SC-200 Incident Response & Remediation 5

Question 1

A threat actor used OAuth application consent phishing to gain persistent access to a Microsoft 365 tenant. Which remediation step revokes the attacker's delegated permissions?

Accepted Answer

Remove the malicious OAuth app's enterprise application and revoke its granted permissions in Microsoft Entra ID

Answer

Removing the enterprise application and revoking granted OAuth permissions in Entra ID eliminates the attacker's delegated access obtained through consent phishing.

Question 2

During forensic investigation of an Azure VM compromise, an analyst needs to examine the VM's disk without running the potentially compromised OS. Which approach should be used?

Accepted Answer

Snapshot the OS disk and attach it to a clean forensic VM as a data disk

Answer

Taking a disk snapshot and attaching it to a separate clean VM allows offline forensic analysis without risk of triggering malicious code on the compromised system.

Question 3

An analyst uses Microsoft Defender for Cloud Apps to investigate a mass download alert. Which MCAS feature shows a detailed activity log of the specific files downloaded by the suspicious user?

Accepted Answer

Activity log filtered by the user and activity type 'Download'

Answer

The MCAS Activity log can be filtered by user, date, and activity type to show exactly which files were downloaded during the suspicious session.

Question 4

A SOC analyst needs to determine whether a suspicious PowerShell command executed on an endpoint was encoded. Which KQL function decodes a Base64-encoded command line in an Advanced Hunting query?

Accepted Answer

base64_decode_tostring()

Answer

The KQL function base64_decode_tostring() decodes Base64-encoded strings, revealing obfuscated PowerShell commands in hunting queries.

Question 5

After an insider threat incident, the organization wants to monitor for future bulk file downloads from SharePoint Online. Which Microsoft solution provides built-in policies specifically for cloud app anomaly detection of this behavior?

Accepted Answer

Microsoft Purview Insider Risk Management

Answer

Microsoft Purview Insider Risk Management includes built-in policies for detecting data theft sequences such as bulk file downloads from SharePoint and OneDrive.

(SC-200) Microsoft Security Operations Analyst Practice Test

(SC-200) Microsoft Security Operations Analyst Practice Test

SC-200 Incident Response & Remediation 5