mediumMultiple SelectObjective-mapped
Automated Actions in Microsoft Defender for Office 365 AIR
A security operations center (SOC) is configuring automated investigation and response (AIR) for Microsoft Defender for Office 365. Which of the following actions can be automatically taken when a malicious email is detected by AIR policies? (Choose all that apply.)
Quick Answer
The answer is that AIR policies in Microsoft Defender for Office 365 can automatically quarantine the email. This action, technically a soft-delete, moves the malicious message from the user’s inbox to the Recoverable Items folder, where it remains restorable by an administrator for a set period. This is a standard remediation step for confirmed threats, as automated investigation and response (AIR) uses playbooks to contain verified phishing or malware emails without manual intervention. On the SC-200 exam, this concept tests your understanding of the specific remediation actions available in Defender for Office 365 AIR, often contrasting them with actions like hard-delete or block URL, which are not automatic defaults. A common trap is assuming AIR can permanently purge emails or block senders automatically—it cannot; quarantine is the primary automated action. Memory tip: think “AIR drops it in the bin, not the incinerator”—quarantine preserves recoverability, aligning with the SOC’s need for forensic flexibility.
⚠ Common exam trap
Test-takers frequently confuse manual user-side actions (like adding a sender to a blocked list) with automated AIR remediation actions, or assume that 'permanently delete' is a valid automated response when Microsoft deliberately avoids irreversible actions in AIR to prevent data loss.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Soft delete the email from user mailbox
AIR policies in Microsoft Defender for Office 365 can automatically soft-delete a malicious email from a user's mailbox. Soft deletion moves the email to the Recoverable Items folder, allowing administrators to restore it if needed, which is a standard remediation action for confirmed threats.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Soft delete the email from user mailbox
Why this is correct
AIR can be configured to soft delete emails, moving them to the Deleted Items folder.
- ✗
Add the sender to the user's blocked sender list
Why it's wrong here
Blocking the sender is not an automatic action in AIR; it must be done through other mechanisms.
- ✓
Quarantine the email
Why this is correct
AIR can automatically quarantine malicious emails to isolate them from users.
- ✗
Permanently delete the email from all mailboxes
Why it's wrong here
Permanent deletion is not supported as an AIR action; soft delete or quarantine are the options.
Go deeper
Related to this question
About these practice questions
One of 209 original SC-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-200
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An organization uses Microsoft Defender for Office 365. The security team wants to automatically investigate and respond to user-reported phishing emails. Which feature should they enable to automate this process?
easy- A.Attack simulation training
- ✓ B.Automated investigation and response (AIR)
- C.Campaign views
- D.Threat Explorer
Why B: Automated investigation and response (AIR) in Microsoft Defender for Office 365 automatically triggers a playbook when a user reports a phishing email via the Report Message or Report Phishing add-in. It collects the email, analyzes it using threat intelligence and machine learning, and takes remediation actions such as soft-deleting the message or blocking the sender, all without manual intervention.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.