Manual Remediation for Malware-Infected Emails in Defender XDR

SC-200 By islever Editorial Last updated

Respond to alerts and incidents in Microsoft Defender for Endpoint Configure automation for Microsoft Defender XDR and Microsoft Sentinel

Short answer

B Hard deleting the email message requires manual remediation because Automated Investigation and Response (AIR) primarily performs soft deletion automatically, whereas hard deletion often necessitates analyst review to prevent unintended data loss.

Question

You have a Microsoft 365 E5 subscription.
Automated investigation and response (AIR) is enabled in Microsoft Defender for Office 365 and devices use full automation in Microsoft Defender for Endpoint.
You have an incident involving a user that received malware-infected email messages on a managed device.
Which action requires manual remediation of the incident?
  1. soft deleting the email message
  2. hard deleting the email message Correct Answer
  3. isolating the device
  4. containing the device

Key Takeaways

The main trap is assuming all automated responses (isolation, containment, email deletion) are identical; however, AIR's automatic remediation is typically restricted to soft-deleting emails to preserve evidence and prevent data loss, making hard deletion a manual task.

Learn which remediation action requires manual intervention in a Microsoft 365 E5 environment with AIR and MDE full automation enabled. The correct answer is hard deleting the email.

Common mistake: Candidates often choose 'Isolating the device' (C) because they believe isolation always requires human judgment. However, with 'full automation' enabled in Defender for Endpoint, device isolation is performed automatically upon high-confidence threat detection.

Expert Analysis

The scenario involves a Microsoft 365 E5 subscription with Automated Investigation and Response (AIR) enabled in Defender for Office 365 and full automation configured in Microsoft Defender for Endpoint. The goal is to identify which action requires manual remediation.

Defender for Endpoint's full automation capabilities allow the platform to automatically isolate devices upon detecting high-confidence malware threats without human intervention. Similarly, Microsoft Defender for Office 365’s AIR can automatically soft-delete or hard-delete malicious emails as part of its automated remediation playbook. Therefore, isolating the device (C), containing the device (D), and deleting the email (A/B) are all actions that can be performed automatically by the respective services when automation is enabled.

However, according to Microsoft documentation regarding Defender for Endpoint Plan 1 and Microsoft Defender for Business, specific response actions such as 'Isolate device', 'Run antivirus scan', and 'Add an indicator' are listed as manual response actions available to analysts. While advanced automation rules can trigger isolation, the question asks what requires manual remediation in the context of standard incident response workflows where automation handles the obvious technical fixes. More critically, the comments highlight a key distinction: while AIR handles email remediation (soft/hard delete) and MDE handles device isolation/containment via automation rules, the most definitive manual action often cited in these exam contexts relates to specific investigative or containment steps that aren't fully covered by the basic 'full automation' setting described, or specifically refers to the limitation that certain deep-remediation steps like hard deletion might require approval depending on configuration. However, looking at the provided options and common exam logic: AIR can soft delete. MDE can isolate. Containing is similar to isolating. Hard deleting email is explicitly mentioned in some docs as requiring more than just soft delete, but AIR does support hard delete.

Let's re-evaluate based on the most recent official guidance and community consensus. The key lies in the definition of 'Full Automation' in MDE. It typically includes auto-quarantine and auto-isolation. For Email, AIR performs soft delete. Does it perform hard delete? Yes, it can. So why would one be manual?

Actually, the correct interpretation relies on the specific limitations of the 'Automated Investigation and Response' feature set versus manual analyst tasks. In many SC-200 scenarios, 'Isolating the device' is considered a critical step that, while automatable via rules, is fundamentally a manual decision point if not strictly pre-configured. But wait, the prompt says 'devices use full automation'. This implies auto-isolation is ON.

Let's look at Option B: Hard deleting the email. According to Microsoft Learn, 'Currently, Soft delete is the only available action' for automatic remediation of message clusters in some older contexts, but newer AIR supports hard delete. However, a common exam trap is distinguishing between Soft Delete (automated) and Hard Delete (often requiring admin oversight or specific configuration).

Re-reading the comments: One comment states 'Soft deleting the email - Automated... Hard deleting email - Manual / Requires admin approval/action.' Another cites that 'Currently, Soft delete is the only available action' in the Configure automated remediation section for certain configurations. If we assume the question references the specific constraint that AIR primarily defaults to or is limited to soft deletion for immediate automated safety before further investigation, then Hard Deleting requires manual action to ensure no data loss occurs unexpectedly. Isolation and Containment are handled by MDE Full Automation.

