SC-200 Respond to security incidents Practice Question
Your organization uses Microsoft Defender for Cloud Apps. You receive an alert about an impossible travel activity for a user. What is the best first step to validate if this is a true positive?
⚠ Common exam trap
The trap here is that candidates often jump to advanced hunting in Sentinel (Option B) as the first step, forgetting that the alert originates from Defender for Cloud Apps and the most immediate and authoritative source for sign-in details is the Entra ID sign-in logs, which are the same data that Defender for Cloud Apps uses to generate the alert.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Review the user's sign-in logs in Microsoft Entra ID
Impossible travel alerts in Microsoft Defender for Cloud Apps are generated based on sign-in activity and user location data. The most direct way to validate whether the alert is a true positive is to review the user's sign-in logs in Microsoft Entra ID (formerly Azure AD), which provides detailed information about each sign-in attempt, including IP addresses, locations, timestamps, and authentication details. This allows you to confirm whether the two sign-ins occurred within an unrealistic time frame for the geographic distance, or if there are anomalies such as VPN usage or IP spoofing that indicate a false positive.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Block the user immediately
Why it's wrong here
Blocking the user immediately is premature because the alert may be a false positive or the result of a misconfiguration. You must first validate the anomalous travel event against authoritative sign-in data in Microsoft Entra ID before taking disruptive action. An immediate block without evidence could lock out a legitimate user and harm business operations.
- ✗
Run an advanced hunting query in Microsoft Sentinel
Why it's wrong here
While an advanced hunting query in Microsoft Sentinel could provide contextual clues, it is not the first step because Sentinel may not have the necessary data ingested or it might introduce latency. The authoritative source for sign-in location and IP details is the Microsoft Entra ID sign-in logs, which should be examined directly. Sentinel hunting is better suited for broader threat hunting after initial validation.
- ✗
Contact the user's manager
Why it's wrong here
Contacting the user's manager is an indirect and slow approach that depends on human recollection rather than objective technical evidence. The sign-in logs in Microsoft Entra ID provide immediate, timestamped IP and geo-location data that can definitively confirm or refute the travel anomaly. In an incident response, you need to gather technical corroboration first, and only later involve a manager for business context.
- ✓
Review the user's sign-in logs in Microsoft Entra ID
Why this is correct
Reviewing the user's sign-in logs in Microsoft Entra ID is the correct first step because these logs contain the authenticated IP address, exact timestamp, and geolocation data needed to corroborate the anomalous travel activity. This source of truth allows you to verify whether the second sign-in actually occurred from the reported location and whether it was a legitimate authentication. It provides the required evidence to decide whether further action is warranted.
- ✗
Check the user's device compliance in Microsoft Intune
Why it's wrong here
Checking the user's device compliance in Microsoft Intune does not verify travel because compliance is determined by policy conditions like encryption status, OS version, or jailbreak detection, not by network location or IP address. While useful for assessing security posture, it cannot provide any information about the user's physical location or whether the sign-in originated from an unusual geographical region. Therefore, it is irrelevant to validating this alert.
Go deeper
Related to this question
About these practice questions
This SC-200 question is part of Courseiva's 1,303-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.