Microsoft · SC-200
Email, data, and cloud alerts
SC-200 · Lesson 9 of 14 · 1:00:04
YouTube loads only after you press play. This chapter opens at its timestamp in the full course. Watch on YouTube ↗
In this lesson
Prepare for the SC-200 exam (Microsoft Certified: Security Operations Analyst Associate). In this lesson: Real-time detections and Threat Explorer, email remediation, zero-hour auto purge and campaigns, automated investigation in Defender for Office 365, Purview DLP alerts in Defender XDR (and the built-in tuning rule active since early October 2026), and Defender for Cloud alerts (mitigation, logic apps, suppression, workflow automation). Includes three original practice questions.
Preview the topics
- An automated investigation found a malicious URL in forty messages, and the remediation ran without anyone approving it. Why?
- Since October, DLP alerts no longer appear in the Defender incident queue, but the SOC still needs them there. What should the admin do?
- An approved vulnerability scanner keeps triggering the same Defender for Cloud alert on a known virtual machine. What should the analyst do?