SC-200 Respond to security incidents Practice Question
Your organization has deployed Microsoft Sentinel with the Microsoft Defender XDR connector. A high-severity incident is created for a user who received a phishing email that contained a malicious link. The user clicked the link, and the attacker gained access to the user's mailbox. The security team needs to remove the attacker's access and prevent future occurrences. What should you do first?
⚠ Common exam trap
SC-200 often tests the order of incident response actions; the trap is focusing on password reset or antivirus scans while missing the attacker's persistence mechanisms like forwarding rules.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Remove any mailbox forwarding rules and delegated access
The first step should be to remove any mailbox forwarding rules and delegated access because attackers often set up persistence mechanisms to maintain access even after password resets. Removing these ensures the attacker cannot continue to receive emails or access the mailbox. This is a critical containment step before other remediation actions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Run a full antivirus scan on the user's device
Why it's wrong here
A full antivirus scan targets endpoint malware and does nothing to revoke the attacker's mailbox access or session tokens. It would be correct for suspected device compromise, but here the priority is containing the identity compromise by disabling the account and revoking sessions.
- ✗
Reset the user's password immediately
Why it's wrong here
Password reset alone leaves the attacker's existing session tokens and mailbox delegation intact, so access persists. It is tempting because credential rotation is a standard containment step after confirmed compromise, and would be correct once sessions are revoked and the malicious inbox rule is removed.
- ✗
Report the incident to Microsoft for further investigation
Why it's wrong here
Reporting to Microsoft feeds threat intelligence but does not remove the attacker's live mailbox access, leaving persistence intact. It suits confirmed platform vulnerabilities or widespread campaigns, whereas this incident requires immediate containment of the compromised user account and its active sessions.
- ✓
Remove any mailbox forwarding rules and delegated access
Why this is correct
Attackers persist by creating hidden inbox forwarding rules and granting delegated mailbox access, so removing these first severs the attacker's ongoing access to the compromised mailbox. Containment precedes broader remediation such as password resets or investigation, satisfying the requirement to remove access immediately.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-200 question from scratch — 1,303 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.