Question 617 of 1,639

Manage a security operations environment →hardMultiple ChoiceObjective-mapped

Quick Answer

The correct answer is Option A because it directly automates the incident response disable user playbook Graph API workflow within Microsoft Sentinel, which is the only solution that minimizes manual intervention while addressing the compromised account in Microsoft Entra ID. By triggering the playbook on incident creation and using the Microsoft Graph API to disable the user and revoke sessions, you ensure the SOC team can block further access without any manual steps, fully aligning with the requirement to automate the response. On the SC-200 exam, this scenario tests your understanding of how playbooks integrate with automation rules and the Graph API for identity remediation, often trapping candidates who confuse alert-triggered playbooks (Option B) with incident-triggered ones—remember that incidents aggregate alerts, so triggering on the incident gives you richer context and a single point of automation. A common memory tip: think “Incident triggers the Graph, not the alert” to avoid picking Defender for Cloud Apps API options that only suspend rather than disable the account.

SC-200 Manage a security operations environment Practice Question

This SC-200 practice question tests your understanding of manage a security operations environment. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.

Your organization, Contoso, uses Microsoft Sentinel in a single Log Analytics workspace. You have ingested logs from Microsoft Defender XDR, Microsoft Entra ID, and Azure Firewall. The SOC team needs to investigate an incident where a user's account was compromised and used to access sensitive data from an external IP address. The incident was created from a Microsoft Defender for Cloud Apps alert. The SOC team wants to automatically block the user from further access and disable the user account in Microsoft Entra ID. You need to design an automated response using Microsoft Sentinel playbooks. The solution must minimize manual intervention. You have the following options: A) Create a playbook that triggers on the incident and uses the Microsoft Graph API to disable the user account and revoke sessions. Configure the playbook to run automatically from an automation rule. B) Create a playbook that triggers on the alert and uses the Defender for Cloud Apps API to suspend the user. Configure the automation rule to run the playbook on incident creation. C) Create a playbook that sends an email to the SOC team to manually disable the user. D) Create an automation rule that automatically changes the incident status to 'Active' and assigns it to a senior analyst. Which option should you choose?

Clue words in this question

Noticing these words before you look at the options changes how you read each choice.

Clue: "minimum / minimize"
Why it matters: Asks for the least resource use — fewest addresses, smallest subnet, lowest overhead. Eliminate over-provisioned options even if they would technically work.

Question 1hardmultiple choice

Read the full Ansible explanation →

A
Create an automation rule that automatically changes the incident status to 'Active' and assigns it to a senior analyst.
Why wrong: This does not block the user; it only manages the incident lifecycle.
B
Create a playbook that sends an email to the SOC team to manually disable the user.
Why wrong: Manual intervention is not minimized; this delays response.
C
Create a playbook that triggers on the alert and uses the Defender for Cloud Apps API to suspend the user. Configure the automation rule to run the playbook on incident creation.
Why wrong: Suspending the user in Defender for Cloud Apps may not disable the user in Entra ID, leaving the account potentially usable for other services.
D
Create a playbook that triggers on the incident and uses the Microsoft Graph API to disable the user account and revoke sessions. Configure the playbook to run automatically from an automation rule.
This is the correct approach. The playbook can directly disable the user in Entra ID and revoke sessions, providing immediate response.

Full breakdown with real-world context →

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Create a playbook that triggers on the incident and uses the Microsoft Graph API to disable the user account and revoke sessions. Configure the playbook to run automatically from an automation rule.

Option D is correct because it uses a playbook triggered on incident creation and leverages the Microsoft Graph API to disable the user account and revoke sessions, which directly addresses the compromised account in Microsoft Entra ID. This approach minimizes manual intervention by automating the entire response within Microsoft Sentinel, aligning with the requirement to block further access and disable the account automatically.

Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Create an automation rule that automatically changes the incident status to 'Active' and assigns it to a senior analyst.
Why it's wrong here
This does not block the user; it only manages the incident lifecycle.
✗
Create a playbook that sends an email to the SOC team to manually disable the user.
Why it's wrong here
Manual intervention is not minimized; this delays response.
✗
Create a playbook that triggers on the alert and uses the Defender for Cloud Apps API to suspend the user. Configure the automation rule to run the playbook on incident creation.
Why it's wrong here
Suspending the user in Defender for Cloud Apps may not disable the user in Entra ID, leaving the account potentially usable for other services.
✓
Create a playbook that triggers on the incident and uses the Microsoft Graph API to disable the user account and revoke sessions. Configure the playbook to run automatically from an automation rule.
Why this is correct
This is the correct approach. The playbook can directly disable the user in Entra ID and revoke sessions, providing immediate response.
Clue confirmation
The clue word "minimum / minimize" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.

Common exam traps

Common exam trap: answer the scenario, not the keyword

The trap here is that candidates may choose Option C, mistakenly believing that suspending the user via Defender for Cloud Apps API is sufficient, but it does not disable the account in Microsoft Entra ID or revoke all sessions, leaving potential access paths open.

Detailed technical explanation

How to think about this question

The Microsoft Graph API's `user: revokeSignInSessions` endpoint invalidates all refresh and session tokens for a user, effectively blocking further access, while the `user: update` endpoint can disable the account by setting `accountEnabled` to false. Playbooks in Microsoft Sentinel use Azure Logic Apps to execute these API calls, and automation rules can trigger the playbook on incident creation with a condition like 'Provider: Microsoft Defender for Cloud Apps' to ensure precise targeting.

KKey Concepts to Remember

Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.

TExam Day Tips

Watch for words such as best, first, most likely and least administrative effort.
Review why wrong options are wrong, not only why the correct option is correct.

Key takeaway

Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Real-world example

How this comes up in practice

A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.

What to study next

Got this wrong? Here's your next step.

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

Related SC-200 practice-question pages

Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.

Manage a security operations environment practice questions

Practise SC-200 questions linked to Manage a security operations environment.

Respond to security incidents practice questions

Practise SC-200 questions linked to Respond to security incidents.

Perform threat hunting practice questions

Practise SC-200 questions linked to Perform threat hunting.

Mitigate threats using Microsoft Defender XDR practice questions

Practise SC-200 questions linked to Mitigate threats using Microsoft Defender XDR.

Mitigate threats using Microsoft Defender for Cloud practice questions

Practise SC-200 questions linked to Mitigate threats using Microsoft Defender for Cloud.

Mitigate threats using Microsoft Sentinel practice questions

Practise SC-200 questions linked to Mitigate threats using Microsoft Sentinel.

SC-200 fundamentals practice questions

Practise SC-200 questions linked to SC-200 fundamentals.

SC-200 scenario practice questions

Practise SC-200 questions linked to SC-200 scenario.

SC-200 troubleshooting practice questions

Practise SC-200 questions linked to SC-200 troubleshooting.

Practice this exam

Start a free SC-200 practice session

Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.

10 questions 20 questions 30 questions 50 questions Timed 30

SC-200 practice-test guide →Study guide →Browse all practice tests

FAQ

Questions learners often ask

What does this SC-200 question test?

Manage a security operations environment — This question tests Manage a security operations environment — Read the scenario before looking for a memorised answer..

What is the correct answer to this question?

The correct answer is: Create a playbook that triggers on the incident and uses the Microsoft Graph API to disable the user account and revoke sessions. Configure the playbook to run automatically from an automation rule. — Option D is correct because it uses a playbook triggered on incident creation and leverages the Microsoft Graph API to disable the user account and revoke sessions, which directly addresses the compromised account in Microsoft Entra ID. This approach minimizes manual intervention by automating the entire response within Microsoft Sentinel, aligning with the requirement to block further access and disable the account automatically.

What should I do if I get this SC-200 question wrong?

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

Are there clue words in this question I should notice?

Yes — watch for: "minimum / minimize". Asks for the least resource use — fewest addresses, smallest subnet, lowest overhead. Eliminate over-provisioned options even if they would technically work.

What is the key concept behind this question?

Read the scenario before looking for a memorised answer.

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Keep practising

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.