Respond to Alerts and Incidents in Microsoft Defender XDR SC-200 Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   Microsoft Defender for Cloud Apps alerts you that a user is downloading a large number of files from SharePoint and uploading them to a personal cloud storage app. The user's account shows a sign-in from a new device. You need to determine if this is a security risk and take action. What should you do first?

   • AUse the activity log in Defender for Cloud Apps to review the user's recent activity and the new device's risk profile.
   • BReset the user's password and require multi-factor authentication (MFA).
   • CSuspend the user's access to SharePoint and the personal cloud storage app.
   • DBlock the personal cloud storage app in Defender for Cloud Apps.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   When investigating a security risk in Microsoft Defender for Cloud Apps, an analyst wants to see all activities performed by a specific user across all connected cloud apps. Which view should the analyst use?

   • AFiles page
   • BAlerts queue
   • CCloud Discovery dashboard
   • DActivity log
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   A security analyst receives an alert from Microsoft Defender for Identity about a suspicious Kerberos activity. What type of activity does Microsoft Defender for Identity primarily monitor?

   • ACloud app usage
   • BAzure subscription activity
   • COn-premises Active Directory attacks
   • DEmail phishing campaigns
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A security analyst is investigating a complex incident that spans multiple domains: a user's email account was compromised, leading to a malicious link click, which resulted in a device infection, and then lateral movement to other resources. The incident is visible in Microsoft Defender XDR. The analyst needs to contain the incident while preserving evidence for a legal investigation. What should the analyst do?

   • ADelete the user's email account to prevent further phishing.
   • BImmediately shut down the compromised device to stop lateral movement.
   • CUse the incident's attack story in Defender XDR to identify all affected entities, then isolate the compromised device and disable the user account.
   • DReset the user's password and revoke sessions, then continue monitoring.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   Microsoft Sentinel has an incident that combines alerts from multiple sources, including Microsoft Defender for Endpoint and Microsoft Defender for Identity. The incident indicates a multi-stage attack. The security team wants to investigate the incident and manage it effectively. What should the analyst do?

   • AOpen each alert individually in its source product and manually correlate them.
   • BExport the incident data to Excel for manual analysis.
   • CClose the incident as a false positive because the alerts are from different sources.
   • DOpen the incident in Microsoft Sentinel, use the investigation graph to view related entities and alerts, and then assign the incident to an analyst for follow-up.
   Reveal Solution Discussion Select an answer first