SC-200 Respond to security incidents Practice Question
Which TWO of the following are valid response actions that can be taken on a device from Microsoft Defender for Endpoint? (Choose two.)
⚠ Common exam trap
A common mix-up: candidates confuse response actions across different Microsoft security products (Defender for Endpoint vs. Defender for Office 365 vs. Microsoft Entra ID) and mistakenly select identity-based or email-based actions as valid device-level responses.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Run antivirus scan
Microsoft Defender for Endpoint includes a 'Run antivirus scan' response action that initiates a Microsoft Defender Antivirus scan on the device. This action can be triggered from the Microsoft 365 Defender portal to detect and remediate malware or suspicious files without requiring user interaction.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Quarantine email
Why it's wrong here
Email quarantine is a remediation action performed on mailbox messages in Microsoft 365 Defender for Office 365 or Exchange Online Protection, not on devices. This action removes suspicious or malicious emails from user mailboxes to prevent delivery, but it does not apply to endpoint response workflows. In the context of device-level response actions in Microsoft Defender for Endpoint, quarantine email is not a valid option.
- ✗
Disable user account
Why it's wrong here
Disabling a user account is an identity-based response action that revokes the account's sign-in rights in Microsoft Entra ID, effectively preventing authentication. This action is typically used to stop compromised or malicious user activity, but it is managed under Microsoft Defender for Identity or Microsoft Entra ID, not as a device-level response action. Since it targets the user principle rather than the endpoint, it is not a valid device response action.
- ✓
Run antivirus scan
Why this is correct
Running an antivirus scan is a native device response action in Microsoft Defender for Endpoint that initiates a Windows Defender scan directly on the endpoint. This action can be a quick or full scan, allowing security teams to detect and remediate malware without removing the device from the network. It is commonly used to assess a device's health after a potential compromise and is a valid response action for endpoint containment.
- ✗
Reset user password
Why it's wrong here
Resetting a user password is an identity remediation action that invalidates the current password and forces the user to create a new one, typically via Microsoft Entra ID self-service or admin reset. This action helps mitigate compromised credentials but does not interact with the endpoint's processes or network state. It is categorized under identity response actions, not device response actions in Defender for Endpoint.
- ✓
Isolate device from network
Why this is correct
Isolating a device from the network is a device response action in Microsoft Defender for Endpoint that immediately severs all network communication with the device, while maintaining a secure channel to the Defender for Endpoint service. This prevents an attacker from performing lateral movement or data exfiltration, while still allowing security teams to monitor and investigate the device. It is a key containment action used during active incidents.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-200 question from scratch — 1,303 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.