During an investigation, you find that a file with a specific hash was executed on multiple devices. You need to determine which users are affected and what actions they took. What should you do?

Isolate all devices that executed the file.

Collect investigation packages from all affected devices.

Reset passwords for all users who logged into the affected devices.

Use the file entity page to see a list of devices and users associated with the file.

You are investigating a device that was compromised. The device timeline shows that a user logged in from an unusual IP address, then a file was downloaded, and then the user's account was used to access a sensitive share. You need to determine if the user's account is compromised and if the sensitive share was accessed. What should you do?

Review the device timeline only and ignore the user entity.

Investigate the user entity to see all logons and activities, and review the device timeline to correlate the events.

Isolate the device and check the sensitive share's access logs.

Reset the user's password and force a sign-out.

An automatic attack disruption incident is raised for a device that was attempting to spread ransomware. The disruption contained the attack, but you need to ensure the device is safe and the threat is fully removed. What should you do?

Isolate the device indefinitely to prevent further spread.

Collect an investigation package and send it to Microsoft for analysis.

Run a live response session to check for any remaining malicious processes and clean them.

Trust the automatic disruption and close the incident.

You are investigating a device that was compromised. The device timeline shows a series of events: a user double-clicked a malicious attachment, which launched a PowerShell script, which then created a scheduled task. The scheduled task is set to run every hour. You need to determine if the scheduled task is still active and what it does. You also need to remediate the device without disrupting business operations. What should you do?

Isolate the device and then reimage it.

Use live response to query the scheduled task and its actions, then remove the task if it is malicious.

Collect an investigation package and analyze it offline.

Delete the PowerShell script file from the device.

After containing a malware outbreak, you need to ensure the same malware cannot infect devices again. The malware used a specific file hash and a scheduled task for persistence. What should you do?

Run a full antivirus scan on all devices.

Add the file hash to the indicator list and disable the scheduled task on affected devices.

Isolate all devices that were infected.

Reset all user passwords and enable MFA.

Microsoft Certified:Security Operations Analyst Associate

Domain 2Objective 2

Respond to Alerts and Incidents in Microsoft Defender for Endpoint SC-200 Practice Questions (Page 2)

Part of the Respond to security incidents domain, which accounts for 35–40% of the SC-200 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~14–26 in this domain), expect 5–9 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

7concepts

35–40%of the exam

Questions 6–10

6application · medium
During an investigation, you find that a file with a specific hash was executed on multiple devices. You need to determine which users are affected and what actions they took. What should you do?
Select an answer first
7expert · hard
You are investigating a device that was compromised. The device timeline shows that a user logged in from an unusual IP address, then a file was downloaded, and then the user's account was used to access a sensitive share. You need to determine if the user's account is compromised and if the sensitive share was accessed. What should you do?
Select an answer first
8application · medium
An automatic attack disruption incident is raised for a device that was attempting to spread ransomware. The disruption contained the attack, but you need to ensure the device is safe and the threat is fully removed. What should you do?
Select an answer first
9expert · hard
You are investigating a device that was compromised. The device timeline shows a series of events: a user double-clicked a malicious attachment, which launched a PowerShell script, which then created a scheduled task. The scheduled task is set to run every hour. You need to determine if the scheduled task is still active and what it does. You also need to remediate the device without disrupting business operations. What should you do?
Select an answer first
10application · medium
After containing a malware outbreak, you need to ensure the same malware cannot infect devices again. The malware used a specific file hash and a scheduled task for persistence. What should you do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-200

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-200” is a trademark of its owner, used for identification only.

Respond to Alerts and Incidents in Microsoft Defender for Endpoint SC-200 Practice Questions (Page 2)

Questions 6–10

During an investigation, you find that a file with a specific hash was executed on multiple devices. You need to determine which users are affected and what actions they took. What should you do?

An automatic attack disruption incident is raised for a device that was attempting to spread ransomware. The disruption contained the attack, but you need to ensure the device is safe and the threat is fully removed. What should you do?

After containing a malware outbreak, you need to ensure the same malware cannot infect devices again. The malware used a specific file hash and a scheduled task for persistence. What should you do?

Keep studying — Respond to security incidents