Respond to security incidents →mediumMultiple Select

SC-200 Respond to security incidents Practice Question

Which TWO actions should an analyst take when a user reports receiving a suspicious email with an attachment? (Select TWO.)

⚠ Common exam trap

SC-200 often tests the correct incident response actions for suspicious emails. The trap is choosing actions that are either dangerous (opening attachment) or ineffective (blocking sender locally) instead of the proper submission and deletion procedures.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Submit the email to Microsoft for analysis using the Submissions page in Microsoft 365 Defender.

Option A is correct because submitting the suspicious email via the Submissions page in Microsoft 365 Defender sends the message, including its attachment, to Microsoft for analysis, allowing the service to detonate and inspect it and then update its threat intelligence and filtering. Option C is correct because an analyst can use Microsoft 365 Defender (for example, via Threat Explorer or the Email entity page) to soft-delete or hard-delete the malicious message from the user's mailbox, removing the threat and preventing further user interaction. Option B is wrong because automatically forwarding a potentially malicious email with a live attachment to IT spreads the threat and is not a standard containment action. Option D is wrong because opening the attachment could execute malicious code and compromise the analyst's workstation. Option E is wrong because blocking the sender only in the user's Outlook settings is a weak, local action that does not remove the message or protect the organization, and sender addresses are easily spoofed.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Submit the email to Microsoft for analysis using the Submissions page in Microsoft 365 Defender.
Why this is correct
Submitting the suspicious email via the Submissions page sends the original message and attachments to Microsoft for detonation and signature analysis, satisfying the need to report and analyse the threat. This enables Microsoft to tune detection and block similar messages across the tenant.
✗
Run a PowerShell script to automatically forward the email to IT.
Why it's wrong here
Forwarding via a PowerShell script alters the original message and destroys chain-of-custody evidence needed for investigation. It is tempting as automation, and would be correct for routine mail routing, not for preserving a suspected phishing artefact for analysis.
✓
Delete the email from the user's mailbox using Microsoft 365 Defender.
Why this is correct
Deleting the message via Microsoft 365 Defender removes the threat from the mailbox before further user interaction, containing the incident. This satisfies the scenario's need to remediate the suspicious attachment immediately, complementing investigation rather than replacing it.
✗
Open the attachment to verify if it is malicious.
Why it's wrong here
Opening the attachment executes potential malware on the analyst's workstation, risking infection and losing the safe detonation environment. It is tempting as direct verification, and would be correct only inside an isolated sandbox, never on a production endpoint.
✗
Block the sender in the user's Outlook settings.
Why it's wrong here
Blocking the sender in one user's Outlook leaves other recipients exposed and creates no tenant-wide detection or investigation record. It is tempting as immediate user relief, and would be correct for persistent nuisance mail, not suspected malicious campaigns requiring organisational blocking.

Go deeper

SC-200 Respond to security incidents Practice Question

Why each option matters

Option-by-option breakdown

Related to this question