SC-200 Incident Response & Remediation 2

Question 1

During a ransomware incident, a security analyst needs to isolate a compromised Windows device from the network while preserving the ability to manage it remotely via Microsoft Defender for Endpoint.
Which action should be taken?

Accepted Answer

Contain the device using the Isolate Device action in the MDE portal

Answer

Delete the device from Azure AD

Answer

Disable the device's NIC via Group Policy

Answer

Power off the device immediately

Question 2

A SOC analyst is investigating an alert triggered by Microsoft Sentinel indicating a suspicious process injection. Which KQL query clause would filter ProcessCreationEvents to show only events where a child process spawned from an unexpected parent?

Accepted Answer

where InitiatingProcessFileName !in ('explorer.exe', 'svchost.exe') and FileName == 'powershell.exe'

Answer

where ProcessCommandLine has 'injection'

Answer

where AccountName contains 'admin'

Answer

where LogonType == 3

Question 3

After containing a compromised endpoint, an analyst must determine the scope of lateral movement. Which Microsoft Defender for Endpoint feature provides a visual timeline of all machine interactions and network connections for a specific device?

Accepted Answer

Device Timeline

Answer

Threat Analytics

Answer

Advanced Hunting query builder

Answer

Secure Score dashboard

Question 4

An organization wants to automatically trigger an isolation playbook in Microsoft Sentinel when a high-severity alert involving a specific host is generated. What should the analyst configure?

Accepted Answer

An analytics rule with an automation rule that runs a playbook

Answer

A workbook with a saved query

Answer

A watchlist with host IP addresses

Answer

A data connector with custom parsing

Question 5

A threat actor used Pass-the-Hash to move laterally across several Windows servers. Which remediation step is MOST effective at preventing reuse of the stolen NTLM hash?

Accepted Answer

Reset the compromised account password and invalidate existing sessions

Answer

Disable SMBv1 on all servers

Answer

Enable Windows Firewall on all affected hosts

Answer

Delete the account from Active Directory temporarily

Question 6

Microsoft Defender for Cloud generates a security alert for a suspicious outbound connection from an Azure VM to a known C2 IP. Which response action can be taken directly from Defender for Cloud without leaving the portal?

Accepted Answer

Apply a just-in-time network access policy to block the IP

Answer

Revoke the VM's managed identity

Answer

Delete the VM's OS disk snapshot

Answer

Rotate the VM's administrator password

Question 7

During post-incident analysis of a Business Email Compromise (BEC) attack, an analyst reviews the Microsoft 365 Unified Audit Log. Which activity type indicates the attacker created a mail forwarding rule to exfiltrate email?

Accepted Answer

New-InboxRule

Answer

MailItemsAccessed

Answer

FileDownloaded

Answer

UserLoggedIn