Exam MS-102 All Questions

View all questions & answers for the MS-102 exam

Exam MS-102 topic 1 question 69 discussion

Actual exam question from Microsoft's MS-102

Question #: 69
Topic #: 1

HOTSPOT -
You have a Microsoft 365 E5 tenant.
You have the alerts shown in the following exhibit.

Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.
NOTE: Each correct selection is worth one point.

Show Suggested Answer

Suggested Answer:

by AMDf at Sept. 6, 2023, 1:38 p.m.

Comments

Submit Cancel

saya_222

Highly Voted 1 year, 8 months ago

1 : Investigating, Resolved, or Dismissed 2 : change Status to Dismissed, Investigating, or Active https://www.examtopics.com/exams/microsoft/ms-101/ →Topc3 #140

upvoted 30 times

norbe01

9 months, 1 week ago

Tested on DEV tenant, correct

upvoted 2 times

...

sergioandreslq

1 year, 8 months ago

Yes, I tested just to confirm, you can roll-back a resolved alert to Dismissed, Investigating, or Active

upvoted 3 times

...

Romke_en_Tomke

1 year, 8 months ago

You can post direct url: https://www.examtopics.com/discussions/microsoft/view/94571-exam-ms-101-topic-3-question-140-discussion/

upvoted 2 times

...

faeem

Highly Voted 1 year, 8 months ago

Hi, just tested now. Went to an incident and changed the status to resolved. Then went back into the incident and was able to change it back to in progress.

upvoted 6 times

sergioandreslq

1 year, 8 months ago

Yes, I tested just to confirm, you can roll-back a resolved alert to Dismissed, Investigating, or Active

upvoted 2 times

...

correction

Most Recent 1 month, 4 weeks ago

On my side,(In purview alerts) I tested with 2 different Alerts, but after changing their state to "resolved". I wouldn't be able to roll back to DISMISS or INVESTIGATING. Only INVESTIGATING and ACTIVE status can be change and DISMISS and RESOLVED status cannot be changed. So I confirm that the given answers are correct.

upvoted 1 times

...

EubertT

2 months, 2 weeks ago

Correct Answers: For Alert1, you can change Status to: ➤ Investigating, Resolved, or Dismissed (Reason: Alert1 is currently Active, so it can still be changed to any of the other statuses.) For Alert5, you can: ➤ change Status to Dismissed, Investigating, or Active (Reason: Alert5 is currently Resolved, and resolved alerts can be reactivated or updated to other valid statuses.)

upvoted 1 times

...

m2L

1 year, 6 months ago

Please guys can you test a gain? On my side I tested with 2 different Alertes, but after changing their state to "resolved". I wouldn't be able to roll back to DISMISS or INVESTIGATING. So I confirm that the given answers are correct.

upvoted 5 times

...

amurp35

1 year, 9 months ago

The three status options are actually: 'New, In-Progress, or Resolved' and these options are not shown. https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/manage-alerts?view=o365-worldwide https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/mdo-sec-ops-manage-incidents-and-alerts?view=o365-worldwide

upvoted 4 times

daye

1 year, 7 months ago

This Alert is from Purview not from Security Admin, so the actions are differents. I just test it, and you can rollback it. In my case, I didn't have any explicit button but changing the comments, I was able to change the status as well. https://learn.microsoft.com/en-us/purview/compliance-manager-alert-policies

upvoted 3 times

...

AMDf

1 year, 9 months ago

Alert1 correct Alert5 should be "not change status" For resolved issue there is no option to change status

upvoted 3 times

...