SC-200 Respond to security incidents Practice Question
Which TWO actions should be taken to respond to a potential data exfiltration incident detected by Microsoft Defender for Cloud Apps?
⚠ Common exam trap
Test-takers frequently confuse 'revoking sessions' (a temporary measure) with 'suspending the account' (a permanent containment action), and may incorrectly think that blocking an IP address or running an antivirus scan is a sufficient immediate response to data exfiltration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Suspend the user account in Microsoft Entra ID.
Suspending the user account in Microsoft Entra ID immediately revokes the user's ability to authenticate, preventing further access to cloud resources and stopping potential data exfiltration. This is a direct containment action that aligns with incident response best practices for compromised accounts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Block the IP address of the user's device at the firewall.
Why it's wrong here
Blocking the user's IP at the firewall is a network-layer control that only restricts traffic from that source address; it does not invalidate already-issued access tokens or active sessions, and the user can easily switch to a different device, network, or VPN to re-authenticate. This action is also imprecise, potentially affecting other users behind the same NAT or proxy, while leaving the actual compromise vector (the identity) untouched. It may be a supplemental step, but it is not a definitive containment action.
- ✓
Suspend the user account in Microsoft Entra ID.
Why this is correct
Suspending the user account in Microsoft Entra ID immediately disables the account, preventing the user from authenticating and blocking issuance of new access tokens across all Entra ID-integrated cloud applications, including Exchange Online, SharePoint, and Teams. This is the most direct and comprehensive identity-centric containment action because it removes the attacker's ability to log in regardless of endpoint, IP, or session state. It also stops password-based and token-based access at the source, making it the preferred first step in responding to a compromised identity.
- ✗
Report the user to Microsoft for investigation.
Why it's wrong here
Reporting the user to Microsoft for investigation is a post-incident forensic step, not an immediate response action. Microsoft support teams cannot suspend an account or revoke sessions within your tenant on your behalf in near real time, and the process involves creating a support ticket and waiting for a response. This action does nothing to contain ongoing exfiltration, so it should be deferred until after you have directly disabled the account and revoked active sessions, and only if you need Microsoft's assistance with deeper investigation or legal escalation.
- ✓
Revoke all active sessions for the user in Defender for Cloud Apps.
Why this is correct
Revoking all active sessions for the user in Defender for Cloud Apps forcibly terminates the user's current access tokens and session cookies, requiring reauthentication before any further access to governed cloud apps is allowed. This action stops an attacker who is actively using an existing session to exfiltrate data, without waiting for the account to be disabled, and it is particularly useful when you want to minimize disruption to a legitimate user. However, it is scoped to apps monitored by Defender for Cloud Apps policies, so it should be combined with account suspension to ensure coverage across all cloud services.
- ✗
Run a full antivirus scan on the user's device.
Why it's wrong here
Running a full antivirus scan on the user's device addresses possible endpoint malware but does not resolve the immediate threat of cloud app exfiltration, which occurs through legitimate authentication and session tokens rather than malicious code on the device. A scan is time-consuming and does not block or revoke the attacker's active access, so it fails as an initial containment step. Endpoint scanning is appropriate only after you have contained the identity compromise, and only if you have reason to believe the device itself is compromised.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-200 question from scratch — 1,303 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.