mediumMultiple ChoiceObjective-mapped
SC-200 Practice Question: A security analyst is using Microsoft 365…
A security analyst is using Microsoft 365 Defender and discovers that a legitimate business application has been incorrectly blocked as malicious by an automated investigation. The analyst needs to unblock this application immediately so it can run on all endpoints in the organization. What action should the analyst take from the file's entity page in Microsoft 365 Defender?
⚠ Common exam trap
Many exam-takers confuse the immediate unblocking action (adding an allow indicator) with the longer-term feedback process (submitting to Microsoft) or with post-remediation steps (restoring from quarantine), failing to recognize that custom indicators provide real-time override capability for automated investigations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add an indicator to allow the file
Adding an indicator to allow the file creates a custom indicator of compromise (IoC) in Microsoft 365 Defender that explicitly overrides the automated investigation's verdict. This action immediately permits the file to run on all endpoints in the organization by adding an 'allow' entry to the threat intelligence feed, which takes precedence over the automated detection logic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Add an indicator to allow the file
Why this is correct
Creating an allow indicator in Microsoft 365 Defender for the file's SHA-256 hash or certificate forces the security stack to treat that file as trusted across all onboarded devices. As a custom indicator, it overrides automated block verdicts from threat intelligence, so the file will no longer be blocked by antivirus, Cloud App Security, or other Microsoft Defender components. This is the only option that immediately and persistently changes the file's disposition within your tenant.
- ✗
Submit the file to Microsoft for analysis
Why it's wrong here
Submitting the file to Microsoft for analysis sends it to the cloud security research team for potential classification updates, such as adding a clean or malicious verdict globally. Even if the file is later determined benign, the updated classification must be propagated through the threat intelligence pipeline and may take hours or days to reach your environment. Therefore, it does not provide immediate unblocking for files already blocked by Microsoft 365 Defender.
- ✗
Remove the existing indicator for the file
Why it's wrong here
Removing an existing indicator for the file only applies if a custom allow or block indicator was previously created by an admin or security team. In this scenario the block is likely due to a built-in detection from threat intelligence or behavioral analysis, which cannot be removed by deleting custom indicators. Even if a custom block indicator exists, removing it would not restore a file that is also flagged by automation, and there is no guarantee the file was blocked solely because of that indicator.
- ✗
Restore the file from quarantine
Why it's wrong here
Restoring the file from quarantine retrieves the quarantined file on a specific device back to its original location, but it does not alter the underlying detection logic that triggered the quarantine. The next time the file is accessed, scanned, or downloaded, the same block will likely reapply because no allow indicator or exclusion has been added. Additionally, quarantine on other devices remains unaffected, so this action provides no tenant-wide remediation.
Go deeper
Related to this question
About these practice questions
One of 209 original SC-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.