SC-200 Respond to security incidents Practice Question
Your organization uses Microsoft Defender for Cloud Apps. You receive an alert that an administrator performed an unusual bulk download from SharePoint. What is the recommended first step to respond?
⚠ Common exam trap
The trap here is that candidates often jump to immediate containment actions (like suspending the account or blocking the IP) without first gathering context, but Microsoft's recommended incident response process emphasizes 'investigate before contain' to avoid false positives and operational disruption.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Review the activity log in Defender for Cloud Apps to determine the context.
The recommended first step when investigating an alert in Microsoft Defender for Cloud Apps is to review the activity log to understand the context of the alert. This allows the analyst to determine whether the bulk download is legitimate (e.g., a scheduled backup or migration) or malicious (e.g., data exfiltration). Jumping to containment actions without context can disrupt business operations and potentially alert an attacker.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Report the activity to Microsoft for further analysis.
Why it's wrong here
Reporting the activity to Microsoft for further analysis would prematurely hand off the incident to external support without first building a local evidence baseline. The Defender for Cloud Apps activity log already contains the contextual details needed for triage, and Microsoft cannot adjudicate whether this particular administrator action was business-as-usual or malicious. This option also does nothing to reduce immediate risk if the activity is truly harmful.
- ✗
Suspend the administrator's account immediately.
Why it's wrong here
Immediately suspending the administrator's account is an aggressive containment measure that can lock out a legitimate user and interrupt critical administrative workflows. In Defender for Cloud Apps, account suspension should be triggered only after corroborating evidence, such as impossible travel or a series of failed sign-ins, is visible in the activity log. Acting without investigation may turn a benign false positive into an unnecessary outage.
- ✗
Block the IP address of the administrator's device.
Why it's wrong here
Blocking the administrator's device IP address is problematic because the IP may be a NAT gateway, a shared corporate egress, or a dynamic address that changes frequently, so the block could impact many other users. An attacker can also easily pivot to a different IP, making this action ineffective as a standalone response. The activity log provides the IP's location and risk score, which are essential to determine whether IP-specific blocking is even relevant to the observed anomaly.
- ✓
Review the activity log in Defender for Cloud Apps to determine the context.
Why this is correct
Reviewing the activity log in Defender for Cloud Apps is the correct first step because it provides the full context of the risky action: the exact activity, affected application, source IP, geolocation, timestamp, and user agent. With this evidence, you can distinguish an expected administrative change from a sign of account compromise and then decide whether to apply adaptive protection, require reauthentication, or invoke a conditional access policy. This investigation-first approach aligns with Microsoft's incident response guidance and minimizes false-positive disruptions.
Go deeper
Related to this question
About these practice questions
This SC-200 question is part of Courseiva's 1,303-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.