Which of the following is an example of a live response action that can be performed on a device in Microsoft Defender for Endpoint?

Modifying the device's BIOS settings

Running a script to collect forensic data

Changing the device's operating system

Deleting the device from the organization's Azure AD

An automatic attack disruption incident indicates that a user account was used to launch a ransomware attack. The disruption contained the attack, but you need to determine if the user account was compromised or if the user was involved. You also need to assess the impact on other devices. What should you do?

Reset the user's password and assume the account was compromised.

Review the automatic attack disruption details and close the incident.

Investigate the user entity to see all logons and activities, and correlate with the device timelines of affected devices.

Isolate all devices the user has logged into.

When investigating a file entity in Microsoft Defender for Endpoint, which information would an analyst typically find?

Network's firewall rules and routing tables

User's email address and phone number

File's prevalence, detection details, and related alerts

Device's operating system and hardware details

In Microsoft Defender for Endpoint, which of the following is an example of an incident remediation action?

Isolating an affected device from the network

Collecting an investigation package

In Microsoft Defender for Endpoint, what is the purpose of automatic attack disruption?

To provide a weekly report of security incidents

To update antivirus definitions automatically

To automatically contain and stop ongoing attacks in real-time

To replace the need for security analysts

Microsoft Certified:Security Operations Analyst Associate

Domain 2Objective 2

Respond to Alerts and Incidents in Microsoft Defender for Endpoint SC-200 Practice Questions (Page 7)

Part of the Respond to security incidents domain, which accounts for 35–40% of the SC-200 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~14–26 in this domain), expect 5–9 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

7concepts

35–40%of the exam

Questions 31–35

31foundation · easy
Which of the following is an example of a live response action that can be performed on a device in Microsoft Defender for Endpoint?
Select an answer first
32expert · hard
An automatic attack disruption incident indicates that a user account was used to launch a ransomware attack. The disruption contained the attack, but you need to determine if the user account was compromised or if the user was involved. You also need to assess the impact on other devices. What should you do?
Select an answer first
33foundation · easy
When investigating a file entity in Microsoft Defender for Endpoint, which information would an analyst typically find?
Select an answer first
34foundation · easy
In Microsoft Defender for Endpoint, which of the following is an example of an incident remediation action?
Select an answer first
35foundation · easy
In Microsoft Defender for Endpoint, what is the purpose of automatic attack disruption?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-200

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-200” is a trademark of its owner, used for identification only.