Back to Microsoft Security Operations Analyst Associate (SC-200)

Manage incident response

Respond to alerts and incidents across Microsoft Defender portal, investigate Microsoft 365 activities, respond to incidents in Microsoft Sentinel, and implement Security Copilot.

Covers responding to alerts and incidents in the Microsoft Defender portal including investigating threats from Defender for Office 365, ransomware and business email compromise incidents, compromised entities from DLP policies, insider risk policies, Defender for Cloud workload protections, Defender for Cloud Apps, Microsoft Entra ID, and Defender for Identity. Includes responding to Defender for Endpoint alerts through device timelines, live response, investigation packages, and evidence investigation. Also covers investigating Microsoft 365 activities through unified audit log, Content Search, and Microsoft Graph activity logs. Encompasses responding to incidents in Microsoft Sentinel with automation rules, playbooks, and on-premises resource playbooks. Includes implementing and using Microsoft Security Copilot for promptbooks, source management, connectors, permissions, cost monitoring, and incident investigation.
5 minutes 5 Questions

Incident response management is a critical component of the Microsoft Security Operations Analyst Associate role, focusing on effectively handling security incidents from detection through resolution. In Microsoft Sentinel and Microsoft Defender XDR, analysts must understand the complete incident l…

Concepts covered: Investigate and remediate threats with Defender for Office 365, Investigate ransomware and BEC incidents from attack disruption, Investigate compromised entities from Purview DLP policies, Investigate threats from Purview insider risk policies, Investigate alerts from Defender for Cloud workload protections, Investigate security risks from Defender for Cloud Apps, Investigate compromised identities from Microsoft Entra ID, Investigate security alerts from Defender for Identity, Investigate device timelines in Defender for Endpoint, Perform live response and collect investigation packages, Perform evidence and entity investigation, Investigate threats using the unified audit log, Investigate threats using Content Search, Investigate threats using Microsoft Graph activity logs, Investigate and remediate incidents in Microsoft Sentinel, Create and configure automation rules in Sentinel, Create and configure Microsoft Sentinel playbooks, Run playbooks on on-premises resources, Create and use Security Copilot promptbooks, Manage Security Copilot sources, plugins, and files, Integrate Security Copilot with connectors, Manage permissions and roles in Security Copilot, Monitor Security Copilot capacity and cost, Identify threats and risks using Security Copilot, Investigate incidents using Security Copilot

Test mode:
Start practice test
SC-200 - Manage incident response Example Questions

Test your knowledge of Manage incident response

Question 1

What does the FileName property represent when constructing a Content Search query in Microsoft Purview?

Correct Answer: The name of the document or file stored in SharePoint sites and OneDrive accounts

The correct answer is that the FileName property represents the name of the document or file stored in SharePoint sites and OneDrive accounts.

In Microsoft Purview Content Search, the FileName property is specifically designed to search for and identify files stored in SharePoint Online sites and OneDrive for Business accounts. This property allows security analysts to construct queries that target specific file names or file name patterns within these collaboration platforms.

Why the other answers are incorrect:

The option about email message subject lines is incorrect because email subject lines are searched using the 'Subject' property, not the FileName property. Email messages in Exchange Online have their own set of searchable properties distinct from file-based properties.

The option about exported search results is incorrect because the FileName property is used during the search query construction phase to find content, not during the export phase. The naming of exported results is handled separately through export settings and has no relation to the FileName search property.

The option about attachments in email messages, Teams chats, and calendar appointments is incorrect because while attachments do have file names, the FileName property in Content Search queries specifically targets files stored in SharePoint and OneDrive locations. Email attachments are typically searched using different properties or through the content of mailboxes, and Teams/calendar attachments are indexed differently within the Microsoft 365 environment.

