Exam MS-900 topic 1 question 434 discussion

Actual exam question from Microsoft's MS-900

Question #: 434
Topic #: 1

A company is using Microsoft 365 Defender.

The company requires the ability to filter alerts and recommend actions that a security team can approve or reject.

You need to identify the component that filters and recommends actions.

Which component should you use?

A. Cloud Access Security Broker
B. threat trackers
C. automated investigation and response
D. advanced hunting
E. threat analytics

Show Suggested Answer

Suggested Answer: C 🗳️

by Nazz1977 at March 18, 2024, 1:28 a.m.

Comments

Submit Cancel

a6cc995

3 months, 1 week ago

Selected Answer: C

The correct answer is C. automated investigation and response (AIR). This component in Microsoft 365 Defender is designed to filter alerts and recommend actions that the security team can approve or reject. It automates the investigation process, identifies threats, and provides actionable recommendations, streamlining the response to security incidents.

upvoted 1 times

...

NoursBear

8 months, 4 weeks ago

I think it's Threat Analytics not 100% sure: https://learn.microsoft.com/en-us/microsoft-365/security/defender/threat-analytics?view=o365-worldwide

upvoted 1 times

NoursBear

8 months, 4 weeks ago

OK answer is likely correct : https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/air-about?view=o365-worldwide

upvoted 1 times

...

Nazz1977

9 months ago

I think it is correct

upvoted 3 times

NoursBear

8 months, 2 weeks ago

yeah TA always confused me, there is a good little video on this article https://learn.microsoft.com/en-us/microsoft-365/security/defender/threat-analytics?view=o365-worldwide

upvoted 1 times

...