SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
Your company uses Microsoft Defender for Identity to monitor on-premises Active Directory. You receive an alert about a potential lateral movement attack involving a service account. The alert indicates that the account was used to log in to multiple servers from a non-domain-joined machine. You need to investigate the alert and determine if the account is compromised. What should you do first?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Review the account’s activity timeline in Microsoft Defender for Identity to see all logins and accessed resources.
The correct first step because Microsoft Defender for Identity provides an activity timeline for each account, allowing you to review all logins, resources accessed, and other suspicious activities. This helps determine if the account is compromised before taking any action. Option A is incorrect because the account may be a member of privileged groups, but that alone does not confirm compromise; the activity timeline provides more context. Option B is incorrect because immediately resetting the password could disrupt legitimate operations and destroy evidence. Option D is incorrect because the user of a service account is typically not a person, and lateral movement alerts indicate automated or unauthorized behavior, so contacting a user is not appropriate.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Check if the account is a member of any privileged groups.
Why it's wrong here
Checking group membership can help assess the risk, but it is not the first step. The immediate priority is to understand the account's recent activity to determine if the behavior is malicious.
- ✗
Immediately reset the service account password.
Why it's wrong here
Resetting the password without investigation may disrupt legitimate operations or alert the attacker. It should only be done after confirming compromise.
- ✓
Review the account’s activity timeline in Microsoft Defender for Identity to see all logins and accessed resources.
Why this is correct
Reviewing the activity timeline provides a detailed record of all logins and accessed resources, enabling you to trace the lateral movement and decide on next steps. This is the correct first action.
- ✗
Contact the user to verify if they performed the logins.
Why it's wrong here
Contacting the user is not appropriate for a service account, as it is used by applications or automated processes. The alert is triggered by system behavior, not user actions.
Go deeper
Related to this question
Learn chapter
Identity Concepts
Key term
Service account
A service account is a special type of account used by an application or a virtual machine, rather than a human user, to authenticate and interact with cloud services and APIs securely.
Key term
Microsoft Defender
Microsoft Defender is a suite of security products that protects devices, data, and identities from cyber threats like malware, phishing, and unauthorized access.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.