Respond to Alerts and Incidents in Microsoft Defender XDR SC-200 Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   Microsoft Defender for Cloud Apps detects a user who is using a personal device to access a cloud app that contains sensitive data. The user has not enrolled the device in mobile device management (MDM). The security team wants to allow the user to access the app but prevent data exfiltration. What should the analyst do?

   • ARequire the user to enroll the device in MDM before accessing the app.
   • BCreate a conditional access policy in Microsoft Entra ID that requires the device to be compliant or blocks access from unmanaged devices, and apply a session policy in Defender for Cloud Apps to restrict download actions.
   • CAllow access but monitor the user's activity without any restrictions.
   • DBlock all access to the app from personal devices.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   Microsoft Entra ID flags a user account as compromised due to a risky sign-in. Your investigation in Defender XDR shows that the user's account was used to access multiple applications and send emails. You need to remediate the compromised identity and prevent further misuse. What should you do?

   • ADisable the user's account and then re-enable it after a few hours.
   • BRemove the user's licenses to prevent access to applications.
   • CRevoke the user's sessions and require a password reset.
   • DAdd the user to a group that requires MFA for all sign-ins.
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   Microsoft Sentinel has an incident that includes alerts from Microsoft Defender for Endpoint and Microsoft Defender for Office 365. The incident indicates a possible multi-stage attack. The security team wants to investigate the incident and determine the full scope. What should the analyst do?

   • AUse the Sentinel investigation graph to view the incident's entities and alerts, and then use advanced hunting in Defender for Endpoint to search for related activity.
   • BExport the incident data to a CSV file for manual analysis.
   • CClose the incident as a false positive because the alerts are from different sources.
   • DOpen each alert individually in its source product and manually correlate them.
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   When investigating a multi-stage attack, which approach is most effective for understanding the full scope of the attack?

   • AIsolate each alert as a separate incident
   • BRely solely on automated tools without manual analysis
   • CFocus only on the initial alert
   • DCorrelate alerts and events across multiple domains and data sources
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   Microsoft Defender for Cloud Apps flags a user who is downloading a large volume of files from SharePoint to a personal device. The activity is unusual for this user. The security team wants to investigate the risk and take action without blocking the user's legitimate work immediately. What should the analyst do?

   • AUse Defender for Cloud Apps to view the user's activity timeline and the file download details, then apply a conditional access policy to block downloads from that device.
   • BImmediately suspend the user's account in Microsoft Entra ID to stop all access.
   • CDelete the downloaded files from the user's personal device remotely.
   • DIgnore the alert because the user may have a legitimate business need.
   Reveal Solution Discussion Select an answer first