EarnYourCert
Open the app
Exams › SC-200 › Domain 2 of 3
SC-200 · Domain 2 of 3 · 35-40% of the exam

Respond to security incidents

Domain 2 of SC-200 accounts for 35-40% of the exam. EarnYourCert has 140 original questions for this domain, all with explanations: 92 multiple choice, 22 yes/no and 26 completion or ordering items, like the real exam.

Practice domain 2 for free →No sign-up. Choose how many questions you want.

Domain 2 sample questions

8 questions from our 140-question bank for this domain. Try to answer before revealing the solution.

1. Which Defender for Office 365 remediation actions can be applied to delivered email?

  1. Block the sender's IP address at the perimeter firewall for 30 days
  2. Disable the recipient's mailbox until the message has been analyzed
  3. Move to Junk, soft delete, hard delete or quarantine
  4. Reset the recipient's password
Show answer

Correct answer: C. Remediation actions help remove threats from mailboxes.

2. Which capability gives an analyst a remote command-line session on a device to run commands and collect files?

  1. Cloud Discovery
  2. Live response
  3. Safe Links
  4. Attack simulation
Show answer

Correct answer: B. Live response supports commands such as getfile and run.

3. What does restricting app execution on a device do?

  1. Resets the user's password
  2. Deletes the user profile
  3. Allows only Microsoft-signed executables to run
  4. Blocks all internet access from the device
Show answer

Correct answer: C. It limits attacker tools while keeping system functions.

4. An investigation shows a suspicious file. Which entity page helps you see prevalence, related alerts and devices that observed the file?

  1. The license page
  2. The billing page
  3. The file entity page
  4. The domain page
Show answer

Correct answer: C. Entity pages aggregate evidence about files, IPs, URLs and users.

5. An analyst wants to stop a malicious file from running on all devices after identifying its hash. What action helps?

  1. Assign a Defender license to every device
  2. Create a guest user
  3. Block the file hash with an indicator
  4. Rename the device and re-onboard it to Defender
Show answer

Correct answer: C. Indicators propagate blocks across onboarded devices.

6. Which Defender for Endpoint feature automatically investigates alerts and remediates threats?

  1. Web content filtering by category for devices
  2. The exposure score shown on the device page
  3. Automated investigation and response (AIR)
  4. Device groups with RBAC assigned to analysts
Show answer

Correct answer: C. AIR examines artifacts and can remediate automatically depending on the device group's automation level.

7. Which action collects an investigation package from a device?

  1. Restrict app execution on the device
  2. Offboard the device from the service
  3. Collect investigation package on the device page
  4. Run a full antivirus scan on the device
Show answer

Correct answer: C. The package contains forensic data such as processes, connections and autoruns for analysis.

8. You must find who added a user to the Global Administrator role last week. Which log should you check?

  1. Sign-in logs
  2. Azure Activity log of the subscription that hosts the tenant
  3. Message trace
  4. Microsoft Entra audit logs
Show answer

Correct answer: D. Directory changes such as role assignments are recorded in the Entra audit logs (AuditLogs table).

Practice domain 2 for free →

Other SC-200 domains

1Manage a security operations environment40-45% 3Perform threat hunting20-25% SC-200: full practice exam→