SC-200 Respond to security incidents Practice Question
Your organization uses Microsoft Defender for Cloud Apps. A security analyst receives an alert for a suspicious sign-in from an IP address in a sanctioned app. The analyst needs to immediately block the user from accessing the app. Which action should the analyst take?
⚠ Common exam trap
Many exam-takers confuse a Defender for Cloud Apps policy (which is a conditional access-like rule that applies to future traffic) with the immediate, account-level containment action available in Microsoft Entra ID, which is the fastest way to stop an active threat.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Suspend the user account in Microsoft Entra ID.
Suspending the user account in Microsoft Entra ID immediately revokes all access tokens and prevents the user from authenticating to any app, including the sanctioned app. This is the fastest way to block access because it disables the user's ability to sign in entirely, regardless of the app or IP address. Defender for Cloud Apps alerts often require immediate containment, and account suspension is a direct, irreversible action that stops all ongoing sessions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Suspend the user account in Microsoft Entra ID.
Why this is correct
Suspending the user account in Microsoft Entra ID immediately disables the user object, preventing any fresh authentication and token issuance for all applications, including the sanctioned app protected by Defender for Cloud Apps. This is the most direct and effective containment action because it blocks all sign-in attempts regardless of device, network, or app, and takes effect nearly immediately across Microsoft's identity plane.
- ✗
Add the IP address to the blocked IP list in Defender for Cloud Apps.
Why it's wrong here
Adding the IP address to the blocked IP list in Defender for Cloud Apps creates a tenant-wide restriction that applies to every user behind that IP (e.g., behind a corporate NAT), causing collateral damage and not isolating the compromised user specifically. Furthermore, if the attacker is using a different source IP or a mobile network, the block is easily bypassed and does not revoke already-issued session tokens.
- ✗
Create a new access policy in Defender for Cloud Apps to block the user.
Why it's wrong here
Creating a new access policy in Defender for Cloud Apps is a slow, reactionary measure because policies require configuration, propagation time, and may only apply to new activities rather than terminating the current session. The policy also depends on matching specific conditions (e.g., user attributes, location, risk score); until those conditions are met, the user retains access, so this does not provide the immediate, account-level enforcement needed.
- ✗
Revoke the user's session tokens in Microsoft Entra ID.
Why it's wrong here
Revoking the user's session tokens in Microsoft Entra ID terminates active sessions by invalidating tokens, but it does not invalidate the user's stored credentials or change the account status. As a result, the user (or attacker) can simply re-authenticate with valid username/password or password and gain new tokens, making this only a temporary disruption rather than a permanent solution.
Go deeper
Related to this question
About these practice questions
This SC-200 question is part of Courseiva's 1,303-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.