SC-200 Defender XDR Alert Triage Workflow

1. Which investigation feature helps correlate events across multiple sources in Defender XDR?

Incident graph

Alert timeline

Threat report

Risk score

Submit

3. Which metric is most important when evaluating alert triage effectiveness?

Mean time to detect (MTTD) and mean time to respond (MTTR)

Number of alerts generated

Alert volume only

User satisfaction rating

Submit

5. True or False: Low-severity alerts should never be investigated.

True

False

6. What should be documented during the triage process?

Investigation findings, decisions, and remediation steps

Only the alert ID

Only the user's name

Nothing unless escalated

7. Which Defender XDR component analyzes cloud application activity?

Defender for Cloud Apps

Defender for Identity

Defender for Office 365

Defender for Servers

Submit

9. What is the purpose of assigning alert ownership during triage?

Track accountability and ensure investigation progress

Avoid sharing information

Reduce the number of alerts

Eliminate the need for escalation

10. True or False: All alerts in Defender XDR should be immediately escalated to incident response.

True

False

11. In Defender XDR, what is the primary purpose of alert triage?

Prioritize and categorize alerts to focus on genuine threats

Delete all low-severity alerts automatically

Archive alerts for compliance reporting only

Convert all alerts to incidents regardless of severity

Submit

13. In Defender XDR, what is the relationship between alerts and incidents?

Alerts are individual events; incidents group related alerts

Alerts and incidents are identical

Incidents always occur before alerts

Alerts cannot be converted to incidents

14. Which action should be taken when an alert is confirmed as malicious?

Immediately isolate the device and escalate

Wait for manual verification

Archive the alert

Send a notification email only

Submit

16. What does MITRE ATT&CK framework help security analysts with during triage?

Understand adversary tactics and techniques

Automate all incident response

Generate compliance reports

Replace manual threat hunting

17. Which Defender XDR component provides entity behavior analysis?

Defender for Office 365

Defender for Identity

Defender for Cloud Apps

Defender for Endpoint

Submit

19. What is the first step in the alert triage workflow?

Immediately remediate the threat

Review alert details and determine if it's a true positive

Escalate to senior management

Close the alert without investigation

20. Which alert severity level typically requires immediate investigation?

Low

Medium

High and Critical

Informational

SC-200 Defender XDR Alert Triage Workflow Quiz

1. Which investigation feature helps correlate events across multiple sources in Defender XDR?

2.

What first name or nickname would you like us to use?

2. When triaging an alert, what does investigating the alert ____ help clarify?

3. Which metric is most important when evaluating alert triage effectiveness?

4. Suspicious activities involving email are typically detected by Defender for ____.

5. True or False: Low-severity alerts should never be investigated.

6. What should be documented during the triage process?

7. Which Defender XDR component analyzes cloud application activity?

8. In alert triage, contextual information such as user behavior helps determine ____.

9. What is the purpose of assigning alert ownership during triage?

10. True or False: All alerts in Defender XDR should be immediately escalated to incident response.

11. In Defender XDR, what is the primary purpose of alert triage?

12. Defender for Endpoint detects threats at the ____ level.

13. In Defender XDR, what is the relationship between alerts and incidents?

14. Which action should be taken when an alert is confirmed as malicious?

15. False positives in alert triage can be reduced by ____.

16. What does MITRE ATT&CK framework help security analysts with during triage?

17. Which Defender XDR component provides entity behavior analysis?

18. In Defender XDR, an alert is considered a true positive when ____.

19. What is the first step in the alert triage workflow?

20. Which alert severity level typically requires immediate investigation?