CCNA Respond to security incidents Questions

Sign-in logs in Microsoft Entra ID reveal the authentication events tied to the suspected token theft, showing anomalous locations, IP addresses and session details. Reviewing them first establishes which accounts and sessions are affected, defining the incident scope before deeper investigation.

Investigating the incident details is the correct first step because it provides the necessary context to determine the scope and severity of the threat. In Microsoft Sentinel, you open the incident to review the full timeline, related alerts, entities (accounts, hosts, IPs), and raw evidence gathered by the analytics rule. This investigation enables triage—confirming whether the failed logins indicate a brute-force attack, a password spray, or a false positive—and guides all subsequent containment and remediation decisions with data rather than assumptions.

The AzureActivity table contains Azure Activity logs, including the Caller field which holds the user identity (UPN or object ID) that initiated the operation. Filtering by OperationName for 'Delete Virtual Machine' and projecting Caller directly returns the user account responsible, making this the correct and efficient query for the scenario.

The rule will not trigger because the incident has Medium severity, while the rule's condition explicitly requires an incident severity of High. When an incident is created or updated, Microsoft Sentinel evaluates the rule's trigger conditions against that incident's properties, and a failed condition prevents the rule from executing any actions. Because no action runs, neither the playbook nor any severity update occurs.

Automation rules act on incidents, so the trigger must be 'IncidentCreated' to fire and apply severity, assignment and status changes. An 'AlertRule' trigger responds to alerts instead, meaning the incident-level actions never execute, which explains why incidents remain unmodified.

Sign-in events from unusual locations or anonymous IP addresses after the click indicate whether stolen credentials were used. This telemetry, available through Microsoft Entra ID sign-in logs, confirms or rules out credential compromise following the malicious URL click.

Initiating a live response session on the VM and running the 'dump memory' command uses Microsoft Defender for Endpoint's built-in forensic capability to gather a complete memory dump from the endpoint. This preserves the volatile state for analysis—including running processes, network connections, and any malware injected into memory—which is exactly what is needed during an active compromise. Live response is the correct documented method for memory acquisition on an MDE-protected Azure VM.

Sysinternals Suite tools such as procdump execute natively on the local computer, using Windows internals (e.g., MiniDumpWriteDump) to capture process memory without relying on any network connection. This makes them ideal for an offline server because a forensic examiner can copy the tool to the machine via removable media and run it from an elevated command prompt to save a .dmp file to local disk. The resulting dump can then be analyzed on a separate workstation, preserving volatile evidence on the original host.

Triage establishes scope and severity before containment, eradication or recovery, so responders can prioritise the critical incident correctly. Skipping straight to remediation risks wasted effort and missed affected assets, whereas triage directly satisfies the best-practise first-action requirement in the stem.

Closing an incident while child alerts remain active leaves orphaned detections that can regenerate the incident or skew metrics. Confirming every linked alert is resolved or closed ensures the remediation is genuinely complete before the incident itself is finalised.

The correct approach is to enable Alert suppression in the analytics rule's 'Set rule logic' settings. When the rule fires, you can configure it to stop running the query for a specified duration (e.g., 1, 6, or 12 hours), so the same matching condition does not immediately generate multiple duplicate alerts. This suppresses additional alerts from that rule during the suppression window while preserving the rule for future detections.

Isolating affected devices through Microsoft Defender for Endpoint halts lateral spread and further encryption while keeping the machine powered on, so volatile memory, running processes and network connections remain intact for forensic capture. This directly satisfies the stem's dual constraint: contain the ransomware outbreak yet preserve evidential artefacts.

The Microsoft Sentinel Incident trigger with the action 'Collect evidence' is the correct choice because it fires when an incident is created, providing a single orchestration point for gathering evidence across multiple sources. This trigger can invoke a playbook automatically via an automation rule or manually, and the playbook can connect to various connectors to collect related evidence and append it to the incident. This aligns with best practice for incident-centric automation.

Isolating the device from the network is the immediate containment action because it severs the ransomware's C2 channel, preventing key exchange, additional payload downloads, and SMB-based worm-like propagation to adjacent systems. Physically disconnecting the network cable, disabling the Wi-Fi adapter, or applying a host-based firewall rule to block all inbound and outbound traffic ensures the encryption process cannot phone home or spread. This preserves evidence while stopping the attack in place, making it the first priority in any ransomware containment playbook.

