SC-200 respond to incidents explained
Respond to security incidents is worth 35–40% of SC-200 and tests whether you can work an incident from the first alert to remediation. It has three groups of objectives: responding in Defender XDR and the products feeding it, responding on devices with Defender for Endpoint, and investigating Microsoft 365 activity. Questions give you a situation and ask for the next action or the right tool.
Respond in Defender XDR
Defender XDR correlates alerts from several products into one incident, so the first skill is reading the incident: the attack story, the affected entities and the evidence. The outline lists the sources whose alerts you must know how to investigate and remediate:
| Source | Typical alert or action |
|---|---|
| Defender for Office 365 | Phishing and malicious mail; remove delivered messages, block senders, automatic attack disruption |
| Microsoft Purview | Threats or compromised entities identified there, such as insider risk and data exfiltration signals |
| Defender for Cloud workload protections | Alerts on servers, containers, databases and storage |
| Defender for Cloud Apps | Risky OAuth apps, impossible travel, mass downloads |
| Microsoft Entra ID | Risky users and sign-ins; confirm compromise, reset credentials, revoke sessions |
| Defender for Identity | Reconnaissance, lateral movement and credential theft on domain controllers |
| Microsoft Sentinel | Incidents from analytics rules, with entities and evidence |
Two further objectives deserve attention: investigating complex attacks (multi-stage, multi-domain, lateral movement) and using agentic AI, including embedded Microsoft Security Copilot, to summarise and investigate incidents. Treat AI output as a lead to verify, not a verdict. Case management covers assigning, classifying, commenting on and closing incidents with the right determination.
How to think about a scenario
- Scope: which entities (users, devices, mailboxes, apps) are involved?
- Contain: isolate the device, disable or reset the account, revoke tokens.
- Eradicate: remove the malicious mail, files or persistence.
- Close with the correct classification, so tuning and reporting stay accurate.
Respond in Defender for Endpoint
- Device timelines show what happened on a device in order, which is how you find the initial process and the spread.
- Actions on the device include isolating it, running an antivirus scan, restricting app execution, collecting an investigation package and opening live response for an interactive session.
- Evidence and entities such as files, IP addresses and URLs can be investigated and acted on, for example by blocking a file hash.
- Automatic attack disruption incidents must be reviewed: you validate what was contained and release or extend it as appropriate.
Investigate Microsoft 365 activities
| Tool | Best for |
|---|---|
| Purview Audit | Who did what, when, across Microsoft 365 services, such as mailbox access or file sharing |
| eDiscovery content search | Finding the content itself, such as every mailbox that received a specific message |
| Microsoft Graph activity logs | API calls made to Microsoft Graph, which helps spot abuse by a compromised app or token |
Audit tells you about actions. Content search finds items. Graph activity logs show API usage. Questions often give you one of these three needs and expect the matching tool.
Example questions
Question 1. A phishing email was delivered to 40 mailboxes before it was identified as malicious. Users in Defender XDR have not clicked it yet. What is the most effective remediation?
- A. Isolate the devices of all 40 recipients
- B. Reset the password of all 40 recipients
- C. Remediate the delivered message from the 40 mailboxes
- D. Close the incident as a false positive
Show answer
Answer: C
Taking a remediation action on the message removes it from the mailboxes, for example by moving it to quarantine or soft-deleting it, before anyone interacts with it. Isolating devices is for endpoint compromise, which has not happened. Resetting every password is disproportionate when nobody clicked. Closing the incident as a false positive leaves the threat in the inboxes.
Want more questions like this? Full SC-200 practice tests →
Question 2. You must find out which users opened and shared a particular SharePoint file during the last week and from which IP addresses. Which tool fits best?
- A. eDiscovery content search
- B. Microsoft Purview Audit
- C. Microsoft Graph activity logs
- D. A Defender for Endpoint device timeline
Show answer
Answer: B
Purview Audit records user and admin activities in Microsoft 365, including file access and sharing, with user and IP details. Content search finds items by their content, not the activity history. Graph activity logs record Microsoft Graph API requests, not SharePoint user actions in general. A device timeline shows endpoint events, not SharePoint file activity.
Want more questions like this? Full SC-200 practice tests →
Question 3. Defender for Identity reports suspected lateral movement from a workstation to a domain controller, and a Defender for Endpoint alert on the same workstation shows credential dumping. How are these presented, and what should you do first?
- A. As one correlated incident; contain the workstation and the exposed account
- B. As two unrelated incidents; handle the lower severity alert first
- C. As separate alerts; delete the duplicate
- D. Wait for a third alert before acting
Show answer
Answer: A
Defender XDR correlates related alerts into a single incident, so you work the combined attack story and contain the affected workstation and the account whose credentials were exposed. Treating them separately loses the connection. Deleting one alert hides evidence. Waiting for a third alert delays containment of an active credential theft.
Want more questions like this? Full SC-200 practice tests →
How to revise this domain
Practise on a real or simulated incident. The Defender portal lets you generate test alerts on a lab device, and you can walk through the timeline, isolate the device, open live response and collect a package. Then repeat the exercise for an identity alert in Entra ID and a Sentinel incident, so the investigation steps become automatic.
Next, read the threat hunting guide, or return to the security operations environment guide for the configuration side.