SC-200 Incident Response & Remediation 5

Question 1

A threat actor used OAuth application consent phishing to gain persistent access to a Microsoft 365 tenant. Which remediation step revokes the attacker's delegated permissions?

Accepted Answer

Remove the malicious OAuth app's enterprise application and revoke its granted permissions in Microsoft Entra ID

Answer

Reset the global administrator password

Answer

Disable legacy authentication protocols

Answer

Enable Microsoft Defender for Cloud Apps

Question 2

During forensic investigation of an Azure VM compromise, an analyst needs to examine the VM's disk without running the potentially compromised OS. Which approach should be used?

Accepted Answer

Snapshot the OS disk and attach it to a clean forensic VM as a data disk

Answer

Restart the VM in safe mode via the Azure portal

Answer

Run Azure Security Center's vulnerability scan on the running VM

Answer

Enable boot diagnostics and review the serial console output

Question 3

An analyst uses Microsoft Defender for Cloud Apps to investigate a mass download alert. Which MCAS feature shows a detailed activity log of the specific files downloaded by the suspicious user?

Accepted Answer

Activity log filtered by the user and activity type 'Download'

Answer

Cloud Discovery dashboard

Answer

App risk score report

Answer

Policy match alerts summary

Question 4

A SOC analyst needs to determine whether a suspicious PowerShell command executed on an endpoint was encoded. Which KQL function decodes a Base64-encoded command line in an Advanced Hunting query?

Accepted Answer

base64_decode_tostring()

Answer

parse_json()

Answer

extract()

Answer

split()

Question 5

After an insider threat incident, the organization wants to monitor for future bulk file downloads from SharePoint Online. Which Microsoft solution provides built-in policies specifically for cloud app anomaly detection of this behavior?

Accepted Answer

Microsoft Purview Insider Risk Management

Answer

Microsoft Entra ID Protection

Answer

Microsoft Defender for Endpoint behavioral rules

Answer

Azure Monitor diagnostic logs

Question 6

During an incident response, an analyst discovers a malicious scheduled task set to run at user logon. Which Microsoft Defender for Endpoint live response command would remove the scheduled task from the compromised endpoint?

Accepted Answer

run schtasks /delete /tn <taskname> /f

Answer

remediate-file

Answer

isolate-device

Answer

collect-investigation-package

Question 7

A security operations team wants to measure the mean time to respond (MTTR) to incidents handled through Microsoft Sentinel. Where would an analyst find this metric natively within Sentinel?

Accepted Answer

The Efficiency workbook in Microsoft Sentinel Workbooks

Answer

The Threat Intelligence blade

Answer

The Data Connectors health dashboard

Answer

The Analytics rules audit log