SC-200 Incident Response & Remediation 3

Question 1

A phishing campaign delivered a malicious macro-enabled document to multiple users. An analyst needs to remove the malicious file from all affected mailboxes in Microsoft 365. Which tool should be used?

Accepted Answer

Microsoft Defender portal Content Search and Purge

Answer

The Content Search and Purge capability in the Microsoft Defender portal (or Compliance center) allows soft- or hard-deleting messages from multiple mailboxes at once.

Question 2

When investigating a compromised Azure service principal, which Microsoft Entra ID sign-in log property indicates the authentication method used and whether MFA was satisfied?

Accepted Answer

Authentication requirement

Answer

The 'Authentication requirement' field in Entra ID sign-in logs shows whether single-factor or multi-factor authentication was required and completed.

Question 3

A SOC team receives a Microsoft Sentinel incident for credential stuffing against an Azure AD tenant. Which built-in UEBA feature helps determine if the logins originated from an unusual location for the targeted users?

Accepted Answer

Entity behavior analytics anomaly detection

Answer

Microsoft Sentinel's UEBA (User and Entity Behavior Analytics) builds behavioral baselines per user and flags logins from unusual locations or times.

Question 4

After a confirmed data exfiltration incident in Microsoft 365, the compliance team asks for an evidence preservation hold. Which feature should the analyst configure?

Accepted Answer

Litigation Hold on affected mailboxes

Answer

Litigation Hold in Exchange Online preserves all mailbox content regardless of user actions, ensuring evidence integrity for forensic and legal review.

Question 5

An analyst identifies that an attacker exfiltrated data via Azure Blob Storage using a stolen SAS token. What is the fastest remediation to revoke access without deleting the storage account?

Accepted Answer

Rotate the storage account access keys to invalidate the SAS token

Answer

SAS tokens signed with account keys are immediately invalidated when the account keys are rotated, cutting off the attacker's access.

(SC-200) Microsoft Security Operations Analyst Practice Test

(SC-200) Microsoft Security Operations Analyst Practice Test

SC-200 Incident Response & Remediation 3