- A
Trigger a training campaign for the user who reported the email.
Why wrong: Training campaigns are initiated manually or through separate automation, not directly through AIR playbooks for email threats.
- B
Move the email to the tenant's shared mailbox for review.
Why wrong: There is no standard 'tenant's shared mailbox' destination. AIR actions typically involve soft delete, quarantine, or block URL/file.
- C
Remove the Report Message add-in from Outlook to prevent false reports.
Why wrong: AIR actions do not modify client add-ins. They operate on email messages, not user interface components.
- D
Soft-delete the email from the user's mailbox and other mailboxes that received the same message.
Correct. AIR can automatically delete the reported email across the organization to contain the threat.
Quick Answer
The correct automated action triggered by an AIR playbook for a user-reported phishing email is to soft-delete the email from the user's mailbox and all other mailboxes that received the same message. This works because when a user clicks "Report Phishing" via the Report Message add-in, Microsoft Defender for Office 365 automatically initiates an automated investigation and response (AIR) playbook that identifies the email’s unique message ID or hash, then uses the threat protection pipeline to perform a tenant-wide soft-delete—removing the threat from every inbox that received it without permanently purging it from recoverable items. On the SC-200 exam, this tests your understanding of how AIR leverages user reporting to trigger automated remediation at scale, often appearing as a scenario where you must distinguish between manual actions (like purge or move to junk) and the automated soft-delete that AIR executes. A common trap is assuming AIR only acts on the reporting user’s mailbox, but the key is tenant-wide removal. Memory tip: think "one report, all mailboxes—soft-delete is the automated sweep."
SC-200 Mitigate threats using Microsoft Defender XDR Practice Question
This SC-200 practice question tests your understanding of mitigate threats using microsoft defender xdr. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. A key principle to apply: aIR automates investigation and remediation of email threats.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
An organization uses Microsoft Defender for Office 365. A security analyst wants to configure automated investigation and response (AIR) for email threats. When a user reports a phishing email using the Report Message add-in, which automated action can be triggered by an AIR playbook?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Soft-delete the email from the user's mailbox and other mailboxes that received the same message.
When a user reports a phishing email via the Report Message add-in, the automated investigation and response (AIR) playbook in Microsoft Defender for Office 365 can automatically soft-delete the email from the user's mailbox and from all other mailboxes that received the same message. This action is part of the built-in remediation steps that AIR can take after confirming the threat, leveraging the email entity's hash or message ID to perform tenant-wide removal via the threat protection pipeline.
Key principle: AIR automates investigation and remediation of email threats.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Trigger a training campaign for the user who reported the email.
Why it's wrong here
Training campaigns are initiated manually or through separate automation, not directly through AIR playbooks for email threats.
- ✗
Move the email to the tenant's shared mailbox for review.
Why it's wrong here
There is no standard 'tenant's shared mailbox' destination. AIR actions typically involve soft delete, quarantine, or block URL/file.
- ✗
Remove the Report Message add-in from Outlook to prevent false reports.
Why it's wrong here
AIR actions do not modify client add-ins. They operate on email messages, not user interface components.
- ✓
Soft-delete the email from the user's mailbox and other mailboxes that received the same message.
Why this is correct
Correct. AIR can automatically delete the reported email across the organization to contain the threat.
Related concept
AIR automates investigation and remediation of email threats.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates may confuse automated remediation actions (like soft-delete) with administrative or training-related tasks, leading them to select options that describe manual or non-automated processes.
Detailed technical explanation
How to think about this question
Under the hood, AIR uses the Microsoft 365 threat protection stack to correlate the reported email's Internet Message ID and sender details, then issues a soft-delete command via Exchange Online's mailbox search and purge operations (e.g., using the `Search-Mailbox` or `New-ComplianceSearchAction` cmdlets). This action removes the email from the Inbox and other folders but retains it in the recoverable items folder for up to 14 days, allowing recovery if needed. In a real-world scenario, this automated removal is critical for rapidly containing a phishing campaign that has already reached multiple users, preventing further clicks while the investigation continues.
KKey Concepts to Remember
- AIR automates investigation and remediation of email threats.
- User-reported phishing emails can trigger AIR playbooks.
- Soft-delete moves emails to the Recoverable Items folder.
- AIR can apply remediation actions across multiple mailboxes.
TExam Day Tips
- Watch for words such as best, first, most likely and least administrative effort.
- Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
AIR automates investigation and remediation of email threats.
Real-world example
How this comes up in practice
A cloud solutions architect for a retail company is evaluating services for a new workload. The correct answer here reflects best practice for the specific scenario described — not a general cloud recommendation. AIR automates investigation and remediation of email threats. Cloud exam questions reward reading the constraint carefully: the same technology can be right or wrong depending on the use case.
What to study next
Got this wrong? Here's your next step.
Review aIR automates investigation and remediation of email threats., then practise related SC-200 questions on the same topic to reinforce the concept.
- →
Mitigate threats using Microsoft Defender XDR — study guide chapter
Learn the concepts, then practise the questions
- →
Mitigate threats using Microsoft Defender XDR practice questions
Targeted practice on this topic area only
- →
All SC-200 questions
1,639 questions across all exam domains
- →
Microsoft Security Operations Analyst SC-200 study guide
Full concept coverage aligned to exam objectives
- →
SC-200 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Related SC-200 practice-question pages
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Manage a security operations environment practice questions
Practise SC-200 questions linked to Manage a security operations environment.
Respond to security incidents practice questions
Practise SC-200 questions linked to Respond to security incidents.
Perform threat hunting practice questions
Practise SC-200 questions linked to Perform threat hunting.
Mitigate threats using Microsoft Defender XDR practice questions
Practise SC-200 questions linked to Mitigate threats using Microsoft Defender XDR.
Mitigate threats using Microsoft Defender for Cloud practice questions
Practise SC-200 questions linked to Mitigate threats using Microsoft Defender for Cloud.
Mitigate threats using Microsoft Sentinel practice questions
Practise SC-200 questions linked to Mitigate threats using Microsoft Sentinel.
SC-200 fundamentals practice questions
Practise SC-200 questions linked to SC-200 fundamentals.
SC-200 scenario practice questions
Practise SC-200 questions linked to SC-200 scenario.
SC-200 troubleshooting practice questions
Practise SC-200 questions linked to SC-200 troubleshooting.
Practice this exam
Start a free SC-200 practice session
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Questions learners often ask
What does this SC-200 question test?
Mitigate threats using Microsoft Defender XDR — This question tests Mitigate threats using Microsoft Defender XDR — AIR automates investigation and remediation of email threats..
What is the correct answer to this question?
The correct answer is: Soft-delete the email from the user's mailbox and other mailboxes that received the same message. — When a user reports a phishing email via the Report Message add-in, the automated investigation and response (AIR) playbook in Microsoft Defender for Office 365 can automatically soft-delete the email from the user's mailbox and from all other mailboxes that received the same message. This action is part of the built-in remediation steps that AIR can take after confirming the threat, leveraging the email entity's hash or message ID to perform tenant-wide removal via the threat protection pipeline.
What should I do if I get this SC-200 question wrong?
Review aIR automates investigation and remediation of email threats., then practise related SC-200 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
AIR automates investigation and remediation of email threats.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.