mediumMultiple ChoiceObjective-mapped
SC-200 Practice Question: A security analyst in Microsoft 365 Defender has…
A security analyst in Microsoft 365 Defender has just completed an automated investigation on a device. The analyst wants to review the specific remediation actions that were taken automatically, such as file quarantine or process termination, as well as any actions that are still pending approval. Where should the analyst look?
⚠ Common exam trap
Many candidates confuse the Incident details page (which shows alert evidence and investigation graph) with the Action center (which specifically tracks remediation actions and their approval status), leading them to select the Alerts tab instead of the correct centralized action management location.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Action center
The Action center in Microsoft 365 Defender is the centralized location to review all automated remediation actions (e.g., file quarantine, process termination) and pending approval actions across devices, email, and identities. It provides a unified view of completed, in-progress, and awaiting-approval actions from automated investigations, ensuring the analyst can track and manage remediation status efficiently.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Action center
Why this is correct
The Action center in Microsoft 365 Defender is the centralized console for tracking and approving remediation actions generated by automated investigations and manual response actions. Analysts can review pending actions, such as quarantining files or isolating devices, and approve or reject them with a full audit trail. This is the correct place to see the outcomes of automated investigation steps and manage their execution.
- ✗
Incident details page -> Alerts tab
Why it's wrong here
The Alerts tab on the incident details page lists alert records associated with the incident, including their detection time, severity, and status. While it provides a rich view of the evidence and entities tied to each alert, it does not present the specific remediation actions taken or pending approval. Remediation steps like deleting a file or blocking an IP are managed in the Action center, not in the Alerts tab. Thus, this tab does not fulfill the analyst's need to review automated investigation actions.
- ✗
Device timeline in advanced hunting
Why it's wrong here
Advanced hunting is a query-based tool for iteratively inspecting raw telemetry across tables, and the Device timeline specifically shows event history on a single device. Although you could write a Kusto Query Language (KQL) query to find action records, this is not the primary interface for reviewing and approving automated investigation actions. The Action center is purpose-built for that workflow, offering pending action queues and one-click approval. Therefore, this option is incorrect because it is a hunting surface, not a management view.
- ✗
Email & collaboration incidents tab
Why it's wrong here
The Email & collaboration incidents tab filters the incident queue to show only security incidents involving email and collaboration workloads, such as phishing or malware in Exchange Online. It does not display a list of remediation actions or provide approval controls for automated investigation steps. This tab is a filtering mechanism for incidents themselves, not a repository for action tracking. Since the analyst needs to review actions taken, this tab is not relevant.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-200 question from scratch — 209 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-200
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. In Microsoft 365 Defender, a security analyst reviews an automated investigation that found a potentially unwanted application on multiple devices. The analyst wants to manually approve the suggested remediation action of uninstalling the application. Where should the analyst go?
medium- ✓ A.The Action center
- B.The Incidents page
- C.The Alerts queue
- D.The Device inventory
Why A: The Action center in Microsoft 365 Defender is the centralized location where security analysts can view and manually approve or reject remediation actions that were suggested by automated investigations, such as uninstalling a potentially unwanted application. This is the correct place because the Action center consolidates all pending and completed actions across devices, allowing the analyst to take direct manual intervention on the recommended remediation.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.