SC-200 Respond to security incidents Practice Question
Your organization uses Microsoft Defender for Cloud to protect hybrid cloud workloads. An alert indicates that a container in Azure Kubernetes Service (AKS) is running a privileged container. Which response action should you take first?
⚠ Common exam trap
Test-takers frequently think immediate containment (disabling or deleting) is always the correct first step, but Microsoft's incident response guidance emphasizes 'investigate first' to avoid destroying evidence and to ensure the response is proportional to the threat.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Investigate the alert details in Microsoft Defender for Cloud
When a Microsoft Defender for Cloud alert indicates a privileged container in AKS, the first response action should be to investigate the alert details within Defender for Cloud. This allows you to assess the scope, impact, and context of the alert—such as which container, namespace, and pod is involved, and whether it is a false positive—before taking any disruptive remediation steps. Prematurely disabling, deleting, or restarting resources could destroy forensic evidence and escalate the incident unnecessarily.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Investigate the alert details in Microsoft Defender for Cloud
Why this is correct
Investigation is the mandatory first step because Microsoft Defender for Cloud enriches AKS container alerts with the full attack story, affected pod and container identities, MITRE ATT&CK tactics, and associated entities. Opening the alert details lets you confirm whether the activity is a true positive, determine its severity and blast radius, and identify which subsequent containment or remediation action is safe. Proceeding before reviewing these details risks an incorrect response, which is why all other options are premature.
- ✗
Disable the container immediately
Why it's wrong here
Immediately disabling the container is premature and operationally hazardous because you have not confirmed that the alert is a true positive or scoped the blast radius. In AKS, the pod's controller or ReplicaSet will often reschedule a new container to satisfy the desired replica count, so disabling one instance may do nothing while also destroying the running process state and volatile forensic evidence. Defender for Cloud's guidance is to validate the alert and then use an appropriate containment action, not react blindly to a single event.
- ✗
Restart the AKS cluster
Why it's wrong here
Restarting the AKS cluster is a coarse control-plane action that does not address the compromised workload and can create a broader availability incident. A restart may not terminate the malicious pod because the affected deployment's desired state will simply cause the scheduler to recreate it, and any in-memory or ephemeral forensic artifacts are lost during node reboot. It also ignores the fact that Defender for Cloud's alert details and surrounding audit logs are the authoritative source for targeted, evidence-preserving remediation.
- ✗
Delete the container and its image
Why it's wrong here
Deleting the container and its image is an irreversible, destructive action that destroys forensic evidence you need to identify root cause and campaign scope. Even if the running container is removed, the malicious image may remain in the repository (such as Azure Container Registry) and can be pulled again by a manifest, or other persistence mechanisms like DaemonSets, CronJobs, or unauthorized secrets may keep attacker access alive. Containment and cleanup should only occur after investigation and should also include registry-level and infrastructure-level review.
Go deeper
Related to this question
About these practice questions
This SC-200 question is part of Courseiva's 1,303-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.