medium10 pts · first answer countsincident-responsecloud-identity

Containing a hijacked Microsoft 365 account

You confirm an attacker used a stolen session to access a user's Microsoft 365 mailbox. Which containment set is most complete?

A.Reset the password onlyB.Send the user a warning emailC.Reset the password, revoke all sessions and refresh tokens, review MFA methods and remove malicious inbox rules or app consentsD.Disable MFA so the user can log in more easily

Discussion 0

Join free to post in the discussion.

Containing a hijacked Microsoft 365 account

Discussion 0

Related questions