Match each Microsoft 365 Defender portal component to its function.
Drag a concept onto its matching description — or click a concept then click the description.
Protects email and collaboration tools
Protects devices from threats
Protects on-premises Active Directory
Protects cloud applications
Unified threat protection dashboard
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Incidents: A collection of related alerts that represent a potential attack.
The correct matches are Incidents with 'collection of related alerts', Alerts with 'individual notifications', and Hunting with 'proactive search'. The definitions for Threat Analytics and Secure Score are swapped in options C and D.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
Incidents: A collection of related alerts that represent a potential attack.
Why this is correct
Incidents in the Microsoft 365 Defender portal are the primary unit of investigation: the portal automatically correlates alerts that share related attack chains, entities, or timelines into a single incident, giving responders a consolidated view of the full scope of a potential breach. This correlation prevents analyst fatigue from thousands of isolated alerts and aligns with the industry concept of 'incident response' where the focus is on the attack, not just the symptom. Each incident can include multiple alerts from different workloads (e.g., Defender for Endpoint, Defender for Office 365, Defender for Identity), and its severity and status drive the overall incident management lifecycle, including assignment, investigation, and resolution.
Alerts: Individual notifications of suspicious activity.
Why this is correct
An alert in the Microsoft 365 Defender portal represents a discrete, timestamped detection of a specific suspicious or malicious activity, such as a single sign-in anomaly, a malware file execution, or a suspicious PowerShell command. Alerts are generated by various Microsoft 365 Defender components and may be triggered independently or as part of a larger attack; they each carry metadata like severity, category, and MITRE ATT&CK technique. While an alert by itself indicates 'something happened,' it is not yet the full story — analysts pivot from alerts into investigating the broader incident that groups them, and alerts can be triaged, suppressed, or linked to incidents depending on their context and fidelity.
Threat Analytics: A measurement of an organization's security posture.
Why it's wrong here
Threat Analytics in the Microsoft 365 Defender portal is actually a set of in-depth reports about active threat actors, attack campaigns, and vulnerabilities, offering expert narrative analysis, relevant detections, and recommended mitigations—it is not a measurement of an organization's security posture. The definition given describes Microsoft Secure Score, which is the portal's quantitative security posture measurement based on your tenant's configuration and security controls. Therefore, if you match 'Threat Analytics' to 'a measurement of an organization's security posture,' you are confusing a threat intelligence capability with a compliance/security hygiene metric, so this pairing is incorrect.
Secure Score: Provides expert analysis of active threats and campaigns.
Why it's wrong here
Secure Score in the Microsoft 365 Defender portal is a dynamic, quantified assessment of your organization's security posture, expressed as a percentage and a set of improvement actions that reflect how well you have implemented security features for your identities, devices, apps, and data. It does not provide expert analysis of active threats or campaigns; that function belongs to Threat Analytics, which focuses on real-world threat actors and ongoing attack operations. Hence, attributing 'provides expert analysis of active threats and campaigns' to Secure Score is a mismatched definition, making the pairing incorrect.
Hunting: Proactively search for threats using advanced queries.
Why this is correct
Hunting (advanced hunting) in the Microsoft 365 Defender portal is a proactive, query-based capability that allows security analysts to search across raw, schema-normalized data from endpoints, Office 365, identities, and cloud apps to discover threats that may not have triggered alerts or to investigate hypotheses and known indicators. It uses a Kusto Query Language (KQL)-like language to join data tables, surface anomalies, and build custom detections—this is fundamentally different from passively reviewing alerts or incidents. Because the definition 'Proactively search for threats using advanced queries' directly matches this functionality, the pairing is correct and distinguishes it from the reactive, event-driven nature of alerts and incidents.
Go deeper
Learn chapter
Microsoft 365 Tenant Setup
Key term
Threat
A threat is any potential danger that could harm a computer system, network, or data, whether from a malicious hacker, a natural disaster, or an accidental mistake.
Key term
Threat analytics
Threat analytics is the process of using threat intelligence, machine learning, and behavioral data to identify, assess, and predict cybersecurity threats in real time.
About these practice questions
One of 241 original MS-102 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.