Incident Response and Evidence Preservation for Defender for Cloud Alerts
An analyst investigates a Defender for Cloud alert for suspicious process execution on a VM. Which next step best preserves evidence while enabling deeper endpoint investigation?
Quick Answer
The correct next step is to pivot to the Microsoft Defender for Endpoint device timeline and isolate the device if containment is required. This approach preserves volatile evidence—such as running processes, memory contents, and registry state—by avoiding disruptive actions on the live VM, while the device timeline provides a forensically sound, time-ordered record of process executions and network connections for deeper endpoint investigation. On the AZ-500 exam, this scenario tests your understanding of integrating Defender for Cloud alerts with Defender for Endpoint’s endpoint detection and response (EDR) capabilities, a key incident response workflow. A common trap is to immediately snapshot the VM or run a live response script, which can alter or destroy volatile data; instead, remember that isolation contains the threat without freezing the OS, preserving the forensic state. Memory tip: “Pivot and isolate, don’t snapshot and violate.”
⚠ Common exam trap
Candidates often confuse immediate containment with evidence preservation, mistakenly choosing to delete or disable resources instead of using the platform's native investigation and isolation capabilities.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Pivot to Microsoft Defender for Endpoint device timeline and isolate the device if containment is required
Pivoting to the Microsoft Defender for Endpoint device timeline allows the analyst to investigate the suspicious process execution in a forensically sound manner without disrupting the live environment. Isolating the device from the network, if needed, contains the threat while preserving volatile evidence such as running processes, memory, and registry state. This approach aligns with incident response best practices and leverages Defender for Endpoint's deep endpoint visibility.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Delete the VM immediately to stop the process
Why it's wrong here
This does not meet the stated requirement as directly as the correct option.
- ✓
Pivot to Microsoft Defender for Endpoint device timeline and isolate the device if containment is required
Why this is correct
Correct for the stated requirement.
- ✗
Disable all analytics rules in Sentinel
Why it's wrong here
This does not meet the stated requirement as directly as the correct option.
- ✗
Rotate every subscription key before reviewing the process tree
Why it's wrong here
This does not meet the stated requirement as directly as the correct option.
Go deeper
Related to this question
About these practice questions
This AZ-500 question is part of Courseiva's 194-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-500
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A Defender for Cloud alert indicates possible credential theft on a VM. Which two response actions are sensible early containment steps?
hard- ✓ A.Isolate the affected endpoint or restrict network access if business impact allows
- B.Delete all Log Analytics workspaces
- ✓ C.Reset or revoke suspected compromised credentials
- D.Disable Microsoft Defender for Endpoint onboarding
Why A: Isolating the affected VM or restricting its network access is a fundamental containment step that prevents the attacker from using the compromised credentials to move laterally or exfiltrate data. Option C is also correct because resetting or revoking the suspected compromised credentials directly neutralizes the stolen credentials, preventing the attacker from authenticating further. Both actions are early containment steps: network isolation limits the attack surface, while credential reset removes the attacker's access. Deleting Log Analytics workspaces or disabling Defender for Endpoint would harm visibility and are not containment actions.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.