Microsoft Defender for Identity raises an alert for a user account that has attempted to perform an unusual Kerberos delegation activity. The account is a domain administrator. The security team needs to investigate and remediate the alert. What should the analyst do?

Change the account's group membership to remove it from Domain Admins.

Use the Defender for Identity alert details to view the affected account and the source computer, then disable the account and reset its password.

Ignore the alert because Kerberos delegation is a common administrative activity.

Run a full antivirus scan on the source computer.

Your security team is managing multiple incidents in Microsoft Defender XDR. You need to ensure that each incident is properly tracked and that the team knows who is responsible for each one. What should you do?

Create a separate email distribution list for each incident.

Export all incidents to a spreadsheet and share it with the team.

Close all incidents that are not critical to reduce the workload.

Assign each incident to a team member and set the status to 'In progress'.

A security analyst needs to investigate a data spillage incident involving sensitive documents shared externally. Which Microsoft Purview solution provides investigation and remediation capabilities for such data security threats?

Microsoft Purview Information Protection

Microsoft Purview Data Loss Prevention (DLP)

Microsoft Certified:Security Operations Analyst Associate

Domain 2Objective 1

Respond to Alerts and Incidents in Microsoft Defender XDR SC-200 Practice Questions (Page 3)

Part of the Respond to security incidents domain, which accounts for 35–40% of the SC-200 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~14–26 in this domain), expect 5–9 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

10concepts

35–40%of the exam

Questions 11–15

11foundation · easy
A security analyst is reviewing a phishing email that was delivered to a user's mailbox. The analyst needs to identify all messages that share the same sender and subject line as the reported email. Which Microsoft Defender for Office 365 capability should the analyst use to find these related messages?
Select an answer first
12application · medium
Microsoft Defender for Identity raises an alert for a user account that has attempted to perform an unusual Kerberos delegation activity. The account is a domain administrator. The security team needs to investigate and remediate the alert. What should the analyst do?
Select an answer first
13foundation · easy
A security analyst uses Microsoft Sentinel to investigate a security incident. Which Microsoft Sentinel feature provides a visual representation of the attack path and related entities?
Select an answer first
14application · medium
Your security team is managing multiple incidents in Microsoft Defender XDR. You need to ensure that each incident is properly tracked and that the team knows who is responsible for each one. What should you do?
Select an answer first
15foundation · easy
A security analyst needs to investigate a data spillage incident involving sensitive documents shared externally. Which Microsoft Purview solution provides investigation and remediation capabilities for such data security threats?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-200

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-200” is a trademark of its owner, used for identification only.

Respond to Alerts and Incidents in Microsoft Defender XDR SC-200 Practice Questions (Page 3)

Questions 11–15

Microsoft Defender for Identity raises an alert for a user account that has attempted to perform an unusual Kerberos delegation activity. The account is a domain administrator. The security team needs to investigate and remediate the alert. What should the analyst do?

A security analyst uses Microsoft Sentinel to investigate a security incident. Which Microsoft Sentinel feature provides a visual representation of the attack path and related entities?

Your security team is managing multiple incidents in Microsoft Defender XDR. You need to ensure that each incident is properly tracked and that the team knows who is responsible for each one. What should you do?

A security analyst needs to investigate a data spillage incident involving sensitive documents shared externally. Which Microsoft Purview solution provides investigation and remediation capabilities for such data security threats?

Keep studying — Respond to security incidents