Contain a Compromised Account by Disabling and Revoking Sessions
Your organization uses Microsoft Sentinel with Microsoft Defender XDR integrated. A critical incident has been raised involving a user account that was used to access a confidential SharePoint site from an unusual location at 2:00 AM. The incident includes alerts from Microsoft Defender for Cloud Apps, Microsoft Defender for Identity, and Microsoft Defender for Office 365. The analyst needs to contain the incident, investigate the scope, and begin remediation. The environment has the following: Microsoft Entra ID with conditional access policies, Microsoft Intune for device management, and Microsoft Defender for Endpoint on all devices. The analyst has identified the user account and the device used. Which course of action should the analyst take first?
Quick Answer
The answer is to disable the user account in Microsoft Entra ID and revoke all sessions, as this is the fastest and most effective way to contain a compromised account. Disabling the account immediately blocks all authentication attempts, while revoking sessions invalidates existing tokens and active logins, cutting off the attacker’s current access. This tests your understanding of the containment phase in the Microsoft incident response lifecycle, a key domain in the SC-200 exam where you must prioritize stopping the threat before investigating or remediating. A common trap is choosing to reset the password or sign out of sessions first, but those actions can be bypassed if the account remains enabled, or they fail to terminate active tokens. Remember the memory tip: “Disable first, investigate second” — because you cannot secure what you have not stopped.
⚠ Common exam trap
The trap here is that candidates often prioritize device isolation (Option B) because they think of endpoint compromise first, but the incident is about a user account used from an unusual location, meaning the account itself is the primary vector—disabling the account is the fastest and most effective containment step before any device or investigation actions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Disable the user account in Microsoft Entra ID and revoke all sessions.
Disabling the user account in Microsoft Entra ID and revoking all sessions is the immediate containment step because it stops the compromised account from being used for any further access, including the suspicious SharePoint access and any lateral movement. This action directly addresses the core of the incident—the user account—and is the fastest way to cut off the attacker's current authentication tokens and sessions, preventing further damage while the investigation proceeds.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a conditional access policy to block the user.
Why it's wrong here
Policy may take minutes to propagate; disabling account is instant.
- ✗
Isolate the user's device using Microsoft Defender for Endpoint.
Why it's wrong here
Device isolation doesn't stop cloud access from other devices.
- ✗
Run a KQL query to find all resources accessed by the user.
Why it's wrong here
Investigation should follow containment.
- ✓
Disable the user account in Microsoft Entra ID and revoke all sessions.
Why this is correct
Immediately stops the user from accessing any resources.
Go deeper
Related to this question
About these practice questions
This SC-200 question is part of Courseiva's 209-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SC-200
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You receive an alert about a suspicious sign-in from an IP address associated with a known malicious actor. The sign-in was for a privileged account. You need to immediately contain the incident. What should you do first?
medium- A.Reset the user's password.
- ✓ B.Disable the user account in Microsoft Entra ID.
- C.Create a custom analytics rule in Sentinel to detect similar sign-ins.
- D.Block the IP address in the firewall.
Why B: Disabling the user account in Microsoft Entra ID immediately stops the attacker from using the compromised credentials. Option A is wrong because resetting the password might not be fast enough if the attacker has an active session. Option C is wrong because creating an analytics rule does not contain the incident immediately; it only helps detect similar sign-ins in the future. Option D is wrong because blocking the IP address in the firewall is reactive and may not be effective if the attacker uses a different IP.
Variation 2. Your organization uses Microsoft Sentinel with the Microsoft 365 Defender connector. You receive an incident indicating that a user's account was used to sign in from an unusual location (Russia) while the user is in the United States. The sign-in was successful and no MFA challenge was prompted because the user had a valid session. The incident severity is High. You need to respond immediately. What should you do first?
medium- A.Block the IP address in the Conditional Access policy.
- ✓ B.Revoke the user's session in Microsoft Entra ID.
- C.Investigate the sign-in logs to determine if there are other compromised accounts.
- D.Reset the user's password.
Why B: Revoking the user's session in Microsoft Entra ID immediately terminates all active tokens and sessions, preventing the attacker from continuing to use the authenticated session. This is the fastest way to stop the ongoing compromise because the sign-in succeeded without MFA due to a valid session, and the attacker is already inside. Other actions like blocking IP or resetting password are slower or less direct in this scenario.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.