SC-200 Respond to security incidents Practice Question
Wide World Importers uses Microsoft Sentinel, Microsoft Defender XDR, and Microsoft Purview for data loss prevention (DLP). An incident is generated: 'DLP policy violation - sensitive data shared externally.' The incident shows that a user shared a document containing credit card numbers via SharePoint Online with an external guest. The user is a finance department employee. You need to respond to the incident. The organization wants to minimize business disruption while protecting data. Which of the following is the BEST immediate action?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Remove the external guest's access to the document in SharePoint Online.
Removing the external guest's access to the document stops data exposure without affecting the user's work. Option A is wrong: disabling the user prevents all work and may be too drastic. Option B is wrong: deleting the document destroys evidence. Option D is wrong: DLP policy change takes time and does not stop current exposure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Delete the document from SharePoint Online.
Why it's wrong here
Deleting the document from SharePoint Online is irreversible unless the item is still in the recycle bin, and it would destroy the original content needed for forensic analysis in Microsoft Purview audit logs or Sentinel. The file may also be required to determine the blast radius, identify the exact sharing link that exposed credit card data, and preserve business records. It also prevents you from validating whether the external guest actually accessed or exfiltrated the data.
- ✗
Modify the DLP policy to block sharing of credit card numbers.
Why it's wrong here
Modifying the DLP policy to block future sharing of credit card numbers is a preventive control that only affects newly created sharing links or uploads after the policy takes effect. It does nothing to revoke the guest's existing access to the document, because the sharing link or direct permission remains valid. The current incident requires immediate containment—revoking access—not a long-term policy adjustment that will take time to propagate across Microsoft 365.
- ✓
Remove the external guest's access to the document in SharePoint Online.
Why this is correct
Removing the external guest's access to the document in SharePoint Online is the correct containment step because it directly targets the specific sharing permission that caused the incident. This action revokes the guest's ability to view or download the file while preserving the document for investigation and allowing internal users with existing permissions to continue working. It is a granular, least-privilege response that minimizes disruption and aligns with Microsoft incident response guidance for external sharing.
- ✗
Disable the user's account in Microsoft Entra ID and investigate.
Why it's wrong here
Disabling the user's account in Microsoft Entra ID is an over-broad response that would block the user from accessing all resources, not just the exposed document, potentially halting critical business operations. The incident may be the result of an accidental misconfigured sharing link rather than a compromised identity, so disabling the account is premature without evidence of unauthorized account activity. You should instead investigate the sharing metadata and audit logs to confirm whether the user's credentials were used to share the file.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-200 question from scratch — 673 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.