SC-200 Incident Response & Remediation 3 — Questions and Answers
Question 1: A phishing campaign delivered a malicious macro-enabled document to multiple users. An analyst needs to remove the malicious file from all affected mailboxes in Microsoft 365. Which tool should be used?
- Microsoft Defender portal Content Search and Purge (Correct answer)
- Exchange Admin Center Message Trace
- Microsoft Entra ID Conditional Access
- Microsoft Sentinel Watchlist
Correct answer: Microsoft Defender portal Content Search and Purge
The Content Search and Purge capability in the Microsoft Defender portal (or Compliance center) allows soft- or hard-deleting messages from multiple mailboxes at once.
Question 2: When investigating a compromised Azure service principal, which Microsoft Entra ID sign-in log property indicates the authentication method used and whether MFA was satisfied?
- Risk level
- Authentication requirement (Correct answer)
- Conditional Access status
- Client app field
Correct answer: Authentication requirement
The 'Authentication requirement' field in Entra ID sign-in logs shows whether single-factor or multi-factor authentication was required and completed.
Question 3: A SOC team receives a Microsoft Sentinel incident for credential stuffing against an Azure AD tenant. Which built-in UEBA feature helps determine if the logins originated from an unusual location for the targeted users?
- Entity behavior analytics anomaly detection (Correct answer)
- Fusion alert correlation
- Anomaly detection rules in Log Analytics
- Microsoft Secure Score baseline
Correct answer: Entity behavior analytics anomaly detection
Microsoft Sentinel's UEBA (User and Entity Behavior Analytics) builds behavioral baselines per user and flags logins from unusual locations or times.
Question 4: After a confirmed data exfiltration incident in Microsoft 365, the compliance team asks for an evidence preservation hold. Which feature should the analyst configure?
- Retention policy set to 'delete only'
- Litigation Hold on affected mailboxes (Correct answer)
- Data Loss Prevention policy in audit mode
- Microsoft Defender for Cloud Apps shadow IT discovery
Correct answer: Litigation Hold on affected mailboxes
Litigation Hold in Exchange Online preserves all mailbox content regardless of user actions, ensuring evidence integrity for forensic and legal review.
Question 5: An analyst identifies that an attacker exfiltrated data via Azure Blob Storage using a stolen SAS token. What is the fastest remediation to revoke access without deleting the storage account?
- Rotate the storage account access keys to invalidate the SAS token (Correct answer)
- Delete the blob container
- Disable the storage account's firewall rules
- Change the storage account's SKU tier
Correct answer: Rotate the storage account access keys to invalidate the SAS token
SAS tokens signed with account keys are immediately invalidated when the account keys are rotated, cutting off the attacker's access.
Question 6: During an active intrusion, a Defender for Endpoint alert shows a scheduled task was created for persistence. Which investigation step in MDE provides the full command line used to create the task?
- Review the Alert Story graph (Correct answer)
- Check the Device Inventory list
- Run a Secure Score assessment
- Export the device's vulnerability report
Correct answer: Review the Alert Story graph
The Alert Story (or attack story) graph in MDE shows the full process tree and command-line arguments associated with each alert event.
Question 7: A compromised account sent thousands of spam emails before being detected. Which Microsoft 365 action should the analyst take to prevent further sending while investigation continues?
- Remove the user from all distribution groups
- Block the user from signing in and remove the account from the Restricted Senders list after remediation (Correct answer)
- Disable the user's mailbox archive
- Set the user's mailbox to shared
Correct answer: Block the user from signing in and remove the account from the Restricted Senders list after remediation
Blocking sign-in stops active sessions, and removing the account from the Restricted Senders list (after cleanup) restores normal mail flow once remediation is confirmed.
SC-200 Incident Response & Remediation 3
A phishing campaign delivered a malicious macro-enabled document to multiple users.
An analyst needs to remove the malicious file from all affected mailboxes in Microsoft 365.
Which tool should be used?