SC-200 Practice Question: In Microsoft 365 Defender, what is the primary…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Manage user roles and permissions for the security portal.

  Why it's wrong here

  Role administration for the Microsoft 365 Defender portal is performed through Microsoft Entra ID (Azure AD) or the Microsoft 365 admin center, where you assign RBAC roles such as Security Reader, Security Administrator, or Global Administrator. The Action center is solely a workflow queue for remediation actions; it contains no user management, role assignment, or permission-editing capabilities. Therefore, while permissions affect who can view and approve actions, they are not a function of the Action center itself.

• ✓

  View and manage pending and completed remediation actions from automated investigations.

  Why this is correct

  The Action center in Microsoft 365 Defender consolidates all remediation actions generated by automated investigations, showing them in Pending and History tabs. For pending actions, analysts can approve or reject them — for example, quarantining a suspicious file, blocking a malicious URL, or isolating an endpoint. Completed actions remain in the history view for audit and verification, giving security teams a centralized way to track and control the response outcomes of Defender's automated investigation engine. This is its primary, and defining, function.

• ✗

  Create custom detection rules using advanced hunting queries.

  Why it's wrong here

  Creating custom detection rules from advanced hunting queries is an entirely separate capability, located under the Hunting section in the Microsoft 365 Defender portal. Those rules use Kusto Query Language (KQL) to continuously detect threats, whereas the Action center has no query editor or rule-building interface. Detection engineering is proactive, while the Action center is reactive — it deals only with the remediation steps that result from detections, not with defining the detections themselves.

• ✗

  Manage threat intelligence feeds and indicators.

  Why it's wrong here

  Threat intelligence feeds and indicators are managed under Settings > Microsoft 365 Defender > Indicators, where you can import indicators like hashes, IPs, and domains via the TIP API or manually. The Action center neither imports, edits, nor stores such indicators; it only handles the remediation actions (e.g., block indicator or remove file) that may be triggered by them. Additionally, indicator management is an administrative configuration task, whereas the Action center is an operational response workflow.

Go deeper

Related to this question