Incident Response and Evidence Preservation for Defender for Cloud Alerts
An analyst investigates a Defender for Cloud alert for suspicious process execution on a VM. Which next step best preserves evidence while enabling deeper endpoint investigation?
Quick Answer
The correct next step is to pivot to the Microsoft Defender for Endpoint device timeline and isolate the device if containment is required. This approach preserves volatile evidence—such as running processes, memory contents, and registry state—by avoiding disruptive actions on the live VM, while the device timeline provides a forensically sound, time-ordered record of process executions and network connections for deeper endpoint investigation. On the AZ-500 exam, this scenario tests your understanding of integrating Defender for Cloud alerts with Defender for Endpoint’s endpoint detection and response (EDR) capabilities, a key incident response workflow. A common trap is to immediately snapshot the VM or run a live response script, which can alter or destroy volatile data; instead, remember that isolation contains the threat without freezing the OS, preserving the forensic state. Memory tip: “Pivot and isolate, don’t snapshot and violate.”
⚠ Common exam trap
Candidates often confuse immediate containment with evidence preservation, mistakenly choosing to delete or disable resources instead of using the platform's native investigation and isolation capabilities.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Pivot to Microsoft Defender for Endpoint device timeline and isolate the device if containment is required
Pivoting to the Microsoft Defender for Endpoint device timeline allows the analyst to investigate the suspicious process execution in a forensically sound manner without disrupting the live environment. Isolating the device from the network, if needed, contains the threat while preserving volatile evidence such as running processes, memory, and registry state. This approach aligns with incident response best practices and leverages Defender for Endpoint's deep endpoint visibility.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Delete the VM immediately to stop the process
Why it's wrong here
Deleting the VM destroys volatile memory, disk artefacts and logs needed for forensic analysis, so evidence is lost rather than preserved. It is tempting as containment, and would be correct if the workload were disposable and the priority were stopping active spread with no investigation requirement.
- ✓
Pivot to Microsoft Defender for Endpoint device timeline and isolate the device if containment is required
Why this is correct
Defender for Endpoint's device timeline preserves the forensic process tree and related events while allowing deeper investigation, and device isolation contains the threat without destroying volatile evidence. This satisfies the requirement to preserve evidence and enable endpoint-level analysis before remediation.
- ✗
Disable all analytics rules in Sentinel
Why it's wrong here
Disabling Sentinel analytics rules suppresses detection across the environment and does nothing to isolate or capture the endpoint's state. It is tempting when alerts are noisy and analysts want quiet, and would suit planned maintenance windows, not an active investigation requiring evidence retention.
- ✗
Rotate every subscription key before reviewing the process tree
Why it's wrong here
Rotating subscription keys destroys the authentication context tied to the compromised workload and does not preserve volatile endpoint evidence. It is tempting because key rotation is a standard containment action after credential exposure. Deeper investigation requires collecting the process tree and memory before remediation.
Go deeper
Related to this question
About these practice questions
This AZ-500 question is part of Courseiva's 617-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-500
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A Defender for Cloud alert indicates possible credential theft on a VM. Which two response actions are sensible early containment steps?
hard- ✓ A.Isolate the affected endpoint or restrict network access if business impact allows
- B.Delete all Log Analytics workspaces
- ✓ C.Reset or revoke suspected compromised credentials
- D.Disable Microsoft Defender for Endpoint onboarding
Why A: Option A is correct because isolating the affected endpoint (for example, via Microsoft Defender for Endpoint's 'Isolate device' action) or otherwise restricting its network access stops an attacker from moving laterally or exfiltrating data while the investigation proceeds, and it is a standard early containment step when business impact permits. Option C is correct because credential theft means the attacker may hold valid account secrets, so resetting passwords and revoking tokens, sessions, or refresh tokens (for example, via Microsoft Entra ID revoke sessions or password reset) invalidates the stolen credentials and cuts off the attacker's access. Option B is not appropriate because deleting Log Analytics workspaces destroys the very telemetry and audit evidence needed to investigate the alert and would not contain the threat. Option D is not appropriate because disabling Defender for Endpoint onboarding removes the endpoint detection and response capability that is essential for monitoring, investigating, and remediating the compromised VM.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.