SC-200 Certification Practice Question #99

Question

You have a Microsoft 365 tenant.

You have a known threat file named File1.docx.

You need to prevent users from downloading File1.docx.

What should you do?

Accepted Answer

The target is a *known threat file* (File1.docx) and the goal is to prevent it from being downloaded/run. In Microsoft Defender, the purpose-built control for a known-bad file is a custom file-hash indicator with the block action, which MS Learn describes as preventing the file from being read, written, or executed across the organization. DLP, sensitivity labels, and automated investigation address classification, data-leak governance, and alert-driven response respectively, not deterministic blocking of a specific malicious file, so they are eliminated. The Suggested Answer and the marked community choice both select A, and MS Learn confirms it; confidence is high but not maxed because no community vote count is recorded for cross-validation.

More SC-200 practice questions