SC-200 Respond to security incidents Practice Question
A Microsoft Defender for Endpoint alert indicates that a device has been communicating with a known command-and-control (C2) server. The device is critical for production. What is the most appropriate response?
⚠ Common exam trap
Watch out — candidates often choose 'Block the C2 server URL in the firewall' (Option C) because it seems like a quick network fix, but they fail to recognize that the device itself is already compromised and must be contained at the endpoint level to prevent lateral movement or data exfiltration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Isolate the device using Microsoft Defender for Endpoint's device isolation feature.
Microsoft Defender for Endpoint's device isolation feature is designed to contain a compromised device while preserving forensic data and minimizing disruption. For a critical production device, full isolation (blocking all network traffic except to the Defender service) stops C2 communication without physically disconnecting the device, allowing the security team to investigate and remediate remotely.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disconnect the network cable of the device.
Why it's wrong here
Physically disconnecting the network cable is an uncontrolled, manual action that cannot be applied to virtual machines or wireless devices, and it does not preserve forensic data—volatile memory may be lost and the device state becomes unclean. It also prevents continued monitoring of the attacker's activity and may alert the adversary, whereas Microsoft Defender for Endpoint's isolation is a managed, reversible action that maintains forensic integrity and allows a controlled investigation.
- ✗
Run a full antivirus scan on the device.
Why it's wrong here
Running a full antivirus scan is reactive and detection-based; it relies on known signatures and heuristics, so it may not detect fileless malware or sophisticated tools already in memory. More importantly, a scan does not block the ongoing command-and-control (C2) communication, leaving the device connected and the attacker able to maintain persistence, move laterally, or exfiltrate data while the scan is running, so it fails to provide the immediate containment required.
- ✗
Block the C2 server URL in the firewall.
Why it's wrong here
Blocking the C2 server URL in the firewall is a narrow, tactical measure that only disrupts one known channel; the device may use multiple fallback C2 domains, IP addresses, or DNS over HTTPS to evade the block. It also does not sever the device's broader network communication, allowing other attacker actions on the device to continue, and it provides no forensic preservation or centralized, trackable isolation, making it an incomplete response compared to device isolation.
- ✓
Isolate the device using Microsoft Defender for Endpoint's device isolation feature.
Why this is correct
Isolating the device with Microsoft Defender for Endpoint's device isolation feature is the correct initial response because it severs all inbound and outbound communication except to the Defender service, immediately containing the threat while keeping the device powered on. When forensic preservation mode is enabled, the device remains in a state that preserves volatile evidence and prevents file system changes, allowing security analysts to investigate the compromise, collect artifacts, and remediate without losing critical data—all through a centrally managed, reversible action.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-200 question from scratch — 209 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-200
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your security team receives an alert from Microsoft Defender for Endpoint indicating a suspicious PowerShell command was executed on a device. The command attempted to download a payload from a known malicious IP. After confirming the alert is a true positive, what should be your first containment step?
medium- A.Search for similar commands across all devices using advanced hunting
- B.Disable the user account in Microsoft Entra ID
- ✓ C.Isolate the device from the network using Microsoft Defender for Endpoint
- D.Reset the user's password
Why C: Immediately isolating the affected device from the network prevents lateral movement and further compromise. Option A is wrong because searching for similar commands is part of investigation, not immediate containment. Option B is wrong because disabling the user account may not stop the malicious process already running on the device. Option D is wrong because resetting the password does not address the existing compromise on the device.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.