Exam SC-200 topic 1 question 40 discussion

Actual exam question from Microsoft's SC-200

Question #: 40
Topic #: 1

You have a Microsoft 365 subscription that uses Microsoft 365 Defender.

A remediation action for an automated investigation quarantines a file across multiple devices.

You need to mark the file as safe and remove the file from quarantine on the devices.

What should you use in the Microsoft 365 Defender portal?

A. From the History tab in the Action center, revert the actions.
B. From the investigation page, review the AIR processes.
C. From Quarantine from the Review page, modify the rules.
D. From Threat tracker, review the queries.

Show Suggested Answer

Suggested Answer: A 🗳️

by antoniokt at Feb. 27, 2023, 4 a.m.

Comments

Submit Cancel

slimjago

Highly Voted 2 years, 3 months ago

correct https://learn.microsoft.com/en-us/microsoft-365/security/defender/m365d-autoir-actions?view=o365-worldwide#undo-completed-actions

upvoted 7 times

...

Nikki0222

Most Recent 7 months, 2 weeks ago

Correct

upvoted 2 times

...

chepeerick

1 year, 7 months ago

option A

upvoted 1 times

...

Dracula666

1 year, 7 months ago

Selected Answer: A

https://learn.microsoft.com/en-us/microsoft-365/security/defender/m365d-autoir-actions?view=o365-worldwide#undo-completed-actions https://learn.microsoft.com/en-us/microsoft-365/security/defender/m365d-autoir-actions?view=o365-worldwide#to-remove-a-file-from-quarantine-across-multiple-devices

upvoted 1 times

...