SC-100 Certification Practice Question #212

Question

Your company wants to optimize ransomware incident investigations.

You need to recommend a plan to investigate ransomware incidents based on the Microsoft Detection and Response Team (DART) approach.

Which three actions should you recommend performing in sequence in the plan? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Accepted Answer

Microsoft's Incident Response (DART) ransomware-investigation playbook defines exactly three sequential steps: Step 1 "Assess the current situation" (understand the scope), Step 2 "Identify the affected line-of-business (LOB) apps" (get systems back online), and Step 3 "Determine the compromise recovery (CR) process" (remove the threat actor). Mapping the tiles, that is Assess-the-current-situation/scope first, Identify-LOB-apps second, and Identify-the-compromise-recovery-process third. The two unused tiles ("Implement a comprehensive strategy to reduce the risk of privileged access compromise" and "Update organizational processes... outsourcing") are broader posture/governance actions that the playbook does not list among the three investigation steps. The minority 4,1,3 view picks the privileged-access tile for slot 3, but the doc's step 3 wording is "compromise recovery process," which is the literal text of tile B — so 4,1,2 wins. Confidence is 88 rather than higher because of the low-vote 4,1,3 dissent.

More SC-100 practice questions