SC-200 Respond to security incidents Practice Question

Which TWO actions are valid containment steps for a compromised user account in Microsoft Defender XDR?

⚠ Common exam trap

Candidates often confuse remediation steps (like running an antivirus scan) with containment steps, or they mistakenly think that adding a user to a privileged role could help monitor the account, when in fact it escalates the compromise.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Disable the user account in Microsoft Entra ID

Disabling the user account in Microsoft Entra ID is a valid containment step because it immediately revokes the user's access to all cloud resources, including Microsoft 365, Azure, and any applications relying on Entra ID authentication. This prevents the compromised account from being used for further malicious activities while preserving the account for investigation. It is a core incident response action in Microsoft Defender XDR for containing identity-based threats.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Create a new email rule to forward emails
Why it's wrong here
Not containment.
✓
Disable the user account in Microsoft Entra ID
Why this is correct
Containment by disabling.
✗
Add the user to a privileged role
Why it's wrong here
Escalates access.
✓
Reset the user's password
Why this is correct
Containment by password reset.
✗
Run a full antivirus scan on the user's device
Why it's wrong here
Remediation, not containment.

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Last reviewed: Jul 4, 2026

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

Keep practising

Question 1,431 of 1,038

Next question

Scored practice sessions

Quick scored rounds with instant marking and a written explanation per question.

Free SC-200 Practice Test 1 — 30 Questions→SC-200 Practice Questions 2 — 50 Questions→

Practice by domain

Each domain maps to a weighted exam section. Focus on the domain where you are weakest.

Respond to security incidents Perform threat hunting Manage a security operations environment

Practice by question type

Practise one question format at a time: exhibits, multi-select, drag-and-drop, troubleshooting.

Browse scenarios

Go deeper on a topic

Each topic page collects the questions that test one concept, plus the theory behind it.

Respond to security incidents practice questions SC-200 troubleshooting practice questions Manage a security operations environment practice questions Perform threat hunting practice questions SC-200 scenario practice questions

Continue studying

All Microsoft practice questions All SC-200 questions Study guide

This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.