SC-200 Respond to security incidents Practice Question
You are investigating a potential ransomware incident in Microsoft Defender XDR. The incident has a high severity alert indicating that a user installed a suspicious application. Which initial response action should you take to contain the threat while preserving evidence?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Isolate the device using Microsoft Defender for Endpoint.
Isolating the device using Microsoft Defender for Endpoint immediately stops lateral movement and data exfiltration while preserving forensic data. Option B is wrong because resetting the password and enforcing MFA does not contain the threat on the device itself. Option C is wrong because uninstalling the suspicious application may remove evidence needed for investigation. Option D is wrong because disabling the user account does not stop malware already running on the device.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Isolate the device using Microsoft Defender for Endpoint.
Why this is correct
Isolating the device via Microsoft Defender for Endpoint severs network communication while retaining the machine's live state, memory and forensic artefacts. This contains the ransomware's spread and preserves evidence, satisfying the requirement to contain the threat without destroying data needed for investigation.
- ✗
Reset the user's password and enforce MFA.
Why it's wrong here
Resetting the password and enforcing MFA does not stop the installed application executing or spreading ransomware, and it alters credentials rather than isolating the endpoint. It is tempting because credential compromise often accompanies such alerts, and this action would be right for a confirmed identity-based attack rather than malicious code on a device.
- ✗
Uninstall the suspicious application via Intune.
Why it's wrong here
Uninstalling via Intune removes the payload but does not isolate the device first, so active encryption or lateral movement continues during the uninstall and volatile artefacts are destroyed. Intune removal suits known unwanted software in a non-urgent cleanup, whereas containment demands network isolation before remediation.
- ✗
Disable the user account in Microsoft Entra ID.
Why it's wrong here
Disabling the account blocks sign-in but leaves the suspicious application running on the device, so encryption can continue and volatile evidence is lost. Account disablement is the correct containment for a compromised identity, yet here the threat is the installed binary, which requires device isolation instead.
Go deeper
Related to this question
About these practice questions
This SC-200 question is part of Courseiva's 1,303-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.