SC-200 Respond to security incidents Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Block the IP address in the Conditional Access policy.

  Why it's wrong here

  Blocking the IP address in a Conditional Access policy applies only to future authentication requests and does not invalidate an already-issued session token. An active attacker with a valid token can continue accessing resources until that token expires, and many exit nodes (cloud services, VPNs) are shared or dynamic, causing the block to impact legitimate users. A sophisticated adversary can also switch to a different IP or proxy, so this is not a reliable or immediate containment step.

• ✓

  Revoke the user's session in Microsoft Entra ID.

  Why this is correct

  Revoking the user's session in Microsoft Entra ID immediately invalidates all refresh tokens for that user and forces re-authentication across all applications, terminating the attacker's active session without waiting for token expiry. This is the correct initial response in a Sentinel incident because it stops ongoing unauthorized access at the session layer, which is faster and more comprehensive than network-level or credential-based actions. It is a precise containment step that precedes password reset and further investigation.

• ✗

  Investigate the sign-in logs to determine if there are other compromised accounts.

  Why it's wrong here

  Investigating sign-in logs to identify other compromised accounts is a critical part of the incident response, but it is not the immediate first action when a single account is confirmed compromised. The priority is to stop the threat by revoking the active session; broadening the investigation can happen afterward without risking further attacker activity. Delaying containment while reviewing logs gives the adversary more time to move laterally, escalate privileges, or persist in the environment.

• ✗

  Reset the user's password.

  Why it's wrong here

  Resetting the user's password stops the attacker from using the stolen credentials for future sign-ins, but it does not invalidate the session tokens the attacker already holds. Without an explicit session revocation, those tokens remain valid until they expire, allowing the attacker to continue accessing resources even after the password is changed. Therefore, a password reset alone is insufficient as an immediate containment measure; session revocation must be performed to terminate the active, token-based access.

Go deeper

Related to this question