SC-200 Practice Question 3775
Exam: SC-200
Domain: Respond to security incidents
Difficulty: easy
In Microsoft Defender for Cloud Apps, an incident flags an "Impossible travel" anomaly where an account signed in from New York and Tokyo within 20 minutes. What immediate governance action can be applied to the user?
Answer Options
A
Confirm user compromised and Require user to sign in again
B
Format the user mobile device remotely
C
Permanently delete the user email mailbox
D
Turn off internet access for the entire corporate office
Correct Answer
A: Confirm user compromised and Require user to sign in again
Explanation
Under the incident governance actions, select "Confirm user compromised" and "Require user to sign in again" to revoke all active session refresh tokens.