How to Contain a Compromised User Account in Microsoft Defender for Cloud Apps
Your organization uses Microsoft Defender for Cloud Apps and Microsoft Sentinel. You receive an alert indicating that a user from the finance department accessed a sensitive SharePoint file from an IP address associated with a known malicious Tor exit node. The file contains payment information. The user's account has not been disabled. What should you do first to contain the incident?
Quick Answer
The correct first step to contain a compromised user account in Microsoft Defender for Cloud Apps is to suspend the user's account in Microsoft Entra ID. This immediately revokes all access tokens and prevents the attacker from exfiltrating sensitive data, such as the payment information in the SharePoint file, while preserving the account for forensic investigation. On the SC-200 exam, this scenario tests your ability to prioritize containment over remediation—a common trap is choosing to block the IP address, but attackers using Tor exit nodes can easily switch IPs, making that ineffective. Another trap is deleting the file, which destroys evidence, or notifying the user, which could tip off the attacker. Remember the containment-first principle: stop the bleeding before investigating. A useful memory tip is "Suspend first, ask questions later"—always disable the account immediately to halt unauthorized access, then proceed with analysis and remediation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Suspend the user's account in Microsoft Entra ID
The first step to contain the incident is to suspend the user's account in Microsoft Entra ID (Option D). This immediately revokes access to all resources, preventing further data exfiltration while preserving the current state for investigation. Option A is incorrect because deleting the SharePoint file may destroy evidence. Option B is incorrect because blocking the IP address in Defender for Cloud Apps is less effective; the attacker can easily switch to a different IP address. Option C is incorrect because notifying the user could alert a potential attacker who might have compromised the account, leading to further malicious actions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Delete the SharePoint file from the site
Why it's wrong here
Deleting the file may destroy evidence.
- ✗
Notify the user of the suspicious activity
Why it's wrong here
Notifying the user could alert the attacker.
- ✗
Block the IP address in Microsoft Defender for Cloud Apps
Why it's wrong here
Blocking IP is less effective; attacker can change IP.
- ✓
Suspend the user's account in Microsoft Entra ID
Why this is correct
Suspending the account prevents further access immediately.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-200 question from scratch — 1,235 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SC-200
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your organization uses Microsoft Defender for Cloud Apps. A security analyst receives an alert for a suspicious sign-in from an IP address in a sanctioned app. The analyst needs to immediately block the user from accessing the app. Which action should the analyst take?
medium- ✓ A.Suspend the user account in Microsoft Entra ID.
- B.Add the IP address to the blocked IP list in Defender for Cloud Apps.
- C.Create a new access policy in Defender for Cloud Apps to block the user.
- D.Revoke the user's session tokens in Microsoft Entra ID.
Why A: Suspending the user account in Microsoft Entra ID immediately revokes all access tokens and prevents the user from authenticating to any app, including the sanctioned app. This is the fastest way to block access because it disables the user's ability to sign in entirely, regardless of the app or IP address. Defender for Cloud Apps alerts often require immediate containment, and account suspension is a direct, irreversible action that stops all ongoing sessions.
Variation 2. Your organization uses Microsoft Defender for Cloud Apps. A security analyst discovers that a user's account has been compromised and is exfiltrating sensitive data from SharePoint Online. The analyst needs to immediately block the suspicious activities while allowing legitimate user activities to continue. What should the analyst do?
hard- A.Reset the user's password and require MFA
- ✓ B.Suspend the user from Defender for Cloud Apps
- C.Revoke all OAuth tokens for the user
- D.Block the user's IP address in the firewall
Why B: The 'Suspend user' action in Microsoft Defender for Cloud Apps immediately blocks the user's access to all cloud apps, terminating any active sessions and preventing further exfiltration. Option A is incorrect because resetting the password and requiring MFA does not terminate existing sessions; the attacker could still be active in current sessions. Option C is incorrect because revoking all OAuth tokens may affect legitimate applications and is not the quickest targeted action. Option D is incorrect because blocking the user's IP address might not be effective if the attacker uses a different IP, or could impact other users sharing the same IP.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.