A device is suspected of being used as a pivot point for lateral movement. You need to gather real-time information about the device's current state, including running processes and open network connections, and then preserve that information for later analysis. What should you do?

Initiate a live response session, run commands to list processes and connections, and then collect an investigation package.

Collect an investigation package only, as it contains all the needed information.

Use the device timeline to view past events.

Isolate the device immediately and then run a scan.

A user reports that their workstation has been running slowly and showing pop-ups. In Microsoft Defender for Endpoint, you open the device timeline and see a process that launched from a temp folder, then made an outbound connection to an IP known for C2 activity. You also notice the same process attempted to access multiple files on the device. Which action should you take first to contain the threat while preserving evidence?

Run a Live Response session and kill the process immediately.

Isolate the device, then collect an investigation package and analyze the timeline.

Disable the user account and reset their password.

Collect an investigation package from the device before taking any other action.

Microsoft Defender for Endpoint generates an incident labeled 'Automatic attack disruption' for a device. The incident indicates that a ransomware attack was automatically contained. You need to understand what happened and ensure the threat is fully remediated. What should you do?

Disable automatic attack disruption to prevent false positives.

Immediately reimage the device to ensure it is clean.

Review the incident details and the device timeline to understand the attack, then verify that the containment actions were effective.

Ignore the incident because automatic disruption already handled it.

An incident involves a user account that was used to log into multiple devices. You need to assess the impact of the compromised account across the environment. What should you do?

Review the device timeline of only one device.

Reset the user's password and move on.

Investigate the user entity to see all devices and activities associated with the account.

Isolate all devices the user has ever logged into.

You need to collect evidence from a device that is suspected of being compromised, but the device is in a remote office with limited bandwidth. You need to minimize the amount of data transferred while still collecting relevant evidence. What should you do?

Ask the user to upload the files manually.

Use Live Response to manually collect specific files and event logs that are relevant to the incident.

Run a remote antivirus scan and collect the scan logs.

Collect a full investigation package, which includes a memory dump and all event logs.

Microsoft Certified:Security Operations Analyst Associate

Domain 2Objective 2

Respond to Alerts and Incidents in Microsoft Defender for Endpoint SC-200 Practice Questions (Page 3)

Part of the Respond to security incidents domain, which accounts for 35–40% of the SC-200 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~14–26 in this domain), expect 5–9 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

7concepts

35–40%of the exam

Questions 11–15

11application · medium
A device is suspected of being used as a pivot point for lateral movement. You need to gather real-time information about the device's current state, including running processes and open network connections, and then preserve that information for later analysis. What should you do?
Select an answer first
12application · medium
A user reports that their workstation has been running slowly and showing pop-ups. In Microsoft Defender for Endpoint, you open the device timeline and see a process that launched from a temp folder, then made an outbound connection to an IP known for C2 activity. You also notice the same process attempted to access multiple files on the device. Which action should you take first to contain the threat while preserving evidence?
Select an answer first
13application · medium
Microsoft Defender for Endpoint generates an incident labeled 'Automatic attack disruption' for a device. The incident indicates that a ransomware attack was automatically contained. You need to understand what happened and ensure the threat is fully remediated. What should you do?
Select an answer first
14application · medium
An incident involves a user account that was used to log into multiple devices. You need to assess the impact of the compromised account across the environment. What should you do?
Select an answer first
15expert · hard
You need to collect evidence from a device that is suspected of being compromised, but the device is in a remote office with limited bandwidth. You need to minimize the amount of data transferred while still collecting relevant evidence. What should you do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-200

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-200” is a trademark of its owner, used for identification only.