220-1102 Practice Question: That they received a phone call from someone…

Enable full disk encryption on the user's workstation

Full disk encryption protects data at rest but does not address the immediate threat of an active compromise. It should be implemented as a security baseline, not as an emergency response.

Run a full antivirus scan on the user's workstation

While malware may be present, the primary concern is that the attacker has valid credentials. Antivirus scans are secondary to containment and credential reset.

Check the domain controller logs for any evidence of lateral movement

Log analysis is important for forensic investigation, but the first step must be to contain the breach by disabling the account. Logs can be reviewed after containment.

What does this 220-1102 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: Disable the user's account and force a password reset — The user has been socially engineered into revealing credentials and an MFA code, meaning an attacker likely has immediate access. The first priority is to contain the incident by disabling the compromised account and forcing a password reset for all accounts using those credentials. This prevents further unauthorized access. Enabling full disk encryption or running antivirus scans are important steps, but containment must come first. Checking audit logs may be done after securing the account, but the immediate action is to disable the account.

What should I do if I get this 220-1102 question wrong?

Identify which 220-1102 exam domain this question belongs to, then review the specific concept being tested. Practise related questions in that domain and focus on understanding why each wrong answer is tempting — not just why the correct answer is right.