When analyzing a device timeline in Microsoft Defender for Endpoint, which type of information would an analyst primarily use to identify patterns of suspicious activity?

Events such as process creation, file creation, and network connections

Network firewall configuration rules

Cloud subscription billing details

User password hashes and authentication tokens

You have collected an investigation package from a compromised device. The package includes a memory dump and event logs. You need to identify the malware's persistence mechanism. What should you do?

Review the event logs for process creation events.

Analyze the memory dump for injected code.

Look for suspicious files in the package's file list.

Search the package for registry hive files and analyze them for run keys.

After remediating a malware infection on a device, you need to ensure that the device is clean and that no remnants of the malware remain. What should you do?

Use Live Response to delete all temporary files.

Isolate the device and monitor it for 24 hours.

Run a full antivirus scan on the device.

Collect an investigation package and analyze it for any remaining indicators.

Which of the following is a primary goal of evidence investigation in Microsoft Defender for Endpoint?

To automatically block all malicious IP addresses

To update the threat intelligence feed

To determine the impact and scope of a security incident

You are investigating a device that is part of a larger incident. The device timeline shows a series of events: a file downloaded, then executed, then made network connections. You need to determine if the file is malicious and if it is related to the larger incident. What should you do?

Collect an investigation package from the device.

Isolate the device to prevent further network connections.

Review the user's email logs for the file's origin.

Check the file's reputation and prevalence in the Microsoft Defender for Endpoint portal.

Microsoft Certified:Security Operations Analyst Associate

Domain 2Objective 2

Respond to Alerts and Incidents in Microsoft Defender for Endpoint SC-200 Practice Questions (Page 1)

Part of the Respond to security incidents domain, which accounts for 35–40% of the SC-200 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~14–26 in this domain), expect 5–9 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

7concepts

35–40%of the exam

Questions 1–5

1foundation · easy
When analyzing a device timeline in Microsoft Defender for Endpoint, which type of information would an analyst primarily use to identify patterns of suspicious activity?
Select an answer first
2application · medium
You have collected an investigation package from a compromised device. The package includes a memory dump and event logs. You need to identify the malware's persistence mechanism. What should you do?
Select an answer first
3application · medium
After remediating a malware infection on a device, you need to ensure that the device is clean and that no remnants of the malware remain. What should you do?
Select an answer first
4foundation · easy
Which of the following is a primary goal of evidence investigation in Microsoft Defender for Endpoint?
Select an answer first
5application · medium
You are investigating a device that is part of a larger incident. The device timeline shows a series of events: a file downloaded, then executed, then made network connections. You need to determine if the file is malicious and if it is related to the larger incident. What should you do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-200

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-200” is a trademark of its owner, used for identification only.