Disabling the account in Microsoft Entra ID immediately blocks authentication, satisfying the requirement to contain the compromised identity. For a hybrid user, however, this alone may not stop on-premises Kerberos activity, since the domain controller still validates tickets until directory sync propagates the change.

Azure Firewall is a supported Microsoft Sentinel data connector, streaming firewall network and application rule logs into the workspace via Azure Monitor diagnostic settings. This satisfies the question's requirement to identify valid connectors, alongside Microsoft Entra ID.

AuditLogs (Microsoft Entra ID) is the authoritative log for directory administrative changes, capturing activities such as 'Add member to role,' 'Remove member from role,' and 'Activate role' in the RoleManagement category. Each log entry includes the actor, target user, role name, and timestamp, enabling full visibility into who was granted elevated permissions and when. In Log Analytics or Microsoft 365 Defender, this appears as the AuditLogs table in the EntraID sign-in/logs connector. Therefore, it is the correct data source for verifying whether any user has been added to a privileged role.

In Microsoft Sentinel, enriching an alert with threat intelligence is a standard investigative step: you pivot on entities such as IPs, domains, or hashes to query TI feeds and identify known malicious context, which helps validate the alert's severity and false-positive risk. This enrichment often leverages the built-in Threat Intelligence workbook or the hunting queries, enabling the analyst to correlate the current alert with historical compromise activity. It directly supports the 'Investigate' phase of the incident response lifecycle, making it a correct step.

Resetting the password invalidates the attacker's knowledge of the compromised secret, while explicitly revoking the user's active sessions and refresh tokens terminates the attacker's existing authenticated access to Microsoft 365/Entra ID apps. This should be done before any other investigation step because it limits dwell time and prevents further lateral movement or data exfiltration as long as the attacker is not already using alternate backdoors. The 'Revoke user sessions' action in the Entra ID admin center (or Microsoft Graph `revokeSignInSessions`) closes current bearer/refresh tokens, not just the password-based login path.

Suspending the user account in Microsoft Entra ID immediately disables the user object, preventing any fresh authentication and token issuance for all applications, including the sanctioned app protected by Defender for Cloud Apps. This is the most direct and effective containment action because it blocks all sign-in attempts regardless of device, network, or app, and takes effect nearly immediately across Microsoft's identity plane.

Microsoft Defender for Endpoint Live Response is the correct choice because it provides a remote, real-time shell for a compromised device. You can initiate a session from the MDE portal, run PowerShell commands, execute a script from the library, collect forensic artifacts, and retrieve the malicious script file for analysis. This interactive capability allows you to inspect the exact script content, confirm its behavior, and gather evidence directly from the endpoint.

Disabling the public IP and applying an NSG rule that blocks all inbound and outbound traffic at the server's subnet effectively isolates the VM from both external attackers and internal lateral movement while leaving the machine powered on for evidence preservation. Because NSGs are stateful and evaluated for every flow, this drops current network conversations and prevents new ones, cutting off command-and-control or data exfiltration. This is the proper immediate containment action in an incident response playbook, as it contains the threat without destroying forensic artifacts.

Automation rules in Microsoft Sentinel evaluate incident conditions and can invoke playbooks automatically when their trigger conditions match, such as on incident creation with a specific severity or title. This satisfies the runbook requirement that no analyst clicks anything. The playbook then performs the Teams posting and task creation through its connectors, so the response is fully automated and repeatable for every matching incident.

Using KQL to query logs in Microsoft Sentinel allows you to search across connected data sources, such as AzureActivity and OfficeActivity, for actions performed by the service account. This provides a detailed and customizable view of all activities, enabling thorough investigation.

STIX/TAXII threat intelligence feeds are legitimate because STIX (Structured Threat Information eXpression) standardizes how threat indicators and malicious behaviors are described, while TAXII (Trusted Automated eXchange of Indicator Information) provides the standardized transport protocol for sharing those feeds. Microsoft Sentinel natively supports ingestion from TAXII servers via the Threat Intelligence TAXII data connector, allowing organizations to pull in indicators of compromise and campaign context from public or commercial providers. This standards-based interoperability is exactly why these feeds are a recognized, first-class source of threat intelligence in a SIEM.

