SC-200 Respond to security incidents Practice Question
Which TWO are immediate containment actions in Microsoft Sentinel for a compromised Azure VM? (Choose two.)
⚠ Common exam trap
Do not confuse remediation (installing anti-malware, resetting passwords, backups) with immediate containment (network isolation). Microsoft Sentinel automation rules trigger playbooks; they do not directly stop VMs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply an NSG to block all inbound and outbound traffic
(Apply an NSG to block all inbound and outbound traffic), an immediate containment action that isolates the compromised Azure VM by blocking network traffic. Option A (install anti-malware extension) is a remediation step, not immediate containment. Option C (reset password) does not stop an active attack and may interfere with investigation. Option D (initiate VM backup) is not containment and could preserve compromised data. Option E (stop the VM using an automation rule) is not a valid Sentinel containment action; automation rules trigger playbooks and do not directly stop VMs, and stopping the VM can destroy volatile evidence.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Install anti-malware extension
Why it's wrong here
Installing an anti-malware extension remediates files on the host but does not sever the attacker's access, so the VM stays reachable and controllable. It is tempting because endpoint protection is a legitimate response action, and would be correct during the later eradication and recovery phase rather than containment.
- ✓
Apply an NSG to block all inbound and outbound traffic
Why this is correct
Attaching a network security group denies all inbound and outbound traffic to the VM, cutting command-and-control and lateral movement immediately. This satisfies the containment requirement by isolating the compromised host while investigation continues, without deleting evidence.
- ✗
Reset the VM administrator password
Why it's wrong here
Resetting the local administrator password does not terminate existing sessions, tokens or reverse shells, so the attacker retains access. It is tempting because credential rotation is a standard remediation step, and would be correct once the host is isolated and the incident moves into recovery.
- ✗
Initiate a VM backup
Why it's wrong here
A backup captures the current disk state but leaves the VM running and connected, so it neither isolates the host nor stops the attack. It is tempting because preserving evidence matters in forensics, and would be correct for evidence collection after containment rather than as a containment action itself.
- ✗
Stop the VM using an automation rule
Why it's wrong here
An automation rule can stop the VM directly from the incident, halting malicious processes and denying the attacker further execution. This satisfies immediate containment by removing the running workload from the network while preserving the disk for forensic analysis.
Go deeper
Related to this question
About these practice questions
This SC-200 question is part of Courseiva's 1,303-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.