How should I use these Respond to security incidents practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Respond to security incidents questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Respond to security incidents domain.

SC-200 · topic practice

Respond to security incidents practice questions

Practise Microsoft Security Operations Analyst SC-200 Respond to security incidents practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Respond to security incidents

Practice 10 questions Browse domain →

What the exam tests

What to know about Respond to security incidents

Respond to security incidents questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Respond to security incidents exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Respond to security incidents questions

20 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Read the full Ansible explanation →

You are investigating a security incident in Microsoft Sentinel where a user received a phishing email containing a link to a malicious domain. The link was clicked, but no further actions were observed. Which playbook action should you take immediately to prevent potential lateral movement?

Trap 1: Disable the user's account

The user clicked a link but no compromise is confirmed; disabling is too aggressive without evidence.

Trap 2: Revoke the user's active sessions

Revoking sessions is for token theft; not indicated here.

Trap 3: Reset the user's password

Password reset is for confirmed credential compromise; here only a link was clicked.

Study all Respond to security incidents common traps →

A
Disable the user's account
Why wrong: The user clicked a link but no compromise is confirmed; disabling is too aggressive without evidence.
B
Revoke the user's active sessions
Why wrong: Revoking sessions is for token theft; not indicated here.
C
Reset the user's password
Why wrong: Password reset is for confirmed credential compromise; here only a link was clicked.
D
Block the malicious domain on the firewall
Blocking the domain prevents further access to the malicious site, containing the threat.

Respond to security incidents practice questions

What to know about Respond to security incidents

Common Respond to security incidents exam traps

Respond to security incidents questions

You are investigating a security incident in Microsoft Sentinel where a user received a phishing email containing a link to a malicious domain. The link was clicked, but no further actions were observed. Which playbook action should you take immediately to prevent potential lateral movement?

During a ransomware incident, Microsoft Defender for Cloud Apps alerts indicate that a user is uploading large volumes of data to an external cloud storage provider not approved by your organization. Which two actions should you take first? (Choose two.)

Your security team uses Microsoft Sentinel analytics rules to detect brute-force attacks. A rule triggers when more than 10 failed logins occur within 5 minutes from a single IP. An incident is generated. Which first step should the analyst take?

An incident in Microsoft Defender XDR involves a device that is suspected to be infected with ransomware. The device is online and actively encrypting files. Which action should you take to contain the threat?

Your organization uses Microsoft Sentinel with UEBA (User and Entity Behavior Analytics). An alert indicates a user's sign-in from an unusual location, followed by a mass download of sensitive files from SharePoint. The user is a low-privilege employee. What is the most likely conclusion?

In Microsoft Sentinel, an incident is created from a Fusion rule that correlates multiple alerts. The incident has a high severity. What should the analyst do first?

You are responding to an incident where a user's credentials were used to access a federated SaaS application from an IP address associated with a known threat actor. The user's account is not disabled. Which action is most effective to prevent further unauthorized access?

During an incident response, you need to collect forensic data from Microsoft Defender for Endpoint (MDE) on a remote device that is currently offline. What is the best approach?

An incident in Microsoft Sentinel involves a phishing campaign that delivered a malicious macro-enabled document. The document was opened by 15 users. Which playbook action should be triggered automatically to contain the threat?

An analyst creates a playbook in Microsoft Sentinel to automatically block an IP address when an alert fires. However, the playbook fails to block the IP. What is the most likely cause?

Exhibit

You run the above KQL query in Microsoft Sentinel to identify ransomware alerts from the last day. The result shows zero rows. Which is the most likely reason?

Exhibit

An administrator creates a Microsoft Defender for Cloud Apps policy to block unsanctioned cloud storage apps. Despite the policy, users can still access these apps. What is the most likely cause?

Exhibit

Which TWO actions are appropriate when responding to a confirmed data exfiltration incident via email?

Which THREE steps should be included in a Microsoft Sentinel playbook for automatic incident response when a high-severity alert fires?

Which THREE conditions must be met for Microsoft Sentinel to automatically run a playbook on an incident?

Your organization uses Microsoft Defender for Office 365. A user reports receiving a phishing email that bypassed the default policy. You need to create a custom anti-phishing policy to block similar emails in the future. What should you configure?

You have a Microsoft Sentinel analytical rule with the above configuration. During a security incident, multiple high-severity alerts are generated within a 5-minute window. How does the rule handle these alerts?

Exhibit

You are deploying Microsoft Sentinel using the above ARM template parameters. After deployment, you notice that Microsoft Defender for Cloud alerts are not being ingested. What is the MOST likely reason?

Exhibit

Track your progress over time

Start a Respond to security incidents only practice session

Related SC-200 topic practice pages

Manage a security operations environment practice questions

Respond to security incidents practice questions

Perform threat hunting practice questions

Mitigate threats using Microsoft Defender XDR practice questions

Mitigate threats using Microsoft Defender for Cloud practice questions

Mitigate threats using Microsoft Sentinel practice questions

SC-200 fundamentals practice questions

SC-200 scenario practice questions

SC-200 troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid