easyMultiple ChoiceObjective-mapped
SC-200 Practice Question: In Microsoft 365 Defender, after an automated…
In Microsoft 365 Defender, after an automated investigation completes, where can an analyst review the specific remediation actions that were taken (e.g., file quarantine, device isolation)?
⚠ Common exam trap
It's easy for candidates to confuse the Incident timeline (which shows investigation steps and alerts) with the Action center (which is the sole location for reviewing and managing remediation actions), leading them to select the Incident timeline instead of the correct Action center.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Action center
The Action center in Microsoft 365 Defender is the centralized location where all manual and automated remediation actions (such as file quarantine, device isolation, and process termination) are tracked and can be reviewed or approved. After an automated investigation completes, the specific actions taken are recorded in the Action center's history tab, allowing analysts to see exactly what was executed and the outcome. This is distinct from the Incident timeline, which shows alerts and events but not the detailed remediation action records.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Incident timeline
Why it's wrong here
The incident timeline is a forensic, chronological view of alerts and raw events correlated with the investigation, but it does not enumerate the specific remediation actions that the automated investigation chose to execute or recommend. While it may include some correlated signals, it lacks the approval workflow status and the complete list of pending, approved, and rejected actions, which is why it cannot be used to verify what was actually remediated.
- ✓
Action center
Why this is correct
The Action center is the centralized, cross-tenant hub in Microsoft 365 Defender that records every remediation action generated by automated investigations (AIR) as well as manual response activities. It shows the action's status (pending, approved, or rejected), the entity it targets (file, device, email, URL, etc.), and the investigation it belongs to, making it the definitive location to review, approve, or reject actions after an automated investigation finishes.
- ✗
Threat analytics
Why it's wrong here
Threat analytics is a threat-intelligence module that provides adversary campaign details, vulnerability information, and mitigation guidance for active threats, not a per-incident audit log of actions taken. It helps you understand the broader threat landscape and recommended detections, but it contains no data about remediation actions performed in a specific investigation, so it cannot serve as the record of what the automated response did.
- ✗
Device inventory
Why it's wrong here
Device inventory displays an onboarded device's health, risk level, and exposure, giving you an endpoint asset view rather than an action history. It does not track the remediation actions (such as file quarantine, process isolation, or device restrictions) that occurred during an automated investigation, so after an investigation you would not see the executed actions in this blade; for that you must look at the Action center.
Go deeper
Related to this question
About these practice questions
This SC-200 question is part of Courseiva's 209-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.