Power Automate is the correct choice because it enables a no-code/low-code workflow that directly integrates with Microsoft 365 Defender’s ‘When an incident is created or updated’ trigger, allowing you to filter for severity ‘High’ and then post a message to a dedicated Teams channel using the ‘Post a message in a chat or channel’ action. This event-driven automation meets the security analyst’s requirement without any custom scripting, making it the ideal solution for automating Teams messages when a Defender incident occurs. On the MS-102 exam, this scenario tests your understanding of how Power Automate connects Microsoft 365 services for incident response workflows; a common trap is assuming Microsoft Graph API or Logic Apps are needed, but Power Automate is the simplest built-in option. Remember the memory tip: “Defender triggers, Teams posts, Power Automate hosts” — this helps you recall that the connector pair (Defender incident trigger + Teams message action) is the core of the solution.
MS-102 Practice Question: Manage security and threats by using Microsoft Defender XDR
This MS-102 practice question tests your understanding of manage security and threats by using microsoft defender xdr. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A security analyst wants to automatically create a Microsoft Teams message in a dedicated security channel whenever a Microsoft 365 Defender incident with severity 'High' is created. Which automation approach should the analyst use?
A Power Automate flow can be triggered by new incidents and post messages to a Teams channel using the 'Post message in a chat or channel' action.
B
Automation rules in Defender
Why wrong: Automation rules can set incident owner, status, and classification, but they lack native integration to post to Teams.
C
Microsoft Graph API
Why wrong: The Microsoft Graph API can be used to create a custom solution, but it requires development effort; Power Automate is simpler and more direct.
D
Action Center
Why wrong: Action Center lists pending automated actions for manual review, not the ability to trigger Teams notifications.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Power Automate
Power Automate is the correct choice because it provides a no-code/low-code workflow that can be triggered by Microsoft 365 Defender's 'When an incident is created or updated' connector, filter for severity 'High', and then post a message to a dedicated Teams channel via the 'Post a message in a chat or channel' action. This directly meets the requirement for automatic, event-driven notification without custom code.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
Power Automate
Why this is correct
A Power Automate flow can be triggered by new incidents and post messages to a Teams channel using the 'Post message in a chat or channel' action.
Related concept
Read the scenario before looking for a memorised answer.
✗
Automation rules in Defender
Why it's wrong here
Automation rules can set incident owner, status, and classification, but they lack native integration to post to Teams.
✗
Microsoft Graph API
Why it's wrong here
The Microsoft Graph API can be used to create a custom solution, but it requires development effort; Power Automate is simpler and more direct.
✗
Action Center
Why it's wrong here
Action Center lists pending automated actions for manual review, not the ability to trigger Teams notifications.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates confuse 'automation rules' in Defender (which handle response actions like isolation) with external notification workflows, leading them to choose Option B instead of recognizing that Power Automate is the correct integration tool for sending Teams messages.
Detailed technical explanation
How to think about this question
Power Automate uses the 'Microsoft 365 Defender' connector which leverages the Microsoft Graph API for security incidents under the hood, but abstracts away the complexity of OAuth token management and HTTP requests. The trigger uses a polling interval (default 3 minutes) to check for new incidents, and the 'Post a message in a chat or channel' action uses the Teams Graph API endpoint `/teams/{team-id}/channels/{channel-id}/messages`. In a real-world scenario, analysts often combine this with adaptive cards to include incident details like affected assets and alert count for faster triage.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A cloud solutions architect for a retail company is evaluating services for a new workload. The correct answer here reflects best practice for the specific scenario described — not a general cloud recommendation. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Cloud exam questions reward reading the constraint carefully: the same technology can be right or wrong depending on the use case.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this MS-102 question in full detail.
Manage security and threats by using Microsoft Defender XDR — This question tests Manage security and threats by using Microsoft Defender XDR — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Power Automate — Power Automate is the correct choice because it provides a no-code/low-code workflow that can be triggered by Microsoft 365 Defender's 'When an incident is created or updated' connector, filter for severity 'High', and then post a message to a dedicated Teams channel via the 'Post a message in a chat or channel' action. This directly meets the requirement for automatic, event-driven notification without custom code.
What should I do if I get this MS-102 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.