SC-200 Respond to security incidents Practice Question
Your company uses Microsoft Defender XDR. A critical server is exhibiting signs of a potential ransomware attack, with files being encrypted and a ransom note appearing. The incident has been escalated to the security operations center (SOC). What is the most immediate action to contain the threat and prevent further spread?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Initiate the 'Contain device' action from Microsoft Defender XDR
Initiate the 'Contain device' action from Microsoft Defender XDR. This action immediately isolates the compromised device from the network, preventing the ransomware from spreading to other systems. Option A is incorrect because collecting an investigation package is for forensic analysis, not containment. Option B is incorrect because disabling the user account does not stop the ransomware process that is already running on the server. Option D is incorrect because running a full antivirus scan takes time and does not contain the threat; containment must happen first.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Collect an investigation package for analysis
Why it's wrong here
Collecting an investigation package gathers forensic evidence for later analysis; it neither terminates the encrypting process nor isolates the host, so encryption continues. It is tempting because it preserves artefacts for root-cause work, and would be correct once containment is achieved and the SOC begins scoping the breach.
- ✗
Disable the user account that was logged on
Why it's wrong here
Disabling the logged-on account revokes that identity's access, yet the malware already running on the server keeps encrypting files and can spread laterally via other credentials or services. Account disablement is correct for a compromised identity, not for containing active malware on a host.
- ✓
Initiate the 'Contain device' action from Microsoft Defender XDR
Why this is correct
Contain device isolates the server from the network via Microsoft Defender XDR while preserving the live session for investigation, immediately halting encryption and lateral spread. This satisfies the stem's requirement for the most immediate containment action against active ransomware.
- ✗
Run a full antivirus scan on the server
Why it's wrong here
A full antivirus scan inspects files but does not sever the attacker's command-and-control channel or stop ongoing encryption, and signature-based scanning often misses ransomware. Scanning suits routine hygiene checks on a quarantined endpoint; containment requires isolating the device from the network first.
Go deeper
Related to this question
About these practice questions
This SC-200 question is part of Courseiva's 1,303-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.