Automation rules in Microsoft Sentinel invoke playbooks by using either a managed identity or an OAuth connection to authenticate against the Logic App resource. If the managed identity lacks the required RBAC role on the Logic App (for example, Logic App Operator), or if the connection used by the rule has been removed, expired, or lacks the necessary permissions, the automation rule cannot trigger the playbook. This is the most direct and common cause of playbook execution failure, making it the correct answer.

The correct approach is to create an automation rule in Microsoft Sentinel that triggers when the specific alert from Microsoft 365 Defender is generated. In the automation rule, you associate a playbook that uses the Microsoft 365 Defender connector to quarantine the email. This enables an automated, immediate response without human intervention, leveraging the built-in alert as the trigger and the Logic Apps playbook to execute the quarantine action.

In Microsoft Sentinel UEBA, the user account is the primary entity type for detecting credential compromise because authentication and authorization are fundamentally tied to accounts. Attacks such as password spray, brute force, impossible travel, and anomalous sign-in all manifest as unusual activity on a user account, and UEBA builds a behavioral baseline per user to score these deviations. The investigation timeline aggregates sign-in events, machine activity, and assigned alerts around the account, enabling analysts to trace the full scope of a compromise. Therefore, User account is the correct answer.

Running a live response session on the device establishes an interactive, remote shell through the Microsoft Defender for Endpoint management plane. It enables the incident responder to execute PowerShell scripts, collect forensic artifacts such as memory, registry, and files, and apply remediation actions directly on the endpoint. Crucially, this can be done even while the device remains isolated, because the live response channel uses an outbound HTTPS connection to the cloud service.

Running a full antivirus scan on affected devices is a primary eradication step because it identifies known ransomware signatures, quarantines the malicious binary, and cleans any dropped files or artifacts. In the context of Microsoft Defender for Endpoint, the scan leverages cloud-delivered protection and tamper protection to remove the threat from all local drives. This action is most effective after isolating the device, because the scan itself does not prevent lateral movement while it is running.

The Microsoft Defender XDR portal is the central console for investigating alerts and incidents across the Microsoft 365 Defender suite. The first step in any incident response is to verify the alert's validity by examining the evidence, related entities, and the incident timeline. Classifying the alert as a true or false positive determines whether subsequent containment, eradication, or closure actions are necessary, making this the correct initial action.

The 'processes' command enumerates running processes on the target device, returning process names, IDs, and related details. This satisfies the forensic requirement to capture volatile evidence of active processes before the compromised Windows host is remediated or shut down.

Because the user holds administrative privileges, credential reset alone is insufficient — active refresh tokens and sessions must be revoked in Microsoft Entra ID to evict the attacker immediately. This contains the compromised privileged identity before any further investigation, satisfying the stem's requirement to act first.

Microsoft Defender for Endpoint's device isolation severs all network connectivity except to the MDE cloud service, instantly breaking command and control channels and laterally used protocols such as SMB and RDP. Because isolation is enforced at the operating system's network stack, it does not rely on killing a process that may simply respawn or on user compliance. This action also preserves volatile memory and active connections for subsequent forensic analysis, making it the preferred first response to a compromised, actively communicating endpoint.

Disabling the user account in Microsoft Entra ID is a valid containment step because it immediately prevents any further authentication attempts using that identity, cutting off the attacker's current access path to cloud applications, Microsoft 365, and other Entra ID-integrated resources. This reversible, non-destructive action preserves all user data and activity logs for forensic analysis while stopping ongoing malicious activity. It is one of the first actions an incident responder should take when a user identity is known to be compromised.

In Microsoft Sentinel, an automation rule can be triggered when an incident's status changes to Closed, and its 'Close alert' action explicitly resolves all linked alerts. This ensures that the security operations team does not have to manually close each alert and that the alert-state lifecycle matches the incident-state lifecycle. Conditions such as severity, owner, or tactic can also be applied, making this the correct, supported mechanism to accomplish the goal.

Microsoft Purview data access logs are the authoritative source for item-level access events in Office 365, recording details such as the specific document downloaded, the user identity, the timestamp, and the device or client IP. These logs are generated by Purview's content discovery and classification pipeline and capture both interactive and background access by apps or users. For an attacker exfiltrating sensitive files, these logs provide the precise chain of access needed to confirm what data was compromised, so this is the correct choice for the investigation.

