A security operations center (SOC) is managing multiple incidents in Microsoft Sentinel. One incident is a high-severity ransomware alert, and another is a low-severity phishing alert. The SOC has limited staff and needs to prioritize its response. What should the analyst do?

Close the low-severity incident as a false positive to focus on the high-severity incident.

Investigate the low-severity incident first because it is easier to resolve.

Wait for more alerts to arrive before starting any investigation.

Assign the high-severity incident to a senior analyst and the low-severity incident to a junior analyst, and set both to 'In progress'.

Microsoft Defender for Cloud raises a security alert about a virtual machine that is communicating with a known malicious IP address. Your investigation in Defender XDR shows that the VM is part of a multi-tier application and the alert is part of a larger attack campaign. You need to isolate the VM while preserving forensic evidence. What should you do?

Take a snapshot of the VM's disk and then shut down the VM.

Use the 'isolate' action in Microsoft Defender for Cloud to isolate the VM from the network.

Delete the VM from the resource group to stop the communication.

Apply a network security group (NSG) rule to block all inbound and outbound traffic to the VM.

Microsoft Certified:Security Operations Analyst Associate

Domain 2Objective 1

Respond to Alerts and Incidents in Microsoft Defender XDR SC-200 Practice Questions (Page 5)

Part of the Respond to security incidents domain, which accounts for 35–40% of the SC-200 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~14–26 in this domain), expect 5–9 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

10concepts

35–40%of the exam

Questions 21–25

21expert · hard
A security operations center (SOC) is managing multiple incidents in Microsoft Sentinel. One incident is a high-severity ransomware alert, and another is a low-severity phishing alert. The SOC has limited staff and needs to prioritize its response. What should the analyst do?
Select an answer first
22foundation · easy
A security analyst wants to use natural language to ask questions about a security incident and receive AI-generated guidance. Which Microsoft security tool provides this capability?
Select an answer first
23foundation · easy
When investigating a compromised user account in Microsoft Purview, which activity log should an analyst review to see what actions the user performed on sensitive items?
Select an answer first
24application · medium
Microsoft Defender for Cloud raises a security alert about a virtual machine that is communicating with a known malicious IP address. Your investigation in Defender XDR shows that the VM is part of a multi-tier application and the alert is part of a larger attack campaign. You need to isolate the VM while preserving forensic evidence. What should you do?
Select an answer first
25foundation · easy
After investigating a Microsoft Sentinel incident, an analyst wants to document the findings and actions taken. Which Microsoft Sentinel feature should the analyst use to record this information?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-200

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-200” is a trademark of its owner, used for identification only.

Respond to Alerts and Incidents in Microsoft Defender XDR SC-200 Practice Questions (Page 5)

Questions 21–25

A security operations center (SOC) is managing multiple incidents in Microsoft Sentinel. One incident is a high-severity ransomware alert, and another is a low-severity phishing alert. The SOC has limited staff and needs to prioritize its response. What should the analyst do?

A security analyst wants to use natural language to ask questions about a security incident and receive AI-generated guidance. Which Microsoft security tool provides this capability?

When investigating a compromised user account in Microsoft Purview, which activity log should an analyst review to see what actions the user performed on sensitive items?

After investigating a Microsoft Sentinel incident, an analyst wants to document the findings and actions taken. Which Microsoft Sentinel feature should the analyst use to record this information?

Keep studying — Respond to security incidents