mechanism that triggers playbooks upon incident creation. Option B is wrong because playbooks are collections of actions (based on Azure Logic Apps) that can be run manually or via automation rules, but they are not the feature that automatically responds to incidents when created. Option C is wrong because watchlists are collections of data (e.g., IP addresses, hostnames) used for correlation and enrichment in analytics rules, not for automated incident response.

Option D is wrong because workbooks are interactive dashboards for visualizing and analyzing data, not for triggering automated responses.

Practice this question →
17
Multi-Selectmedium

Which TWO actions should an analyst take when a confirmed ransomware incident is detected on multiple endpoints? (Choose TWO.)

Select 2 answers
A.Run a full antivirus scan on all endpoints.
B.Isolate affected endpoints using Microsoft Defender for Endpoint.
C.Block known malicious IP addresses and domains in the firewall.
D.Disconnect network cables but leave endpoints powered on.
E.Shut down all affected endpoints to prevent data loss.
AnswersB, C

Immediately contains the threat by isolating devices.

Why this answer

Microsoft Defender for Endpoint's device isolation feature immediately severs all network communication (both inbound and outbound) from the affected endpoint while keeping the device powered on for forensic analysis. This containment action prevents lateral movement and further encryption of data across the network, which is critical during a ransomware incident.

Exam trap

The trap here is that candidates often confuse 'isolation' with 'shutdown' or 'disconnect', not realizing that isolation preserves forensic data and allows remote management, while shutdown destroys volatile evidence and may accelerate data loss.

Practice this question →
18
MCQhard

You are investigating an incident where a user reported receiving a suspicious email with a malicious attachment. Microsoft Defender for Office 365 did not block it. The email originated from a known malicious sender domain. What configuration should you check first?

A.User-reported message settings
B.SPF record for the sender domain
C.Safe Attachments policy
D.Anti-phishing policy in Microsoft Defender for Office 365
AnswerD

Anti-phishing policy in Microsoft Defender for Office 365 is the correct control because it provides domain impersonation protection and spoof intelligence that can identify and block messages from known malicious domains or those mimicking protected senders. It leverages threat intelligence and real-time reputation to enforce blocking, quarantine, or redirect to Junk before delivery to the user's inbox. This policy is specifically designed to combat phishing and impersonation, which aligns with the reported incident involving a suspicious email.

Why this answer

The anti-phishing policy in Microsoft Defender for Office 365 is the primary configuration that evaluates sender reputation, impersonation attempts, and spoof intelligence. Since the email originated from a known malicious sender domain and was not blocked, the anti-phishing policy's spoof settings or impersonation protection may be misconfigured or not applied to the affected user. This policy directly controls how Defender handles emails from malicious domains, making it the first place to check.

Exam trap

The trap here is that candidates confuse the anti-phishing policy with Safe Attachments or SPF records, but the anti-phishing policy is the correct first check because it directly handles domain-based threats and spoofing, while Safe Attachments focuses on file analysis and SPF is a DNS record not configurable within Defender.

How to eliminate wrong answers

Option A is wrong because user-reported message settings control how users submit emails for analysis (e.g., via the Report Message add-in), not how Defender blocks malicious emails at the transport layer. Option B is wrong because the SPF record for the sender domain is a DNS record that the recipient's mail server checks, but it is not a configuration within Microsoft Defender for Office 365 that you can adjust; you can only configure SPF handling in the anti-phishing policy. Option C is wrong because Safe Attachments policy specifically handles attachments by detonating them in a sandbox, but the question states the email had a malicious attachment that was not blocked, and the primary issue is the sender domain being known malicious, which is addressed by anti-phishing policies, not attachment scanning.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Respond to security incidents questions.

Start 20-question session