Disabling compromised accounts in Microsoft Entra ID immediately revokes authentication, blocking the attacker from re-entering the environment via cloud or hybrid identity paths. This directly satisfies containment by stopping lateral movement and further compromise while investigation continues, rather than merely detecting or documenting the incident.

Microsoft Defender for Endpoint's device isolation applies an OS-level network security policy at the client that blocks all inbound and outbound traffic other than the Defender service itself, effectively severing the ransomware's command-and-control channel and preventing further server-side or lateral encryption. This is the immediately effective containment action because it does not rely on terminating the process or cleaning files first. The SOC can then inspect processes, stop the malicious binary, and later restore data from backup in a clean state.

Revoking sessions in Microsoft Entra ID invalidates refresh and access tokens immediately, cutting off the compromised account's continued access. This satisfies the stem's requirement to contain a confirmed exfiltration, since password resets alone leave existing tokens valid until expiry.

Microsoft 365 Defender is a native Sentinel data connector that ingests high-fidelity alerts and incidents from the Microsoft Defender XDR suite, including Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps. This connector enables cross-domain correlation and automates incident response by bringing unified XDR telemetry directly into Sentinel, making it a core component for modern security operations.

The app dashboard in Defender for Cloud Apps surfaces anomaly detection alerts, such as impossible travel, mass download, or activity from a previously unseen IP. These alerts are produced by user and entity behavior analytics and serve as the initial signal that an exfiltration attempt may be in progress. Reviewing this dashboard is a valid investigative step because it helps you prioritize which users and files warrant deeper log analysis, rather than assuming any single event is malicious.

In Microsoft Sentinel, the incident's Entities tab displays the normalized entity objects—such as user accounts, hostnames, IP addresses, URLs, and file hashes—that were extracted and mapped during incident creation. These entities are directly linked to the incident and enriched with context for pivoting, allowing analysts to see and investigate all related resources from a single, authoritative view. This is the correct place to find all related entities for the incident.

The DeviceProcessEvents table records actual process creation events on the endpoint, and this query filters for any process whose file name is 'ransomware.exe' while projecting the initiating process file name and its command line. That parent relationship is the critical forensic evidence: it shows which executable (for example msiexec.exe, rundll32.exe, or a malicious PowerShell) launched the ransomware, enabling the security team to trace back to the initial access vector. Including the timestamp supports chronological reconstruction of the infection, which is the core goal of the incident response investigation.

Device isolation via Microsoft Defender for Endpoint immediately cuts the workstation's network connections while preserving the live system and its forensic artefacts, containing lateral movement and further payload downloads. Remediation and evidence collection follow safely afterwards, satisfying the 90-day preservation policy.

Assigning incidents to analysts or teams is a core incident management capability in Microsoft Sentinel. Through the Incident blade, an analyst can set the Owner and assign the incident to a specific person or group, establishing accountability and routing for follow-up actions. Assignment does not change incident state by itself but ensures each case has a clear point of contact.

Encoded commands, typically Base64 strings passed to PowerShell or command shells, are the signature this hunting query targets. Decoding and inspecting those command lines reveals obfuscated script execution, matching the query's focus on suspicious command-line activity.

Immediately contains the threat by isolating devices.

Reviewing the sign-in details and comparing them with the user's typical behavior is the correct initial triage action because Entra ID sign-in logs contain rich data—client IP, latitude/longitude, user agent, authentication method, device ID, and risk labels (e.g., impossible travel, unfamiliar sign-in properties, anonymized IP)—that can be correlated against the user's historical baseline. This behavioral analytics approach validates whether the sign-in is truly anomalous before any containment steps are taken, which is consistent with the 'identify-scope-contain' incident response lifecycle. Without this evidence-based review, actions like resetting credentials or blocking the account would be premature and potentially misguided, either disrupting a legitimate sign-in or failing to address a real compromise.

Enabling just-in-time (JIT) VM access in Microsoft Defender for Cloud immediately reduces the attack surface by creating temporary NSG rules that only allow specified source IPs and ports during defined schedules. This blocks inbound traffic from the internet or other high-risk sources while preserving legitimate administrative access, unlike a full inbound block. JIT is a fast, reversible, and targeted network-level control that buys time for a safe patch deployment without taking the VM offline.

