Microsoft · SC-200
Device groups and automated response
SC-200 · Lesson 3 of 14 · 14:18
YouTube loads only after you press play. This chapter opens at its timestamp in the full course. Watch on YouTube ↗
In this lesson
Prepare for the SC-200 exam (Microsoft Certified: Security Operations Analyst Associate). In this lesson: device groups (matching rules, ranks, Microsoft Entra user groups, unified RBAC), automation levels (full, semi, no automated response), the Action center, the September 2026 change to automated investigation for endpoints, and automatic attack disruption (containment actions, exclusions, prerequisites). Includes three original practice questions.
Preview the topics
- Every remediation on domain controllers must wait for approval, while laptops stay fully automated. What should the admin do?
- A remediation action waited for approval for nine days, and now it’s gone from the Pending tab. What happened?
- Attack disruption must never contain the CEO’s laptop or the payroll server, while protecting everything else. What should the team configure?