AZ-500 Manage identity and access Practice Question
A Defender for Cloud alert indicates possible credential theft on a VM. Which two response actions are sensible early containment steps?
⚠ Common exam trap
A common mix-up: candidates confuse 'containment' with 'remediation' and choose to delete workspaces or disable security tools, which are destructive or counterproductive actions, rather than the correct containment step of network isolation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Isolate the affected endpoint or restrict network access if business impact allows
Option A is correct because isolating the affected endpoint (for example, via Microsoft Defender for Endpoint's 'Isolate device' action) or otherwise restricting its network access stops an attacker from moving laterally or exfiltrating data while the investigation proceeds, and it is a standard early containment step when business impact permits. Option C is correct because credential theft means the attacker may hold valid account secrets, so resetting passwords and revoking tokens, sessions, or refresh tokens (for example, via Microsoft Entra ID revoke sessions or password reset) invalidates the stolen credentials and cuts off the attacker's access. Option B is not appropriate because deleting Log Analytics workspaces destroys the very telemetry and audit evidence needed to investigate the alert and would not contain the threat. Option D is not appropriate because disabling Defender for Endpoint onboarding removes the endpoint detection and response capability that is essential for monitoring, investigating, and remediating the compromised VM.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Isolate the affected endpoint or restrict network access if business impact allows
Why this is correct
Isolating the endpoint or restricting its network access severs the attacker's command-and-control and lateral movement paths, containing credential theft before persistence or exfiltration. This preserves forensic evidence on the VM while business impact remains acceptable.
- ✗
Delete all Log Analytics workspaces
Why it's wrong here
Deleting Log Analytics workspaces destroys the telemetry and audit evidence needed to investigate the credential theft, and does nothing to contain the compromised VM. It is tempting as a way to purge exposed data, but workspace deletion is a data-retention action, not incident containment.
- ✓
Reset or revoke suspected compromised credentials
Why this is correct
Revoking or resetting the suspected credentials immediately cuts off the attacker's authenticated access, satisfying the containment requirement in the stem. Until those credentials are invalidated, the threat actor can keep using them for lateral movement or further data theft, so this is a sensible early step.
- ✗
Disable Microsoft Defender for Endpoint onboarding
Why it's wrong here
Disabling Defender for Endpoint onboarding removes the endpoint detection and response telemetry that would reveal the credential-theft activity, blinding the investigation. It is tempting when the agent itself appears implicated, but onboarding should remain enabled while the VM is isolated and credentials are reset.
Go deeper
Related to this question
About these practice questions
This AZ-500 question is part of Courseiva's 617-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.