SC-200 Respond to security incidents Practice Question
Your organization uses Microsoft Defender for Cloud. You receive a security alert about a suspicious process on a virtual machine. You want to investigate the process further. What should you do?
⚠ Common exam trap
Watch out — candidates often confuse automated investigation (which runs a predefined playbook) with live response (which provides manual, interactive access), leading them to select option D because they think automation is the default way to respond to alerts.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Initiate a live response session on the VM from Microsoft Defender for Cloud.
Microsoft Defender for Cloud's live response capability allows you to remotely connect to a VM and perform real-time forensic actions, such as running commands, examining running processes, and collecting artifacts. This is the most direct way to investigate a suspicious process on a specific VM, as it provides interactive access without needing to install additional agents or reboot the machine.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a custom detection rule to alert on similar processes.
Why it's wrong here
Creating a custom detection rule is a proactive hunting measure that uses KQL queries to generate alerts for future occurrences of similar processes. It does not provide real-time visibility into the currently running process or allow you to inspect its behavior, memory, or network activity. For an immediate investigation, you need interactive access to the VM, not a rule that only fires on new events.
- ✗
Run a vulnerability assessment scan on the VM.
Why it's wrong here
A vulnerability assessment scan evaluates the VM against known vulnerabilities and missing security updates, producing a report of configuration weaknesses. It does not examine processes, their command lines, or their runtime behavior, so it cannot tell you what the suspicious process is doing. This approach is useful for hardening the VM, but it is not a real-time forensic investigation tool.
- ✓
Initiate a live response session on the VM from Microsoft Defender for Cloud.
Why this is correct
Initiating a live response session from Microsoft Defender for Cloud provides a remote interactive shell to the VM, allowing you to run commands, inspect running processes, collect forensic artifacts, and terminate suspicious processes in real time. Live response is specifically designed for ad-hoc investigations where you need immediate, hands-on visibility. This is the appropriate action when you have identified a specific process and need to examine it directly.
- ✗
Initiate an automated investigation on the VM.
Why it's wrong here
An automated investigation runs predefined playbooks that are typically triggered by an alert, and it automatically executes remediation actions without your direct control. It is not designed for ad-hoc manual investigation of a specific process, and it may not focus on the particular process you are concerned about. Live response gives you the flexibility to target the process directly, whereas automated investigation is for incident response workflows.
Go deeper
Related to this question
About these practice questions
This SC-200 question is part of Courseiva's 1,303-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.