SC-200 Incident Response & Remediation 2 — Questions and Answers
Question 1: During a ransomware incident, a security analyst needs to isolate a compromised Windows device from the network while preserving the ability to manage it remotely via Microsoft Defender for Endpoint. Which action should be taken?
- Delete the device from Azure AD
- Contain the device using the Isolate Device action in the MDE portal (Correct answer)
- Disable the device's NIC via Group Policy
- Power off the device immediately
Correct answer: Contain the device using the Isolate Device action in the MDE portal
The Isolate Device action in Microsoft Defender for Endpoint blocks all network traffic except the MDE management channel, enabling continued remote investigation.
Question 2: A SOC analyst is investigating an alert triggered by Microsoft Sentinel indicating a suspicious process injection. Which KQL query clause would filter ProcessCreationEvents to show only events where a child process spawned from an unexpected parent?
- where ProcessCommandLine has 'injection'
- where InitiatingProcessFileName !in ('explorer.exe', 'svchost.exe') and FileName == 'powershell.exe' (Correct answer)
- where AccountName contains 'admin'
- where LogonType == 3
Correct answer: where InitiatingProcessFileName !in ('explorer.exe', 'svchost.exe') and FileName == 'powershell.exe'
Filtering by unexpected parent processes (InitiatingProcessFileName) helps surface process injection and living-off-the-land techniques.
Question 3: After containing a compromised endpoint, an analyst must determine the scope of lateral movement. Which Microsoft Defender for Endpoint feature provides a visual timeline of all machine interactions and network connections for a specific device?
- Threat Analytics
- Device Timeline (Correct answer)
- Advanced Hunting query builder
- Secure Score dashboard
Correct answer: Device Timeline
The Device Timeline in MDE shows a chronological record of events, alerts, and network connections for an endpoint, aiding scope determination.
Question 4: An organization wants to automatically trigger an isolation playbook in Microsoft Sentinel when a high-severity alert involving a specific host is generated. What should the analyst configure?
- An analytics rule with an automation rule that runs a playbook (Correct answer)
- A workbook with a saved query
- A watchlist with host IP addresses
- A data connector with custom parsing
Correct answer: An analytics rule with an automation rule that runs a playbook
Analytics rules detect threats and automation rules can trigger Logic Apps (playbooks) based on incident conditions such as severity and entity type.
Question 5: A threat actor used Pass-the-Hash to move laterally across several Windows servers. Which remediation step is MOST effective at preventing reuse of the stolen NTLM hash?
- Reset the compromised account password and invalidate existing sessions (Correct answer)
- Disable SMBv1 on all servers
- Enable Windows Firewall on all affected hosts
- Delete the account from Active Directory temporarily
Correct answer: Reset the compromised account password and invalidate existing sessions
Resetting the password invalidates the existing NTLM hash, preventing its reuse in future Pass-the-Hash attacks.
Question 6: Microsoft Defender for Cloud generates a security alert for a suspicious outbound connection from an Azure VM to a known C2 IP. Which response action can be taken directly from Defender for Cloud without leaving the portal?
- Revoke the VM's managed identity
- Apply a just-in-time network access policy to block the IP (Correct answer)
- Delete the VM's OS disk snapshot
- Rotate the VM's administrator password
Correct answer: Apply a just-in-time network access policy to block the IP
Defender for Cloud allows applying JIT network access policies and NSG rules directly to restrict suspicious outbound connections from VMs.
Question 7: During post-incident analysis of a Business Email Compromise (BEC) attack, an analyst reviews the Microsoft 365 Unified Audit Log. Which activity type indicates the attacker created a mail forwarding rule to exfiltrate email?
- MailItemsAccessed
- New-InboxRule (Correct answer)
- FileDownloaded
- UserLoggedIn
Correct answer: New-InboxRule
The New-InboxRule audit event records creation of inbox rules, which attackers commonly use to forward or delete emails to cover tracks.
SC-200 Incident Response & Remediation 2
During a ransomware incident, a security analyst needs to isolate a compromised Windows device from the network while preserving the ability to manage it remotely via Microsoft Defender for Endpoint.
Which action should be taken?