Respond to Alerts and Incidents in Microsoft Defender XDR SC-200 Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   An analyst is investigating an incident that includes alerts from multiple Azure resources, such as a VM, a storage account, and a SQL database. Where in Microsoft Defender for Cloud can the analyst view a consolidated view of these alerts?

   • ARegulatory compliance page
   • BInventory page
   • CRecommendations page
   • DSecurity alerts page
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   A security analyst needs to investigate a security risk involving a user accessing a cloud app from an unusual location. Which Microsoft Defender for Cloud Apps capability provides alerts for such anomalous behavior?

   • ACloud Discovery
   • BAccess policies
   • CApp governance
   • DAnomaly detection policies
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   During a complex attack investigation, an analyst notices that the attacker moved from one compromised workstation to another using remote administration tools. What is this stage of the attack called?

   • ALateral movement
   • BExfiltration
   • CInitial access
   • DPrivilege escalation
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   Your security team is managing a large number of incidents in Microsoft Defender XDR. You need to ensure that incidents are properly prioritized and that the team can collaborate effectively. You also need to provide a clear audit trail for compliance. What should you do?

   • ACreate a separate email distribution list for each incident and send updates to the team.
   • BExport all incidents to a spreadsheet and share it with the team.
   • CUse a third-party ticketing system and manually sync incidents.
   • DUse the incident management features in Defender XDR to assign, prioritize, and add comments to incidents.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A company uses Microsoft Defender for Cloud to protect its Azure VMs. Defender for Cloud raises a high-severity alert for a VM indicating that a suspicious process attempted to disable the Windows Defender firewall. The alert is also visible in Microsoft Sentinel as an incident. The security team wants to contain the threat immediately while preserving forensic evidence. What should the security analyst do first?

   • ACreate a new Microsoft Sentinel incident and assign it to the senior analyst for manual investigation.
   • BDisable the VM's network interface in the Azure portal to cut off all traffic immediately.
   • COpen the alert in Defender for Cloud, review the attack story and related entities, then initiate the recommended response action to isolate the VM.
   • DOpen the incident in Microsoft Sentinel and run a full KQL hunting query across all workspaces to find other affected VMs.
   Reveal Solution Discussion Select an answer first