SC-200 Respond to security incidents Practice Question
Your SOC uses Microsoft Defender for Cloud Apps. An alert indicates that a user is downloading a large number of files from SharePoint. Which action should you take to investigate and potentially block the activity?
⚠ Common exam trap
SC-200 often tests the difference between native Defender for Cloud Apps remediation actions (suspend user) and broader identity controls (Conditional Access), so candidates may overreach with Microsoft Entra ID tools.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Suspend the user in Defender for Cloud Apps
In Microsoft Defender for Cloud Apps, suspending a user is a direct response action that blocks the user from accessing cloud apps and can be used during investigation of suspicious activity like mass file downloads. This is the native remediation action within the CASB solution, allowing the SOC to contain the threat without disabling the identity across all of Microsoft Entra ID.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a Conditional Access policy to block the user
Why it's wrong here
Conditional Access policies are evaluated at sign-in time and govern whether an authentication request is allowed, denied, or challenged with MFA/blocking based on conditions like user, location, and risk. They do not terminate or govern an already established, active session in Defender for Cloud Apps; a user who has already authenticated will continue until their token expires or they re-authenticate. While Defender for Cloud Apps can integrate with Conditional Access for risk-based policies, it is an access decision, not an immediate incident-response governance action for an active alert.
- ✗
Block the IP address in Azure Firewall
Why it's wrong here
Blocking the IP address in Azure Firewall is a network-layer control that filters traffic based on source IP, but it is ineffective against the user's activity in a cloud app if the user is behind a NAT or proxy, as it would block all users sharing that public IP. Additionally, a determined user can simply change IP addresses or use a different network, and the firewall does not have visibility into the user's identity or session within Defender for Cloud Apps. The immediate response to a user-behavior alert requires an identity-level governance action, such as suspending the user account, rather than an infrastructure-level network block that is overly broad and easily bypassed.
- ✗
Use Microsoft Intune to wipe the user's device
Why it's wrong here
Intune remote wipe is a device management action designed to erase a lost or stolen device to protect corporate data, and it addresses device compromise, not user behavior or compromised credentials in a cloud app. When Defender for Cloud Apps raises an alert based on unusual user activity, the user's account and session remain active and accessible from any other device, so wiping one device neither revokes the user's access nor prevents continued malicious activity. This action is unnecessarily destructive and disruptive to the user's device while failing to address the root cause, making it an inappropriate response to a cloud app governance alert.
- ✓
Suspend the user in Defender for Cloud Apps
Why this is correct
Suspending the user in Defender for Cloud Apps is the correct immediate governance action because it directly targets the user account, revoking active sessions, invalidating access tokens, and blocking future sign-ins to connected cloud apps. This identity-level action is precise, affecting only the suspicious account without impacting other users who might share an IP address, and it stops the ongoing activity in real time. Defender for Cloud Apps can apply this action via the underlying app's API, ensuring that the suspension propagates across all managed cloud services as a consistent and immediate containment measure.
Go deeper
Related to this question
About these practice questions
This SC-200 question is part of Courseiva's 1,303-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.