Describe the capabilities of Microsoft security solutions →hardMultiple ChoiceObjective-mapped

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Exhibit

{
  "Alert": {
    "id": "alert-12345",
    "title": "Malware detected",
    "severity": "High",
    "status": "Active",
    "category": "Malware",
    "detectionSource": "Antivirus",
    "evidence": [
      {
        "entityType": "File",
        "fileName": "ransomware.exe",
        "filePath": "C:\\Users\\admin\\Downloads\\",
        "sha1": "abcdef1234567890"
      }
    ]
  }
}

Refer to the exhibit. You are reviewing a Microsoft Defender for Cloud Apps alert. Based on the evidence, which action should you take first?

⚠ Common exam trap

The trap here is that candidates often jump to punitive actions like suspending the user or isolating the device, forgetting that Defender for Cloud Apps is a CASB designed for investigation and policy-based response, where the first step should always be to gather more evidence through file analysis.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Request file upload for analysis

The alert evidence shows a suspicious file upload activity, which could indicate a potential malware or data exfiltration attempt. Requesting file upload for analysis (Option D) is the correct first action because it allows Defender for Cloud Apps to perform deep content inspection and threat detection before taking any disruptive actions like suspending the user or isolating the device, ensuring that the response is proportionate and evidence-based.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Mark the alert as benign
Why it's wrong here
This action is premature and highly risky. Marking an alert as benign without thorough investigation, such as analyzing the file's behavior or reputation, could lead to a critical security oversight. If the file is indeed malicious, dismissing the alert would allow the threat to persist and potentially propagate across the network, compromising data integrity and system availability. Proper incident response dictates validation before dismissal.
✗
Suspend the user account
Why it's wrong here
Suspending a user account is an extreme measure that should only be taken after confirming malicious user intent or widespread compromise directly attributable to the user's actions. A single file detection, even if confirmed malicious, primarily indicates a device or process compromise, not necessarily a malicious user. This action would disrupt legitimate business operations and is disproportionate without further evidence linking the user to the threat's initiation or propagation.
✗
Isolate the device immediately
Why it's wrong here
While device isolation is a critical containment strategy, performing it immediately without initial analysis can hinder investigation and potentially disrupt legitimate business functions unnecessarily. Immediate isolation prevents further communication with the device, which can impede collecting crucial forensic data or understanding the full scope of the threat. A preliminary assessment is typically required to confirm the severity and determine if isolation is the most appropriate next step, balancing containment with investigative needs.
✓
Request file upload for analysis
Why this is correct
Requesting a file upload for analysis is the most appropriate immediate next step for an unconfirmed file detection. This action allows security analysts to submit the suspicious file to advanced threat intelligence services, such as Microsoft Defender for Endpoint's cloud-based sandboxing or detonation chambers. These environments perform deep behavioral analysis, static analysis, and reputation checks to definitively determine if the file is malicious, benign, or potentially unwanted, providing crucial context for subsequent response actions.

Go deeper

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question