SC-200 Incident Response & Remediation 4

Question 1

A Microsoft Sentinel playbook must automatically add a malicious IP to a Threat Intelligence watchlist and block it via an Azure Firewall policy. Which Logic App connector enables querying and updating Microsoft Sentinel watchlists?

Accepted Answer

Microsoft Sentinel connector

Answer

The Microsoft Sentinel Logic Apps connector provides actions to add, update, and query watchlist items as part of automated response playbooks.

Question 2

An analyst suspects credential dumping via lsass.exe on a Windows endpoint. Which Microsoft Defender for Endpoint detection would most directly confirm this activity?

Accepted Answer

An alert for 'Suspicious process accessed LSASS memory'

Answer

MDE detects and alerts on processes that read LSASS memory using techniques consistent with credential dumping tools like Mimikatz.

Question 3

During incident triage in Microsoft Defender XDR, an analyst wants to correlate alerts from Defender for Endpoint, Defender for Office 365, and Defender for Identity into a single view. Which feature provides this unified correlation?

Accepted Answer

Incidents page in the Microsoft Defender portal

Answer

The Incidents page in the Microsoft Defender portal correlates alerts across all Defender products into unified incidents showing the full attack chain.

Question 4

A Golden Ticket attack is detected in the environment. Which two immediate remediation actions are MOST critical?

Accepted Answer

Reset the KRBTGT account password twice and reboot all domain controllers

Answer

Resetting the KRBTGT password twice invalidates all existing Kerberos tickets, including forged Golden Tickets, eliminating the attacker's persistence.

Question 5

An analyst needs to run a live response session on a compromised Linux endpoint enrolled in Microsoft Defender for Endpoint to collect a memory dump. Which MDE feature enables this?

Accepted Answer

Live Response console in the MDE portal

Answer

The Live Response console in MDE allows analysts to remotely run scripts, collect files, and execute forensic commands on enrolled endpoints including Linux.

(SC-200) Microsoft Security Operations Analyst Practice Test

(SC-200) Microsoft Security Operations Analyst Practice Test

SC-200 Incident Response & Remediation 4