SC-200 Respond to security incidents Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Contain the incident to prevent further damage.

  Why this is correct

  Once a Sentinel incident is confirmed as a true positive, the immediate objective is to stop the attacker's ability to cause additional harm. In the NIST 800-61 incident response lifecycle, containment follows detection and analysis, preceding eradication and recovery. In practice, this means initiating actions such as disabling the compromised account, isolating the asset via Microsoft Defender for Endpoint's device isolation, or blocking malicious IOCs in Microsoft Sentinel or Microsoft Defender. Delaying containment to perform deeper analysis risks lateral movement, data exfiltration, and destructive actions, which is why this is the unequivocal first step.

• ✗

  Perform a root cause analysis.

  Why it's wrong here

  Root cause analysis (RCA) is a deep investigative activity that is performed only after the threat is contained and eradicated. In Sentinel, RCA would involve reconstructing the entire attack timeline, analyzing the initial access vector, and identifying the underlying vulnerability or misconfiguration that allowed the incident to occur. While crucial for preventing recurrence, RCA does not reduce active risk and should not be executed while malicious actors still have a foothold in the environment. It is formally part of the post-incident activity phase, not the immediate action after confirming a true positive.

• ✗

  Create a new analytic rule to detect similar activity.

  Why it's wrong here

  Creating a new analytic rule in Microsoft Sentinel to detect similar activity is an improvement to detection capability, which belongs to the post-incident 'lessons learned' phase, not the immediate response. At the moment of confirmation, the SOC still lacks the complete attack pattern and indicators needed to write an accurate, high-fidelity KQL detection rule; acting prematurely may result in either excessive false positives or missed variants. Moreover, a new rule would only create alerts for future incidents and has no effect on the currently active incident. Only after eradicating the threat and fully understanding the behavior can you build a reliable rule that aligns with the observed MITRE ATT&CK technique.

• ✗

  Document the incident in a detailed report.

  Why it's wrong here

  Writing a detailed incident report is essential for compliance, communication, and process improvement, but it must occur after containment, eradication, and recovery have stabilized the environment. A report prepared during the active incident would be incomplete and potentially inaccurate because it lacks final findings, actions taken, and evidence gathered after containment. In Sentinel, analysts document the full chronology in the incident's comments or in an external case management system, but this is a closing activity. Prioritizing documentation over containment while an attacker is active would leave the environment exposed and violates the incident response sequence.

Go deeper

Related to this question