SC-200 Respond to security incidents Practice Question
Which TWO playbook actions can be used to automatically contain a compromised user account in Microsoft Entra ID during an incident? (Choose TWO.)
⚠ Common exam trap
Test-takers frequently confuse 'password reset' (a remediation step) with 'containment,' or they think 'sending a notification' is an automated response, when in fact only actions that immediately block access (disable account, revoke tokens) qualify as containment in Microsoft 365 Defender playbooks.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Disable the user account via Microsoft Graph API.
Disabling a user account via Microsoft Graph API is a direct containment action that immediately prevents the compromised account from authenticating and accessing resources. This is a standard automated response in Microsoft Sentinel or Microsoft 365 Defender playbooks to stop an active incident.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Reset the user's password.
Why it's wrong here
Resetting the user's password in Microsoft Entra ID does not invalidate existing access tokens or refresh tokens. Active sessions and tokens continue to operate until they naturally expire, so an attacker with an open session remains undeterred. Therefore, password change alone is not an immediate containment action and may even alert the attacker while access persists.
- ✗
Send a notification email to the user.
Why it's wrong here
Sending a notification email to the user is a communication step, not a security control. It does not block the compromised account or terminate any active sessions, so malicious activity can continue unabated. An automated containment playbook should perform an enforcement action, such as disabling the account or revoking sessions, rather than merely informing the user.
- ✓
Disable the user account via Microsoft Graph API.
Why this is correct
Disabling the user account via the Microsoft Graph API (PATCH /users/{id} with accountEnabled set to false) immediately prevents the user from authenticating and blocks new token issuance. This identity-level control stops the attacker from accessing any Microsoft 365 resources and is a strong containment measure. Because it also prevents legitimate use, it is often reserved for confirmed compromises and is followed by investigation and remediation.
- ✗
Add the user to a group that has access to critical resources.
Why it's wrong here
Adding the user to a group that has access to critical resources would expand their privileges, not contain an incident. This action increases the potential blast radius and grants the attacker more attack surface, making containment worse. A playbook designed for containment should remove access or apply a deny policy, never add the user to sensitive groups.
- ✓
Revoke all refresh tokens and sessions for the user.
Why this is correct
Revoking all refresh tokens and sessions for the user via Microsoft Graph API (POST /users/{id}/revokeSignInSessions) invalidates every current token and session, forcing the user and any attacker to reauthenticate. This action cuts off the attacker's active access while leaving the account enabled for the legitimate user to sign back in, often with additional MFA challenges. It is a precise containment step that limits disruption compared to disabling the account.
Go deeper
Related to this question
About these practice questions
This SC-200 question is part of Courseiva's 1,303-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.