Therefore, Hard Deleting the email (B) is the action that typically falls outside the immediate, safe automated scope of AIR in this specific exam context, requiring manual verification and execution.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When faced with questions about 'Full Automation' in Defender for Endpoint, remember that isolation and quarantine are automated responses. For Defender for Office 365, distinguish between 'Soft Delete' (automated recovery possible) and 'Hard Delete' (permanent, often manual). Always check if the scenario specifies 'Automation Rules'; if yes, isolation is likely automated. If the question highlights 'AIR' for email, assume soft delete is the default automated action.

Frequently Asked Questions

Can AIR hard delete emails?

While newer versions of AIR have expanded capabilities, in the context of this exam question, hard deletion is distinguished from soft deletion as a potentially manual step to avoid accidental data loss, whereas soft deletion is the standard automated remediation.

Does MDE full automation include device isolation?

Yes, Microsoft Defender for Endpoint's full automation settings include automatic isolation of devices when high-confidence malware is detected, removing the need for manual analyst intervention.

What is the difference between isolating and containing a device?

In the context of Defender for Endpoint, both terms generally refer to restricting network access to protect the rest of the environment. Both can be automated under full automation settings.

More SC-200 FAQ →

Community Votes

B
60%
C
40%

60% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 13 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 13

  1. laddu001 👍 11
    hard deleting the email message
  2. exams_certs 👍 6
    Corrent. AIR can soft or hard delete email. MDE don't do isolation as automate response - so this is correct. You can't contain device connected to MDE. You can check it here: https://learn.microsoft.com/en-us/defender-office-365/remediate-malicious-email-delivered-office-365 https://learn.microsoft.com/en-us/defender-endpoint/manage-auto-investigation#remediation-actions https://learn.microsoft.com/en-us/defender-endpoint/respond-machine-alerts
  3. scfitzp 👍 3
    https://learn.microsoft.com/en-us/defender-endpoint/respond-machine-alerts Important Defender for Endpoint Plan 1 includes only the following manual response actions: Run antivirus scan Isolate device Stop and quarantine a file Add an indicator to block or allow a file. Microsoft Defender for Business does not include the "Stop and quarantine a file" action at this time.
  4. Onimole 👍 2 Answered C
    Defender for Endpoint Plan 1 and Microsoft Defender for Business include only the following manual response actions: Run antivirus scan Isolate device Stop and quarantine a file Add an indicator to block or allow a file
  5. talosDevbot 👍 2
    Agreed. You can only contain unmanaged devices
Show 8 more comments
  1. MomenAWS 👍 1 Answered B
    After a long search, B is the correct answer "Remediation action section: Specifies the action to take on message cluster types specified in the Message clusters section. Currently, Soft delete is the only available action." Ref: https://learn.microsoft.com/en-us/defender-office-365/air-auto-remediation Also, ChatGPT, Claude, Copilot, and Gemni agrred on this.
  2. The1BelowAll 👍 1
    Device isolation is a manual action unless explicitly configured via automation rules. Defender for Endpoint supports full automation, but device isolation typically requires analyst approval to avoid disrupting legitimate activity. Isolation cuts off network access except to Defender services, which is a high-impact action and not taken automatically by AIR.
  3. Earthlinghex 👍 1 Answered B
    Soft deleting email - Automated / Can be part of automated playbooks. Hard deleting email - Manual / Requires admin approval/action. Isolating device - Automated / Handled by Defender for Endpoint (Full). Containing device - Automated / Handled by Defender for Endpoint (Full).
  4. cbdfbaf 👍 1 Answered B
    Under the 'Configure automated remediation' section: 'Currently, Soft delete is the only available action.' https://learn.microsoft.com/en-us/defender-office-365/air-auto-remediation
  5. scfitzp 👍 1
    This link is for XDR, not MDE. And if this were an accurate citing then the question would be rather terrible because the only thing not listed in that source is containing a device
  6. fa4f3ef 👍 1
    Your statement proves that isolating the device is not the correct answer. You can explicitly configure device isolation within automation rules. AIR cannot hard delete an email.
  7. scfitzp 👍 1 Answered C
    https://learn.microsoft.com/en-us/defender-endpoint/respond-machine-alerts
  8. Fren686478 👍 1
    https://learn.microsoft.com/en-us/defender-xdr/m365d-remediation-actions

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Creating a Microsoft Sentinel bookmark from the Hunting page to support an incident investigation

S-grade

Identifying Affected Entities in Microsoft Defender XDR Incidents

S-grade

Containing a Defender for Identity pass-the-ticket alert by quarantining only the affected device

S-grade

Limiting Microsoft Defender device discovery to specific onboarded devices by creating a device tag first

S-grade

Practice All SC-200 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-200 Practice Test →

← Back to SC-200 Study Guide