SC-200 Respond to security incidents Practice Question
Contoso uses Microsoft Sentinel with Microsoft Defender XDR connector. You receive an incident titled 'Malware detected on endpoint' from Microsoft Defender for Endpoint. The incident includes a detailed timeline showing that the malware was downloaded from a malicious URL. You need to respond to the incident using Microsoft Sentinel and Microsoft Defender XDR capabilities. The affected device is a Windows 10 workstation used by a standard user. You have been asked to contain the threat and prevent recurrence. The organization has a policy to preserve evidence for 90 days. Which action should you take FIRST?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Isolate the device using Microsoft Defender for Endpoint device isolation.
Isolating the device using Microsoft Defender for Endpoint immediately contains the threat by disconnecting the device from the network, preventing the malware from spreading or communicating with command-and-control servers. This is the priority first step in incident response. Option A is incorrect because resetting the password does not remove malware from the device. Option B is incorrect creating a custom detection rule is a proactive step but not an immediate containment action. Option C is incorrect because blocking the URL at the firewall prevents further downloads but does not contain the already infected device.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Reset the user's password and revoke sessions in Microsoft Entra ID.
Why it's wrong here
Credential reset addresses identity compromise, yet the incident timeline shows malware executing on the device, so the endpoint remains infected and active. Password resets are tempting because they are standard for account takeover, and would be first if the alert indicated stolen credentials rather than endpoint malware.
- ✗
Create a custom detection rule in Microsoft Sentinel for the malicious URL.
Why it's wrong here
Detection rules generate new alerts from future log matches; they neither isolate the infected Windows 10 device nor stop the active malware. They are tempting because they address recurrence, and would be correct later once containment and evidence preservation are complete.
- ✗
Block the malicious URL at the firewall using Microsoft Defender for Cloud Apps.
Why it's wrong here
Blocking the URL at the firewall prevents re-download but leaves the already-infected Windows 10 workstation running and communicating, so containment fails. URL blocking is tempting because it stops recurrence, and would be right after the device is isolated and evidence preserved.
- ✓
Isolate the device using Microsoft Defender for Endpoint device isolation.
Why this is correct
Device isolation via Microsoft Defender for Endpoint immediately cuts the workstation's network connections while preserving the live system and its forensic artefacts, containing lateral movement and further payload downloads. Remediation and evidence collection follow safely afterwards, satisfying the 90-day preservation policy.
Go deeper
Related to this question
About these practice questions
This SC-200 question is part of Courseiva's 1,303-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.