The query conditions—ParentImage equals 'winword.exe' and CommandLine contains 'cmd.exe'—precisely describe a Microsoft Word process creating a child command prompt. This is a classic indicator of a document with an embedded macro executing a shell command, a common technique for lateral movement or payload delivery. Therefore, this option correctly interprets the rule's intent and logic.

Device isolation from the Microsoft Defender for Endpoint console severs network connectivity while preserving the Defender sensor channel, blocking lateral movement and ransomware spread on the online Intune-managed device. This is the supported remediation action within Microsoft Defender XDR.

Indicators of compromise in Microsoft Defender XDR let you define file hashes, IPs, URLs or commands that block or remediate across onboarded endpoints. Creating a command indicator enforces immediate blocking fleet-wide, satisfying the requirement to stop the PowerShell command on all devices.

The root cause is that the query queries the DeviceEvents table, which does not contain process creation events. Process creation events are stored in the DeviceProcessEvents table, part of the Advanced Hunting schema. Querying DeviceEvents will not return process creation data, even if the rest of the query is correct. Changing the table to DeviceProcessEvents resolves the issue.

Reviewing the user's UEBA insights is the initial investigative step because Sentinel's UEBA engine has already modeled that user's historical behavior and established a baseline. These insights reveal what made the activity anomalous—for example, unexpected geo-location, new device, unusual hour, or abnormal access frequency—and provide a context-rich timeline for triage. This assessment lets the analyst validate the alert and decide on containment versus false positive before any corrective action is taken.

Contacting the user to confirm if they attempted to sign in is the correct initial triage step. In Microsoft Sentinel, sign-in logs and failed attempts are often false positives triggered by user behavior, such as using a personal device or mistyping a password. This direct verification helps the analyst correlate the alert with the user's actual activity, geographic location, and device, enabling a risk-based decision without causing unnecessary disruption. It aligns with standard incident response procedures that emphasize validation before containment.

Isolating the compromised Windows 10 workstation via Microsoft Defender for Endpoint immediately severs the attacker's NTLM authentication path to the target servers, halting lateral movement. Containment precedes investigation, and endpoint isolation is the fastest action that stops pass-the-hash propagation.

Revoking the user's session in Microsoft Entra ID immediately invalidates all refresh tokens for that user and forces re-authentication across all applications, terminating the attacker's active session without waiting for token expiry. This is the correct initial response in a Sentinel incident because it stops ongoing unauthorized access at the session layer, which is faster and more comprehensive than network-level or credential-based actions. It is a precise containment step that precedes password reset and further investigation.

Alerts are generated by built-in analytics rules, Microsoft Defender services, or custom detections and represent a single security detection with associated entities, timestamps, and severity. When an incident is created, related alerts are automatically linked, and you can explicitly add alerts from the Evidence tab to support the investigation. Each alert carries rich metadata such as rule ID, tactic, technique, and triggered logic, making it a primary evidence source. Alerts are valid evidence because they capture the exact detection that initiated or expanded the incident response.

Device isolation in Microsoft Defender for Endpoint is a response action that blocks all inbound and outbound network traffic on the endpoint, except for communication with Defender for Endpoint cloud services. It preserves the sensor's ability to send telemetry and receive additional commands while effectively cutting off lateral movement and data exfiltration. This is the intended containment mechanism for a compromised device during incident response.

Isolating affected devices at the switch or via VLAN segmentation immediately stops the ransomware's lateral movement over SMB, RDP, or WinRM, while keeping the device powered on so volatile data remains intact for later forensic acquisition. This containment measure is the top priority because a single connected endpoint can encrypt an entire network in minutes, including backups that are mounted as network drives.

Cross-workspace queries using the workspace() expression allow you to reference multiple Log Analytics workspaces in a single KQL query, typically with the union operator. This is the most efficient way to search for threats across Microsoft Sentinel workspaces because it avoids data duplication and runs in one query request, returning merged results that can be further processed with KQL operators like project, where, or summarize.

