A device is suspected of being used for data exfiltration. You need to capture the current network connections and running processes to understand the exfiltration method. However, the device is in a remote office with limited bandwidth, and you need to minimize the amount of data transferred. What should you do?

Use the device timeline to review past network connections.

Isolate the device first to stop the exfiltration, then collect evidence.

Collect a full investigation package to ensure you have all evidence.

Use live response to run targeted commands that list network connections and processes, and output only the necessary information.

A device timeline shows a series of events: a user logged in, then a PowerShell process ran, then a file was downloaded, then the file was executed, and then the device made outbound connections. You need to determine if this is a true positive or a false positive, and you have limited time. What should you do?

Collect an investigation package and perform deep memory analysis.

Isolate the device immediately and then analyze the timeline.

Review the file's reputation and the PowerShell command line to assess maliciousness.

Check the user's recent email activity for phishing indicators.

What is the primary goal of incident remediation in Microsoft Defender for Endpoint?

To collect as much evidence as possible

To update the organization's security policies

To resolve the incident and prevent future occurrences

To identify the attacker's identity

During an incident investigation, you find that a specific user account was used to log into multiple devices and download a suspicious file. You need to assess the impact of this user's actions. What should you do?

Collect investigation packages from all devices the user accessed.

Reset the user's password and enable MFA.

Use the user entity page to view related devices, logons, and alerts.

Isolate all devices the user logged into.

Microsoft Certified:Security Operations Analyst Associate

Domain 2Objective 2

Respond to Alerts and Incidents in Microsoft Defender for Endpoint SC-200 Practice Questions (Page 5)

Part of the Respond to security incidents domain, which accounts for 35–40% of the SC-200 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~14–26 in this domain), expect 5–9 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

7concepts

35–40%of the exam

Questions 21–25

21expert · hard
A device is suspected of being used for data exfiltration. You need to capture the current network connections and running processes to understand the exfiltration method. However, the device is in a remote office with limited bandwidth, and you need to minimize the amount of data transferred. What should you do?
Select an answer first
22expert · hard
A device timeline shows a series of events: a user logged in, then a PowerShell process ran, then a file was downloaded, then the file was executed, and then the device made outbound connections. You need to determine if this is a true positive or a false positive, and you have limited time. What should you do?
Select an answer first
23foundation · easy
What is the primary goal of incident remediation in Microsoft Defender for Endpoint?
Select an answer first
24foundation · easy
In Microsoft Defender for Endpoint, which capability allows a security analyst to run commands on a device in real-time to collect data or remediate threats?
Select an answer first
25application · medium
During an incident investigation, you find that a specific user account was used to log into multiple devices and download a suspicious file. You need to assess the impact of this user's actions. What should you do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-200

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-200” is a trademark of its owner, used for identification only.

Respond to Alerts and Incidents in Microsoft Defender for Endpoint SC-200 Practice Questions (Page 5)

Questions 21–25

What is the primary goal of incident remediation in Microsoft Defender for Endpoint?

In Microsoft Defender for Endpoint, which capability allows a security analyst to run commands on a device in real-time to collect data or remediate threats?

During an incident investigation, you find that a specific user account was used to log into multiple devices and download a suspicious file. You need to assess the impact of this user's actions. What should you do?

Keep studying — Respond to security incidents