SC-200 Certification Practice Question #30

Question

You have a Microsoft 365 subscription that uses Microsoft 365 Defender.

A remediation action for an automated investigation quarantines a file across multiple devices.

You need to mark the file as safe and remove the file from quarantine on the devices.

What should you use in the Microsoft 365 Defender portal?

Accepted Answer

To mark a quarantined file as safe and remove it from quarantine across multiple devices, Microsoft's documented procedure is to go to the Action center, open the **History** tab, select the **Quarantine file** action, choose "Apply to X more instances of this file," and **Undo** — i.e. revert the remediation action from the History tab. That is answer A. The other options either only review the investigation (B), manage email/Defender for Office quarantine rules rather than device file quarantine (C), or are unrelated hunting features (D). Suggested Answer, a unanimous 5-vote Most Voted, the top Highly Voted comment, multiple confirming selections, and MS Learn all agree.

More SC-200 practice questions