Threat Explorer (also known as Explorer) in Microsoft Defender for Office 365 is purpose-built for investigating email threats across all mailboxes. It allows searching by message ID, subject, sender, recipient, and delivery status, and can filter by detection technology, threat type, and campaign ID. This enables the analyst to quickly locate every copy of the phishing email, assess the blast radius, and take remediation actions directly.

Microsoft Defender for Endpoint Live Response provides an interactive, remote shell on an onboarded endpoint, enabling incident responders to run built-in, PowerShell, or Python commands. It supports collecting files (collectfile), viewing processes and network connections, and running forensic scripts to extract memory, registry, or disk artifacts. This is the correct tool for live forensic data collection directly from the machine, using the Defender for Endpoint sensor as the transport.

Automation rules in Microsoft Sentinel trigger on incident creation and can set owner, status and severity automatically. Configuring a rule that matches severity equals High and assigns the Tier 2 team satisfies the automatic assignment requirement without manual triage.

SigninLogs records authentication events and AuditLogs captures directory changes such as role assignments, consent grants and credential additions. Together they reveal anomalous sign-ins and privilege escalation tied to compromised accounts, satisfying the need to identify which users were affected.

Investigation is the phase where the analyst uses threat hunting queries, entity timelines, and the investigation graph to reconstruct the attack chain and determine the full scope of compromise. This step involves correlating alerts, user sign-in data, and network artifacts to identify the root cause, affected assets, and potential data loss. In Microsoft Sentinel, a KQL query might pivot on a compromised entity to reveal lateral movement, while the entity timeline provides a chronological view of activities that contextualizes each alert.

Removing the external guest's access to the document in SharePoint Online is the correct containment step because it directly targets the specific sharing permission that caused the incident. This action revokes the guest's ability to view or download the file while preserving the document for investigation and allowing internal users with existing permissions to continue working. It is a granular, least-privilege response that minimizes disruption and aligns with Microsoft incident response guidance for external sharing.

Disabling the user account in Microsoft Entra ID is the fastest and most direct containment action. Setting the account's AccountEnabled property to false immediately prevents new token issuance and triggers revocation of the user's existing refresh tokens, effectively cutting off access within seconds. This can be done in the Entra admin center or via Microsoft Graph, and it is the recommended first step for a confirmed account compromise because it stops the attacker regardless of which app or resource they are targeting.

Locking the compromised account in Microsoft Entra ID immediately invalidates its refresh tokens, halting further authenticated access to SharePoint Online and OneDrive for Business. This directly satisfies the stem's requirement to stop ongoing file encryption, since ransomware encrypts through the hijacked session's existing permissions rather than exploiting a separate vulnerability.

Anti-phishing policy in Microsoft Defender for Office 365 is the correct control because it provides domain impersonation protection and spoof intelligence that can identify and block messages from known malicious domains or those mimicking protected senders. It leverages threat intelligence and real-time reputation to enforce blocking, quarantine, or redirect to Junk before delivery to the user's inbox. This policy is specifically designed to combat phishing and impersonation, which aligns with the reported incident involving a suspicious email.

With groupingConfiguration.enabled set to false, Sentinel disables alert grouping, so each individual alert raised by the rule creates its own incident rather than being merged into a single incident. This satisfies the scenario's requirement for one incident per alert.

Reporting the email via the Microsoft 365 Defender portal (using the 'Report a message' or admin submission workflow) submits the original email, including its headers and attachments, to Microsoft's automated detonation and analysis systems. This enables the security team to extract actionable IOCs, update tenant-level block and allow lists, and contribute to global filtering improvements—directly addressing the low-severity phishing incident without destroying evidence. It is the correct initial response because it simultaneously preserves the artifact and enhances email security posture.

Resetting the user's password in Microsoft Entra ID is a direct containment action because it invalidates the previously valid credential. If the attacker gained access via a phished or stolen password, this immediately prevents them from using that secret for interactive sign-in. It is a focused remediation step that should be performed as soon as the user is confirmed as a legitimate account holder, forcing them to create a new password on next sign-in.

Blocking the ransomware executable's SHA-256 hash via Microsoft Defender for Endpoint custom indicators immediately prevents that specific binary from running on any monitored endpoint, independent of signature updates. Because the hash is a known-bad IOC, defining it as a block indicator enforces a deny action at the kernel and network layers, halting execution on already-uninfected devices and stopping the ransomware from propagating through mapped shares.