An incident involves a file that was detected as malware on multiple devices. You need to determine if the file is part of a larger campaign and if any users were affected. What should you do?

Run a live response command to check the file's hash.

Delete the file from all devices.

Investigate the file entity to see all devices and users associated with it.

Review the device timeline of one affected device.

A phishing attack compromised several user accounts. You have identified the phishing email and the malicious link. You need to remediate the incident and prevent users from clicking the link again. What should you do?

Block the malicious URL using an indicator, reset the compromised accounts' passwords, and review the device timelines for any related activity.

Delete the phishing email from all mailboxes.

Isolate all devices that received the phishing email.

Only reset the passwords of the compromised accounts.

A device was compromised by malware that uses a legitimate remote administration tool for persistence. The malware is not detected by antivirus, and you need to remediate the device without breaking the legitimate use of the remote administration tool. What should you do?

Use live response to identify the specific process or service associated with the malware and disable or remove only that component.

Collect an investigation package and send it to Microsoft for analysis.

Block the remote administration tool's executable using an indicator.

Isolate the device and reimage it to ensure the malware is removed.

Microsoft Certified:Security Operations Analyst Associate

Domain 2Objective 2

Respond to Alerts and Incidents in Microsoft Defender for Endpoint SC-200 Practice Questions (Page 4)

Part of the Respond to security incidents domain, which accounts for 35–40% of the SC-200 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~14–26 in this domain), expect 5–9 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

7concepts

35–40%of the exam

Questions 16–20

16foundation · easy
Which action in Microsoft Defender for Endpoint initiates the collection of an investigation package from a device?
Select an answer first
17application · medium
An incident involves a file that was detected as malware on multiple devices. You need to determine if the file is part of a larger campaign and if any users were affected. What should you do?
Select an answer first
18application · medium
A phishing attack compromised several user accounts. You have identified the phishing email and the malicious link. You need to remediate the incident and prevent users from clicking the link again. What should you do?
Select an answer first
19foundation · easy
In Microsoft Defender for Endpoint, which step involves reviewing collected data such as files, processes, and network connections to determine the nature and scope of an incident?
Select an answer first
20expert · hard
A device was compromised by malware that uses a legitimate remote administration tool for persistence. The malware is not detected by antivirus, and you need to remediate the device without breaking the legitimate use of the remote administration tool. What should you do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-200

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-200” is a trademark of its owner, used for identification only.

Respond to Alerts and Incidents in Microsoft Defender for Endpoint SC-200 Practice Questions (Page 4)

Questions 16–20

Which action in Microsoft Defender for Endpoint initiates the collection of an investigation package from a device?

An incident involves a file that was detected as malware on multiple devices. You need to determine if the file is part of a larger campaign and if any users were affected. What should you do?

A phishing attack compromised several user accounts. You have identified the phishing email and the malicious link. You need to remediate the incident and prevent users from clicking the link again. What should you do?

In Microsoft Defender for Endpoint, which step involves reviewing collected data such as files, processes, and network connections to determine the nature and scope of an incident?

A device was compromised by malware that uses a legitimate remote administration tool for persistence. The malware is not detected by antivirus, and you need to remediate the device without breaking the legitimate use of the remote administration tool. What should you do?

Keep studying — Respond to security incidents