Exam SC-200 topic 1 question 31 discussion

Correct Answer - C, Evidence and Response. Question emphasizes on 'incident'. Though you can view affected entities by clicking on Alerts tab > Alert list, it will be for that particular alert one alert doesn't necessarily be an incident. An incident can have multiple alerts. So you need to click on Incidents tab, open the Incident, go to Evidences and Response tab and look there.

Question Keywords: "...identify all the entities AFFECTED BY AN INCIDENT." Answer: C Evidence and response. "The Evidence and Response tab shows all the supported events and suspicious entities in the alerts in the incident." https://learn.microsoft.com/en-us/microsoft-365/security/defender/investigate-incidents?view=o365-worldwide#evidence-and-response

While evidence and response does this, Assets is the best Answer - C

The correct answer is A. Investigations. The Investigations tab in the Microsoft 365 Defender portal is specifically designed to provide a comprehensive view of incidents, including all affected entities. It correlates alerts and other data to give you a complete picture of the attack scope. This is where you'd go to identify all the users, devices, mailboxes, and other entities involved in a given incident.

C correct

The "Evidence and Response" tab in the Microsoft 365 Defender portal can be used to identify all the entities affected by an incident. In the "Evidence and Response" tab, you can access information about the scope of the incident and the entities that were affected. This information can help you understand the extent of the incident and determine the necessary steps to respond to it.

Evidence and Response

correct C

Assets is actually correct https://learn.microsoft.com/en-us/microsoft-365/security/defender/incidents-overview?view=o365-worldwide

A. Investigations To identify all the entities affected by an incident in the Microsoft 365 Defender portal, you should use the "Investigations" tab. The Investigations tab provides a centralized location where you can manage and track incidents, perform analysis, and review related entities and evidence associated with the incident. Using the Investigations tab, you can explore the scope of the incident, review impacted devices, users, and other entities, and gather evidence to understand the nature and extent of the security issue. This tab allows you to perform a comprehensive investigation to ensure that you have a clear understanding of the incident's impact on your environment. The other options (B, C, and D) are relevant to incident response and security management but may not provide the same level of comprehensive analysis and entity identification as the Investigations tab.

The Alerts tab is primarily used for monitoring and managing security alerts generated by various Microsoft 365 Defender services. While it can provide insights into individual alerts, it may not provide a holistic view of all entities affected by an incident. So defintely C

Evidence as response - contains all the details of entities on an incident

The Evidence and Response tab shows all the supported events and suspicious entities in the alerts in the incident. https://learn.microsoft.com/en-us/microsoft-365/security/defender/investigate-incidents?view=o365-worldwide

C is the correct answer

The Evidence and Response tab shows all the supported events and suspicious entities in the alerts in the incident. https://learn.microsoft.com/en-us/microsoft-365/security/defender/investigate-incidents?view=o365-worldwide

C - Evidence and Response https://learn.microsoft.com/en-us/microsoft-365/security/defender/investigate-incidents#evidence-and-response The description even says 'Microsoft 365 Defender automatically investigates all the incidents' supported events and suspicious entities in the alerts, providing you with information about the important emails, files, processes, services, IP Addresses, and more.'

C - Evidence and Response https://learn.microsoft.com/en-us/microsoft-365/security/defender/investigate-incidents#evidence-and-response The description even says 'Microsoft 365 Defender automatically investigates all the incidents' supported events and suspicious entities in the alerts, providing you with information about the important emails, files, processes, services, IP Addresses, and more.'