SC-200 Respond to security incidents Practice Question
A security analyst detects a suspicious sign-in from an unfamiliar IP address for a user with high privileges. The analyst wants to immediately contain the threat while preserving the user's ability to work with proper approvals. What is the most effective first step?
⚠ Common exam trap
Test-takers frequently choose to disable the user account (Option B) thinking it is the fastest containment, but they overlook that session revocation is necessary to stop active attacker sessions, and disabling the account also blocks the legitimate user without a clear path for re-enabling with approvals.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Initiate a user risk remediation in Microsoft Entra ID Protection by confirming compromise and resetting password with session revocation.
It directly addresses the immediate threat by confirming compromise in Microsoft Entra ID Protection, which triggers a password reset and revokes all existing sessions, effectively terminating the attacker's access. This approach preserves the user's ability to work after re-authentication with proper approvals, as the account remains enabled and can be restored once the risk is mitigated. It is the most effective first step because it combines containment (session revocation) with remediation (password reset) while maintaining operational continuity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Block the IP address in the firewall.
Why it's wrong here
Blocking the IP address at the firewall only addresses the network source and does nothing to invalidate the attacker's existing authentication tokens or session cookies. IP addresses are often shared (NAT, DHCP, or corporate egress points), so this could deny service to legitimate users who now resolve to that same IP. Additionally, the attacker can simply rotate IPs or use a proxy, while the compromised account remains fully usable.
- ✗
Disable the user account in Microsoft Entra ID.
Why it's wrong here
Disabling the user account in Microsoft Entra ID is a heavy-handed, permanent action that locks out the legitimate user immediately, even if the suspicious sign-in is a false positive or the user simply entered credentials on a phishing page. It also fails to revoke already-issued refresh tokens or session cookies, so the attacker may continue to access resources until token expiry. The correct approach is to contain the breach in a reversible, targeted way through risk remediation, not by disabling the whole account.
- ✗
Reset the user's password without revoking sessions.
Why it's wrong here
Resetting the user's password without revoking sessions leaves the attacker's authenticated session tokens fully valid, meaning they can continue to access mail, files, and cloud apps as if nothing happened. Modern authentication in Microsoft Entra ID relies on refresh tokens and session cookies that persist after a password change unless explicitly revoked. Therefore, a password reset must be paired with a 'sign out from all sessions' action, which is exactly what risk remediation performs.
- ✓
Initiate a user risk remediation in Microsoft Entra ID Protection by confirming compromise and resetting password with session revocation.
Why this is correct
Initiating user risk remediation in Microsoft Entra ID Protection is the correct, containment-focused response because it lets you confirm the sign-in as compromised, immediately revoke all refresh tokens and session cookies, and force the user to reauthenticate with a new password. This directly neutralizes the attacker's token-based access while preserving the legitimate user's ability to regain access after verification. It combines detection with automated, policy-driven response and is the documented best practice for handling confirmed user risk in Entra ID.
Go deeper
Related to this question
About these practice questions
One of 1,303 original SC-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.