SC-200 Practice Question 3781
Exam: SC-200
Domain: Respond to security incidents
Difficulty: easy
You need to temporarily release a false-positive email quarantined by Defender for Office 365 so an executive can read it immediately. Where does an analyst release the message?
Answer Options
A
Email & collaboration > Review > Quarantine in the Defender portal
B
Windows Recycle Bin on the user workstation
C
Active Directory Recycle Bin
D
Intune device retirement console
Correct Answer
A: Email & collaboration > Review > Quarantine in the Defender portal
Explanation
In the Microsoft Defender portal under Email & collaboration > Review > Quarantine, select the message and click "Release email".