Which of the following is an example of a case management technique used during a security incident?

Creating a timeline of events and actions taken

Implementing multi-factor authentication

Microsoft Entra ID reports a sign-in from an anonymous IP address for a user account. Microsoft Defender for Identity also shows a suspicious activity for the same user. The security team needs to investigate the potential compromise. What should the analyst do?

Block the anonymous IP address in the firewall.

Ignore the alert because anonymous IP addresses are common.

Review the sign-in logs in Microsoft Entra ID and the Defender for Identity alert details, then determine if the user's credentials are compromised.

Immediately reset the user's password without further investigation.

What is the primary benefit of using agentic AI, such as Microsoft Security Copilot, in incident investigation?

It automatically remediates all security incidents without human intervention

It replaces the need for human analysts

It automates complex investigation steps and provides actionable insights

It guarantees the elimination of all false positives

A user reports receiving a phishing email that was not blocked by Microsoft Defender for Office 365. The email contains a link to a credential-harvesting site. The security team needs to investigate why the email was not blocked and remediate the threat. What should the analyst do?

Use Threat Explorer to locate the email, review the detection details, and submit the email to Microsoft for analysis if it was missed.

Disable the user's account because they clicked the link.

Immediately block the sender's domain in the tenant's allow/block list.

Ignore the email because it was not detected by the system.

Microsoft Certified:Security Operations Analyst Associate

Domain 2Objective 1

Respond to Alerts and Incidents in Microsoft Defender XDR SC-200 Practice Questions (Page 2)

Part of the Respond to security incidents domain, which accounts for 35–40% of the SC-200 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~14–26 in this domain), expect 5–9 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

10concepts

35–40%of the exam

Questions 6–10

6foundation · easy
Which of the following is an example of a case management technique used during a security incident?
Select an answer first
7foundation · easy
When a user account is confirmed compromised, which Microsoft Entra ID action can an analyst take to immediately block all sign-in attempts for that user?
Select an answer first
8application · medium
Microsoft Entra ID reports a sign-in from an anonymous IP address for a user account. Microsoft Defender for Identity also shows a suspicious activity for the same user. The security team needs to investigate the potential compromise. What should the analyst do?
Select an answer first
9foundation · easy
What is the primary benefit of using agentic AI, such as Microsoft Security Copilot, in incident investigation?
Select an answer first
10expert · hard
A user reports receiving a phishing email that was not blocked by Microsoft Defender for Office 365. The email contains a link to a credential-harvesting site. The security team needs to investigate why the email was not blocked and remediate the threat. What should the analyst do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-200

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-200” is a trademark of its owner, used for identification only.