SC-200 Incident Response & Remediation 3

Question 1

A phishing campaign delivered a malicious macro-enabled document to multiple users.
An analyst needs to remove the malicious file from all affected mailboxes in Microsoft 365.
Which tool should be used?

Accepted Answer

Microsoft Defender portal Content Search and Purge

Answer

Exchange Admin Center Message Trace

Answer

Microsoft Entra ID Conditional Access

Answer

Microsoft Sentinel Watchlist

Question 2

When investigating a compromised Azure service principal, which Microsoft Entra ID sign-in log property indicates the authentication method used and whether MFA was satisfied?

Accepted Answer

Authentication requirement

Answer

Risk level

Answer

Conditional Access status

Answer

Client app field

Question 3

A SOC team receives a Microsoft Sentinel incident for credential stuffing against an Azure AD tenant. Which built-in UEBA feature helps determine if the logins originated from an unusual location for the targeted users?

Accepted Answer

Entity behavior analytics anomaly detection

Answer

Fusion alert correlation

Answer

Anomaly detection rules in Log Analytics

Answer

Microsoft Secure Score baseline

Question 4

After a confirmed data exfiltration incident in Microsoft 365, the compliance team asks for an evidence preservation hold. Which feature should the analyst configure?

Accepted Answer

Litigation Hold on affected mailboxes

Answer

Retention policy set to 'delete only'

Answer

Data Loss Prevention policy in audit mode

Answer

Microsoft Defender for Cloud Apps shadow IT discovery

Question 5

An analyst identifies that an attacker exfiltrated data via Azure Blob Storage using a stolen SAS token. What is the fastest remediation to revoke access without deleting the storage account?

Accepted Answer

Rotate the storage account access keys to invalidate the SAS token

Answer

Delete the blob container

Answer

Disable the storage account's firewall rules

Answer

Change the storage account's SKU tier

Question 6

During an active intrusion, a Defender for Endpoint alert shows a scheduled task was created for persistence. Which investigation step in MDE provides the full command line used to create the task?

Accepted Answer

Review the Alert Story graph

Answer

Check the Device Inventory list

Answer

Run a Secure Score assessment

Answer

Export the device's vulnerability report

Question 7

A compromised account sent thousands of spam emails before being detected. Which Microsoft 365 action should the analyst take to prevent further sending while investigation continues?

Accepted Answer

Block the user from signing in and remove the account from the Restricted Senders list after remediation

Answer

Remove the user from all distribution groups

Answer

Disable the user's mailbox archive

Answer

Set the user's mailbox to shared