Question 2

A Security Operations Analyst at a manufacturing company is investigating supply chain attacks using Microsoft Security Copilot. The analyst has Defender XDR and Sentinel configured as active data sources. During the investigation, the team identifies that their DevOps pipeline security tool (Snyk) contains critical vulnerability data about compromised third-party libraries that could be related to the attack chain. The analyst attempts to use a pre-built Snyk plugin that was recently added to Security Copilot's plugin ecosystem. After locating the Snyk plugin in the plugin management interface, the analyst notices it shows as 'Available' but Copilot is not returning any Snyk-related data when prompted about vulnerable dependencies. The analyst has confirmed that API credentials for Snyk are valid and the service is operational. What action must the analyst perform to resolve this issue and enable Snyk data retrieval in investigation sessions?

Correct Answer: Activate the Snyk plugin in the Security Copilot plugin management console to enable data queries from the vulnerability scanning platform

The correct answer is to activate the Snyk plugin in the Security Copilot plugin management console to enable data queries from the vulnerability scanning platform.

In Microsoft Security Copilot, plugins follow a specific lifecycle management process. When a plugin shows as 'Available' in the plugin management interface, this indicates that the plugin exists in the ecosystem and can be used, but it has not yet been activated for the current environment. This is a critical distinction in Security Copilot's architecture.

The scenario explicitly states that:
1. The Snyk plugin is located in the plugin management interface
2. The plugin shows as 'Available' status
3. API credentials are valid and the service is operational
4. Despite prompts about vulnerable dependencies, no Snyk data is being returned

This combination of factors points directly to the plugin not being activated. In Security Copilot, simply having a plugin available does not mean it is active and ready to process queries. The analyst must explicitly activate the plugin through the plugin management console. Once activated, the plugin status changes and Security Copilot can then route relevant prompts to the Snyk data source and retrieve vulnerability information.

The other options introduce unnecessary complexity or incorrect implementation approaches:

  • Configuring the plugin as a custom source within data connectors misunderstands how pre-built plugins work in Security Copilot. Pre-built plugins don't require custom source configuration; they are designed to work through the standard plugin activation process.

  • Deploying through the Microsoft Entra enterprise application gallery and establishing service principals represents an over-engineered approach that conflates authentication mechanisms with plugin activation. While service principals may be used for some integrations, the scenario already confirms that API credentials are valid, indicating authentication is not the issue.

  • Creating a logic app workflow with webhook triggers to bridge the Snyk API represents building a custom integration when a pre-built plugin already exists. This approach would be appropriate if no pre-built plugin existed, but the scenario explicitly mentions using a pre-built Snyk plugin that was recently added to the ecosystem.

The solution is straightforward: activate the available plugin to change its state from 'Available' to 'Active', enabling Security Copilot to query Snyk data during investigation sessions.

Question 3

What does the 'userAgent' property in Microsoft Graph activity logs identify when analyzing API request patterns during security investigations?

Correct Answer: The client application or software library that initiated the API request, including version information and platform details

The 'userAgent' property in Microsoft Graph activity logs identifies the client application or software library that initiated the API request, including version information and platform details.

This is the correct answer because the userAgent field is a standard HTTP header that describes the client software making the request. In Microsoft Graph activity logs, this property captures essential information about:

  • The application name and type (e.g., Microsoft Graph PowerShell SDK, custom application, web browser)
  • Version numbers of the client software
  • Platform details (operating system, framework versions)
  • Library or SDK information used to make the request

This information is crucial for security investigations as it helps analysts:
- Identify legitimate versus suspicious applications accessing Microsoft Graph
- Detect anomalous API request patterns from unexpected clients
- Track application versions that might have vulnerabilities
- Distinguish between automated tools and interactive user sessions
- Correlate activities across multiple log entries

Why the other answers are incorrect:

The second option about geographic location and network infrastructure is incorrect because the userAgent property does not contain routing or geographic information. This type of data would be found in other properties like IP addresses or location-based fields in the logs.

The third option regarding authentication methods is incorrect because while authentication is important in API requests, the userAgent specifically identifies the client software, not the authentication mechanism. Authentication details are captured in separate fields like authenticationMethod or credentialType.

The fourth option about the application processing the response is incorrect because the userAgent identifies the client that initiates and sends the request, not the component that processes the response. The userAgent is part of the request headers sent TO Microsoft Graph, not information about response handling.

More Manage incident response questions
947 questions (total)
Start 100 question test