An analyst is investigating a Microsoft Defender for Identity alert about a user account that was used to perform a reconnaissance activity. What is the first step the analyst should take to remediate the alert?

Review the alert's evidence and related entities

Microsoft Sentinel generates an incident that combines multiple alerts from different resources, indicating a potential multi-stage attack. You need to investigate the incident and take action. What should you do first?

Use the incident's investigation graph to visualize the related entities and alerts.

Close the incident as a false positive if the alerts are not critical.

Run a hunting query to look for other affected resources.

Assign the incident to a senior analyst and add a comment with initial observations.

A security analyst receives an alert about a suspicious process running on an Azure virtual machine. Which Microsoft Defender for Cloud capability provides workload protection alerts for virtual machines?

Microsoft Defender for Containers

You are investigating a complex attack that started with a phishing email, moved to a compromised user account, and then used that account to access internal resources. You need to identify the full scope of the attack. What should you do?

Use the incident graph in Defender XDR to see the relationships between the email, user, and resources.

Run a hunting query for all sign-ins from the user's IP address.

Review the email trace for the phishing email and block the sender.

Reset the user's password and revoke sessions.

Microsoft Certified:Security Operations Analyst Associate

Domain 2Objective 1

Respond to Alerts and Incidents in Microsoft Defender XDR SC-200 Practice Questions (Page 4)

Part of the Respond to security incidents domain, which accounts for 35–40% of the SC-200 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~14–26 in this domain), expect 5–9 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

10concepts

35–40%of the exam

Questions 16–20

16foundation · easy
An analyst is investigating a Microsoft Defender for Identity alert about a user account that was used to perform a reconnaissance activity. What is the first step the analyst should take to remediate the alert?
Select an answer first
17application · medium
Microsoft Sentinel generates an incident that combines multiple alerts from different resources, indicating a potential multi-stage attack. You need to investigate the incident and take action. What should you do first?
Select an answer first
18foundation · easy
A security analyst needs to investigate a user account that may be compromised. Which Microsoft Entra ID log should the analyst review to identify sign-ins from unfamiliar locations or devices?
Select an answer first
19foundation · easy
A security analyst receives an alert about a suspicious process running on an Azure virtual machine. Which Microsoft Defender for Cloud capability provides workload protection alerts for virtual machines?
Select an answer first
20application · medium
You are investigating a complex attack that started with a phishing email, moved to a compromised user account, and then used that account to access internal resources. You need to identify the full scope of the attack. What should you do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-200

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-200” is a trademark of its owner, used for identification only.