SC-100 Certification Practice Question #213

Question

You have a Microsoft 365 subscription that syncs with Active Directory Domain Services (AD DS).

You need to define the recovery steps for a ransomware attack that encrypted data in the subscription. The solution must follow Microsoft Security Best Practices.

What is the first step in the recovery plan?

Accepted Answer

The official Microsoft "Responding to ransomware attacks" playbook orders the response so that disabling Exchange ActiveSync and OneDrive sync is the early containment action that must happen before any eradication/recovery — pausing sync stops potentially infected devices from propagating encrypted files into the cloud, which would otherwise re-spread during recovery. Of the four choices, only D appears at this earliest point; A (run an antivirus scan = "Remove malware", step 5) and B (recover files on a cleaned device, step 6) come later and assume containment already occurred, and C (contact law enforcement) belongs to the "during an attack" guidance, not the recovery plan's first step. The Suggested Answer, a 15-vote Most Voted, and a 14-👍 Highly Voted comment all converge on D. Confidence is held at 77 because there is a genuine, well-reasoned community split: several commenters argue A or B by interpreting "recovery steps" narrowly as the Eradication-and-recovery phase, where the first answer-listed action would be the AV scan. MS Learn breaks the tie toward D because the question asks for the FIRST step of the overall recovery plan and emphasizes stopping encrypted data from spreading, which is exactly the sync-disable containment action.

More SC-100 practice questions