How should I use these Respond to security incidents practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Respond to security incidents questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Respond to security incidents domain.

SC-200 · topic practice

Respond to security incidents practice questions

This domain covers responding to security incidents using Microsoft Sentinel, Defender XDR, and related tools. It tests your ability to triage, investigate, contain, and remediate threats. You must know how to use incident management, automation rules, playbooks, and advanced hunting to resolve attacks like phishing, ransomware, and data exfiltration.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Editorial oversight:Johnson Ajibi· MSc IT Security, IEEE Senior Member

20 questionsDomain: Respond to security incidents

Practice 10 questions Browse domain →

What the exam tests

What to know about Respond to security incidents

You must be able to triage and remediate incidents using Microsoft Sentinel and Defender XDR. The most important thing is to correctly use automation rules and playbooks to contain threats without disrupting legitimate business operations.

Manage incidents in Microsoft 365 Defender and Microsoft Sentinel, including assignment, status, and classification.

Use advanced hunting with KQL to investigate incidents and identify affected entities.

Configure automation rules and playbooks to automate response actions like isolating devices or blocking users.

Perform remediation actions such as soft-deleting malicious emails, isolating endpoints, or revoking user sessions.

Watch out for

Common Respond to security incidents exam traps

▸Confusing automation rules with playbooks: automation rules trigger playbooks but do not perform actions directly; playbooks contain the logic.
▸Forgetting that Microsoft Sentinel incidents can include entities from multiple sources, requiring cross-workspace investigation.
▸Assuming Defender for Office 365 automatically blocks all phishing emails; manual remediation may be needed for missed threats.

Practice set

Respond to security incidents questions

20 questions · select your answer, then reveal the explanation

Question 1hardmulti select

Read the full Ansible explanation →

Which THREE conditions must be met for Microsoft Sentinel to automatically run a playbook on an incident?

Trap 1: The incident severity must be set to High or Critical

Incident severity is merely a condition that can be used in an automation rule, not a mandatory prerequisite. Automation rules can be configured to run on any severity, including Low or Medium, and severity itself is a dynamic property that might be changed by the rule. Therefore, restricting this to High or Critical is unnecessary and would incorrectly limit the rule's applicability.

Trap 2: The user must be signed in to the Azure portal

The execution of playbooks in Microsoft Sentinel is fully asynchronous and occurs in the background via Azure Logic Apps, independent of any interactive user session. The automation rule engine invokes the Logic App using its own identity or a managed identity, and there is no requirement for a user to be actively signed in to the Azure portal. Requiring an interactive sign-in would break the automation's ability to run unattended.

Study all Respond to security incidents common traps →

A
The incident severity must be set to High or Critical
Why it fails: Incident severity is merely a condition that can be used in an automation rule, not a mandatory prerequisite. Automation rules can be configured to run on any severity, including Low or Medium, and severity itself is a dynamic property that might be changed by the rule. Therefore, restricting this to High or Critical is unnecessary and would incorrectly limit the rule's applicability.
B
The playbook must have the Sentinel Responder role assigned
The Logic App that serves as a playbook must be granted the Microsoft Sentinel Responder role on the relevant Log Analytics workspace or resource group to obtain write permissions for incident management. This role enables the playbook to perform actions like changing incident status, adding comments, or assigning ownership; without this RBAC assignment the automation rule will fail to execute the playbook.
C
The incident must be created by a scheduled or NRT analytics rule
Automation rules are evaluated only when an incident is created by a supported analytics rule, such as a scheduled query or an NRT rule that runs near real-time. Incidents created manually, via API, or from other sources do not trigger playbook actions because the incident creation event lacks the context and lineage that analytics rules provide. Thus, the playbook automation depends on the incident originating from an analytics rule.
D
The user must be signed in to the Azure portal
Why it fails: The execution of playbooks in Microsoft Sentinel is fully asynchronous and occurs in the background via Azure Logic Apps, independent of any interactive user session. The automation rule engine invokes the Logic App using its own identity or a managed identity, and there is no requirement for a user to be actively signed in to the Azure portal. Requiring an interactive sign-in would break the automation's ability to run unattended.
E
The playbook must be set to 'Enabled' on the automation rule
Within an automation rule, each playbook action has its own 'Enabled' toggle; the playbook will only run if this toggle is turned on. Additionally, the underlying Logic App in Azure must itself be in an enabled state. If either is disabled, the action is skipped during incident processing, so the rule must explicitly have the playbook enabled.

Respond to security incidents practice questions

What to know about Respond to security incidents

Common Respond to security incidents exam traps

Respond to security incidents questions

Which THREE conditions must be met for Microsoft Sentinel to automatically run a playbook on an incident?

Your organization uses Microsoft Defender for Office 365. A user reports receiving a phishing email that bypassed the default policy. You need to create a custom anti-phishing policy to block similar emails in the future. What should you configure?

You deploy the above ARM template to create a scheduled analytics rule in Microsoft Sentinel. After deployment, the rule runs but never generates incidents. What is the MOST likely cause?

Exhibit

You are responding to a data exfiltration incident in Microsoft Sentinel. The attacker used a PowerShell script to upload data to an external storage account. You need to identify the specific storage account used. Which KQL query should you use in the AzureActivity table?

Which TWO actions are valid for containing a compromised user account in Microsoft 365 Defender? (Choose two.)

Which TWO Microsoft 365 Defender portals provide automated investigation and response capabilities? (Choose two.)

Which Microsoft Sentinel feature allows you to automatically respond to incidents by running a playbook when an incident is created?

During an incident response, you identify that a user's account was used to sign in from an unusual location. You need to contain the incident immediately. What should you do first?

You are reviewing an automation rule in Microsoft Sentinel. The rule triggers on incident creation with severity High. However, during a recent High severity incident, the playbook did not run. What is the most likely cause?

Exhibit

Which TWO are valid incident response actions in Microsoft Sentinel?

Which THREE are valid ways to automatically respond to a security incident in Microsoft Defender XDR?

Your organization uses Microsoft Defender for Identity. You receive an alert about a suspicious Kerberos authentication attempt. What is the best first step to contain the potential threat?

During a ransomware incident, you need to prevent the encryption of files on a server running Windows Server 2022. You have Microsoft Defender for Endpoint Plan 2. Which attack surface reduction rule should you enable?

Which TWO actions can be performed using Microsoft Sentinel's automation rules? (Choose two.)

Which THREE are valid containment actions in Microsoft Defender for Endpoint? (Choose three.)

Your organization uses Microsoft Purview to manage insider risk. A user is suspected of exfiltrating data via email. The incident response team needs to preserve a copy of the user's mailbox for legal hold. Which action should be taken?

Which TWO components are required to enable automated investigation and response (AIR) in Microsoft Defender for Office 365?

Refer to the exhibit. This is a snippet from an automation rule in Microsoft Sentinel. What is the purpose of the 'RunQuery' action?

Exhibit

Your organization uses Microsoft Sentinel. A security analyst reports that an incident was automatically closed by a playbook before the investigation was complete. What should you do to prevent automatic closure in the future?

Track your progress over time

Start a Respond to security incidents only practice session

Related SC-200 topic practice pages

Manage a security operations environment practice questions

Respond to security incidents practice questions

Perform threat hunting practice questions

SC-200 fundamentals practice questions

SC-200 scenario practice questions

SC-200 troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid