Containing a Defender for Identity pass-the-ticket alert by quarantining only the affected device
Respond to alerts and incidents in Microsoft Defender XDR
Answer
Correct answer: B — The stolen Kerberos ticket resides on Device1, so quarantining only the device contains the incident with minimal user impact.
You have an on-premises network. You have a Microsoft 365 E5 subscription that uses Microsoft Defender for Identity. From the Microsoft Defender portal, you investigate an incident on a device named Device1 of a user named User1. The incident contains the following Defender for Identity alert. Suspected identity theft (pass-the-ticket) (external ID 2018) You need to contain the incident without affecting users and devices. The solution must minimize administrative effort. What should you do?
Community Votes
54% of anonymous learners picked answer E. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
In a pass-the-ticket attack the stolen ticket is tied to the device, not the user credential, so isolating the device contains the incident without disabling accounts or resetting passwords, which is the minimal-effort, minimal-blast-radius response.
A Defender for Identity 'Suspected identity theft (pass-the-ticket)' alert on Device1 means a forged Kerberos ticket resides on that device; quarantining Device1 isolates the threat with the least disruption, while User1 can keep working elsewhere.
Disabling the user or resetting passwords as well — those actions disrupt User1 and other accounts and are not required to contain a device-resident ticket; they exceed the minimal-effort containment the question asks for.
Community Discussion (14 comments)
DChilds
👍 11
Selected: E
The security team where I work carries out the activities of option E every single time.
pjn
👍 1
Selected: C
Resetting passwords is the only option that does not disrupt any users or devices like the question requires. This is also what Copilot suggests: The best option is: C. Reset the password for all the accounts that previously signed in to Device1. Explanation: Pass-the-ticket attacks occur when attackers steal and reuse Kerberos tickets to impersonate users. Resetting the passwords for all accounts that previously signed in to Device1 invalidates any stolen Kerberos tickets and prevents further misuse. This action is targeted and minimizes impact on other users and devices. Disabling the user account (as in options A, D, and E) or quarantining the device (as in options B, D, and E) would be more disruptive and might not be necessary immediately if the attack is contained by resetting passwords.
HAjouz
👍 2
Selected: B
Quarantining Device1 will isolate the compromised device from the network, preventing further malicious activity while minimizing the impact on other users and devices12. If you have any more questions or need further assistance, feel free to ask!
Takakage
👍 2
Selected: B
You need to contain the incident without affecting users and devices. The solution must minimize administrative effort." The best way to meet this requirement is to isolate only B:Device1. This method takes into account the following points: • Minimal impact on users: User1's account can continue to operate without deactivating it. • Device Isolation: Isolate Device1 from the network to prevent impact on other devices or users. This approach is a balanced way to effectively contain incidents while minimizing administrative effort. < supplement > reasons why the other alternatives are incorrect are: Option A: Disable User1 only • Reason: Simply disabling User1 will keep Device1 connected to the network, which can affect other devices and users. Option E: Disable User1, isolate Device1, and reset passwords for all accounts that previously signed in to Device1 • Why: This method is the most comprehensive, but it is very much administrative and has a significant impact on users and devices.
user636
👍 3
Selected: A
A is correct. The user1 is using the stolen ticket, disabling the user1 will cause the user1 to not be able to use the stolen ticket anymore (in fact the user1 will not be able to perform any actions). Also, in this way you do not impact any other user or device. Also in this scenario, a different user (say user2) can still use the same stolen ticket. Also, as the question is about MDI, read this: https://learn.microsoft.com/en-us/defender-for-identity/remediation-actions Good luck
g_man_rap
👍 2
Selected: B
Quarantining Device1: This action isolates the device from the network, preventing it from communicating with other devices, thus containing the threat. It minimizes administrative effort because it doesn't require resetting passwords or disabling accounts unless necessary. This approach allows for further investigation to determine the scope of the compromise.
Syncure
👍 2
Selected: B
The attack directily impact to the device, not user
LOMCLOTRMC
👍 2
Selected: E
This is a really silly question. How do we respond in a way that does not affect the user or the device? I chose E with the following interpretation "not affect "other" users or devices".
KingJ92
👍 2
To contain the incident of suspected identity theft (pass-the-ticket) involving User1 and Device1 while minimizing administrative effort and avoiding unnecessary disruption to other users and devices, the best course of action is: B. Quarantine Device1 only. Explanation: Quarantine Device1: Quarantining Device1 isolates the device from the network, preventing any further potential malicious activity from being executed through that device. This action contains the threat while minimizing the impact on other users and devices.
Studytime2023
👍 2
This question is terribly worded. There is no way to avoid some effect on at least one user. I would quarantine the device and reset passwords to all users who've been on the device. Or maybe if I had time, reset the user who's kerberos ticket was stolen and quarantine the device and "monitor" all users who have previously been signed into that device. There is no way to avoid disruption to one or more users. As a cybersecurity specialist, security should be paramount over a users discomfort during reset of password etc. Imagine being the person responsible for full compromise of an organisation. BTW. to my understanding, quarantining the device doesn't stop reuse of the kerberos ticket (before it expires).
scfitzp
👍 2
Selected: B
Pass the ticket is lateral movement, and as far as I understand the ticket though correlated to the User, lives on the device. So wouldn't we quarantine the device? The user can continue local activity.
Polomint
👍 1
Selected: E
The question itself is really badly written and confusing... Option E is could be correct here because, if the exposed device was the issue that the kerberos ticket were stolen, then probably the hacker has dumped the LSAAS and gained access to all previously logged in users kerberos ticket. Option A could be correct here if User1´s kerberos ticket was compromised from a unknown source then disabling the user´s account will mitigate the risk. According to Microsoft: Pass-the-Ticket is a lateral movement technique in which attackers steal a Kerberos ticket from one computer and use it to gain access to another computer by reusing the stolen ticket https://learn.microsoft.com/en-us/defender-for-identity/lateral-movement-alerts
Sekpluz
👍 2
Selected: D
I would choose Option D. This is because resetting the user’s password won’t have any effect in a Kerberos ticket attack. Changing the password won’t invalidate the stolen Kerberos ticket. It’s necessary to disable the user from Active Directory (AD). In this way, if a hacker tries to use the ticket to log in on any other device, it won’t work because the user is disabled. I would also definitely quarantine the device because there’s no telling what else the hacker might have done to that device. This is considered best practice. And yes, you could also argue for Option E. As a best practice, it wouldn’t hurt to change the user’s password as well.
Hawklx
👍 2
Selected: B
This is because the alert is related to a “pass-the-ticket” attack, which is a type of Kerberos attack where an attacker steals a Kerberos ticket and uses it to gain unauthorized access to resources. The ticket is tied to the device (Device1 in this case), not the user (User1). Therefore, quarantining the device would effectively contain the incident. (GenAI generated)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
A pass-the-ticket alert indicates an attacker reused a Kerberos ticket that lives on the compromised device (Device1), not a compromised user credential. The lowest-effort containment that limits blast radius is to quarantine/isolate Device1 from the network. User1's account remains usable on other devices, satisfying the 'without affecting users' intent and minimizing administrative effort.Why the Other Options Are Wrong
Disabling User1 (A) disrupts the user unnecessarily and does not remove the ticket from the device. Resetting passwords for all accounts on Device1 (C) is broad and disruptive. Combining disable + quarantine (D) or all three (E) exceeds the minimal-effort containment and affects more users and devices than needed.Community Comment Notes
This is heavily contested (E 44 vs B 38). Takakage, g_man_rap, Syncure, scfitzp, and Hawklx argue B, noting the ticket is device-resident and quarantine contains it with minimal impact. DChilds (11 likes) says their team does E, but E is more disruptive than the minimal-effort requirement. My determination follows the device-isolation reasoning.Official Reference
Related Analysis
Practice All SC-200 Questions
Access 80 questions with complete answers and detailed explanations.
View Full SC-200 Practice Test →