SC-200 Manage a security operations environment Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Enable user-reported message settings in Microsoft Defender for Office 365 and configure automated investigation.

  Why this is correct

  Enabling user-reported message settings in Microsoft Defender for Office 365 ingests reports from the Outlook Report button into the system. When configured with automated investigation, each reported message automatically triggers an AIR (Automated Investigation and Response) workflow that runs detonation, threat hunting, and recommended actions. This is the only option that directly connects the user report to a native investigation in Microsoft Defender XDR, matching the requirement.

• ✗

  Create a playbook in Microsoft Sentinel triggered by a custom connector.

  Why it's wrong here

  While Sentinel playbooks can automate responses, they are not triggered by the Outlook Report button unless you build a custom connector to subscribe to Microsoft Graph APIs for user-reported messages. Even then, the playbook would only run in the Azure Monitor/Sentinel context, requiring manual incident correlation and missing the out-of-the-box email threat detection features of MDO. This approach is far more complex and does not leverage the integrated investigation capabilities of Defender XDR.

• ✗

  Configure a data loss prevention policy in Microsoft Purview.

  Why it's wrong here

  Data loss prevention policies in Microsoft Purview focus on identifying and protecting sensitive data like credit card numbers and PII in transit and at rest. On a user-reported email, a DLP policy would only assess content against classification rules and apply restrictions such as blocking external sharing or showing a policy tip; it has no mechanism to launch an automated security investigation or analyze phishing threats. Thus it does not satisfy the requirement.

• ✗

  Set up a session policy in Microsoft Defender for Cloud Apps.

  Why it's wrong here

  Session policies in Microsoft Defender for Cloud Apps are designed for monitoring and controlling user activities in sanctioned and unsanctioned cloud apps using reverse proxy controls, such as controlling downloads or requiring step-up authentication. They operate at the HTTP/S session level and do not ingest Outlook user-reported messages, nor do they perform email-level threat analysis or response. Therefore, they are unrelated to the needed email investigation workflow.

Go deeper

Related to this question