SC-200 Manage a security operations environment Practice Question
You are a security analyst at a company that uses Microsoft Defender for Cloud Apps. You receive an alert that an anomalous activity was detected from a user's device. You need to investigate the activity to determine if it is a true positive. What should you do first?
⚠ Common exam trap
Candidates often confuse the investigation phase with the remediation phase, incorrectly choosing to block the IP (Option D) or review sign-in logs (Option C) before examining the actual activity details that confirm the threat.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
In the Microsoft Defender for Cloud Apps portal, open the alert and then click 'View activity' to see the detailed activity log.
The first step in investigating an anomalous activity alert in Microsoft Defender for Cloud Apps is to open the alert and click 'View activity' to examine the detailed activity log. This log provides the raw telemetry—such as IP address, user agent, timestamp, and activity type—needed to determine if the behavior is malicious or benign. Without reviewing this evidence, you cannot make an informed judgment about the alert's validity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use Microsoft Power BI to analyze user activity data.
Why it's wrong here
Microsoft Power BI is a business analytics service meant for visualizing and modeling data from various sources, not an integrated investigation tool within Microsoft Defender for Cloud Apps. You could theoretically export raw activity logs into Power BI and build a custom report, but that is a slow, indirect workaround that requires extra data engineering and does not leverage the native alert context. The Defender for Cloud Apps portal already provides a direct, structured activity view for any alert, so Power BI is neither the intended nor the most efficient way to investigate a specific suspicious action.
- ✓
In the Microsoft Defender for Cloud Apps portal, open the alert and then click 'View activity' to see the detailed activity log.
Why this is correct
In Microsoft Defender for Cloud Apps, alerts are backed by discrete activity records captured via API connectors and conditional access app control. Opening the alert and clicking 'View activity' takes you to the Activity log with a filter pre-applied to that exact event, showing user, IP address, user agent, device, cloud app, action, and result. This is the native investigation path designed for alert triage, allowing you to pivot to adjacent activities, related alerts, or governance actions without leaving the portal. It directly answers who did what, from where, when, and with what outcome, which is exactly what an analyst needs for this alert.
- ✗
Open the user's page in Microsoft Entra ID to review sign-in logs.
Why it's wrong here
Microsoft Entra ID sign-in logs contain authentication events such as successful or failed logins, MFA challenges, and conditional access grants, but they do not capture granular in-app actions like file downloads, email forwarding, or permission changes in connected cloud apps. The alert in Defender for Cloud Apps is about a post-authentication activity, so the user may already have been signed in for hours, and the sign-in log would not show the specific action that triggered the alert. While sign-in logs are useful for identity-specific investigations, they are not the definitive source for cloud app activity and would likely miss the event that generated this alert.
- ✗
Create an IP address range policy to block the user's IP.
Why it's wrong here
Creating an IP address range policy in Defender for Cloud Apps is a remediation or governance action, not an investigation technique. Blocking an IP does not help you determine whether the activity was malicious, which user account was involved, or what files were accessed—it only stops future traffic from that IP after the fact. It also risks over-blocking if the IP is shared by legitimate users or sits behind a NAT, potentially causing an outage. Investigation must happen first, via the alert's 'View activity' action, before considering any conditional access or governance policy changes.
Go deeper
Related to this question
About these practice questions
One of 1,303 original SC-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.