SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
Your organization uses Microsoft Sentinel for SIEM. You receive an alert that a user account was compromised. You need to automatically disable the user's access across all cloud apps (SaaS) and reset their password. What should you use?
⚠ Common exam trap
Many candidates confuse the reactive, automated remediation capability of Sentinel playbooks with the proactive, policy-based controls of Defender for Cloud Apps or the device-focused actions of Intune, leading them to choose an option that addresses only a subset of the required actions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a Microsoft Sentinel automated response playbook
Microsoft Sentinel's automated response playbooks, built on Azure Logic Apps, can trigger an incident-based workflow that disables the user in Microsoft Entra ID and resets their password via the Microsoft Graph API. This provides the necessary cross-cloud automation to remediate a compromised account across all SaaS apps without manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a Microsoft Sentinel automated response playbook
Why this is correct
Microsoft Sentinel automated response playbooks, built on Azure Logic Apps, are specifically designed for Security Orchestration, Automation, and Response (SOAR). They can be triggered by Sentinel incidents or alerts to execute predefined workflows, such as calling the Microsoft Graph API to disable a user account in Microsoft Entra ID and initiate a password reset. This provides an immediate, automated, and scalable response to detected threats, directly addressing the requirement for revoking user access and resetting passwords without human intervention.
- ✗
Use Microsoft Intune to remote wipe the user's device
Why it's wrong here
While Microsoft Intune can perform a remote wipe on a device, which removes all corporate data and potentially resets the device to factory settings, this action does not directly address the user's account access or password. Wiping a device is primarily a data loss prevention measure for compromised endpoints. It does not revoke the user's ability to log in from another device or prevent further access if their credentials are compromised, thus failing to meet the core requirement of revoking user access and resetting their password.
- ✗
Manually disable the user in Microsoft Entra ID and reset password
Why it's wrong here
Manually disabling a user account in Microsoft Entra ID and resetting their password would achieve the desired security outcome of revoking access and securing the account. However, this approach is not automated and requires direct human intervention for each incident. For a Security Information and Event Management (SIEM) system like Microsoft Sentinel, which aims to provide rapid and scalable responses to security incidents, manual processes introduce significant delays, increase the Mean Time To Respond (MTTR), and are prone to human error, making it an inefficient solution.
- ✗
Configure a Microsoft Defender for Cloud Apps session policy
Why it's wrong here
Microsoft Defender for Cloud Apps (MDCAS) session policies are powerful tools for real-time monitoring and control over user sessions to cloud applications. They can enforce actions like blocking downloads, requiring re-authentication, or redirecting traffic based on risk factors. While a session policy could restrict access during a suspicious session, it does not possess the capability to directly disable a user account in Microsoft Entra ID or force a password reset, which are critical actions for fully revoking access and securing compromised credentials.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
Key term
SIEM
SIEM (Security Information and Event Management) is a system that collects and analyzes log data from across an IT environment to detect and respond to security threats in real time.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.