SC-200 Respond to security incidents Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Create a new email rule to forward emails

  Why it's wrong here

  Creating an email forwarding rule on the compromised mailbox is not a containment action because it does not restrict or sever the attacker's existing access; instead, it may actually facilitate data exfiltration by automatically sending sensitive emails to an external address. Since an attacker could use such a rule to maintain visibility or steal information, it runs contrary to the goal of isolating the incident. Proper containment would involve revoking credentials and blocking sign-ins, not modifying mailbox behavior.

• ✓

  Disable the user account in Microsoft Entra ID

  Why this is correct

  Disabling the user account in Microsoft Entra ID is a valid containment step because it immediately prevents any further authentication attempts using that identity, cutting off the attacker's current access path to cloud applications, Microsoft 365, and other Entra ID-integrated resources. This reversible, non-destructive action preserves all user data and activity logs for forensic analysis while stopping ongoing malicious activity. It is one of the first actions an incident responder should take when a user identity is known to be compromised.

• ✗

  Add the user to a privileged role

  Why it's wrong here

  Adding the user to a privileged role is the opposite of containment, as it escalates the account's permissions and expands the attacker's reach into the environment. Granting roles such as Global Administrator or Privileged Role Administrator would give the attacker additional control over tenant settings, potentially enabling persistence mechanisms like backdoor accounts or modified policies. This action would increase the blast radius and should never be taken during a containment phase.

• ✓

  Reset the user's password

  Why this is correct

  Resetting the user's password invalidates the attacker's stolen credentials and forces the legitimate user to authenticate with a new secret, making it a direct containment measure for credential-compromise incidents. However, it is important to understand that password reset alone may not terminate existing sessions or revoke tokens, so it should be paired with Entra ID's "Revoke sessions" feature or equivalent to fully contain the attack. Nevertheless, it removes the immediate authentication vector the attacker is likely using.

• ✗

  Run a full antivirus scan on the user's device

  Why it's wrong here

  Running a full antivirus scan on the user's device is a remediation or eradication step, not a containment action, because it attempts to clean a compromised host rather than isolate the compromised identity or stop access to cloud resources. Even if malware is detected and removed, the attacker could still retain valid credentials, session tokens, or other footholds, allowing continued access. Containment should first focus on breaking the attacker's authentication and access paths, such as disabling the account or resetting credentials, before scanning for malware.

Go deeper

Related to this question