MS-102 Practice Question: Manage security and threats by using Microsoft Defender XDR
A security administrator needs to view a unified incident queue that correlates alerts from Microsoft Defender for Endpoint, Microsoft Defender for Office 365, and Microsoft Defender for Identity. Which console should the administrator open?
⚠ Common exam trap
Candidates often confuse the Microsoft 365 Defender portal with Azure Security Center (now Defender for Cloud), mistakenly thinking that all security alerts converge in Azure, when in fact the unified incident queue for Microsoft 365 Defender workloads is exclusive to security.microsoft.com.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft 365 Defender portal (security.microsoft.com)
The Microsoft 365 Defender portal (security.microsoft.com) provides a unified incident queue that aggregates and correlates alerts from Microsoft Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps. This single-pane-of-glass view enables security administrators to investigate and respond to cross-domain threats without switching between separate consoles.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft 365 Defender portal (security.microsoft.com)
Why this is correct
Microsoft 365 Defender portal (security.microsoft.com) is the single security operations console that aggregates alerts and incidents from Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps. Its unified incident queue correlates related alerts into a single incident, enabling triage, investigation, and response across all Microsoft 365 Defender workloads. This portal is the correct destination for viewing a unified incident queue.
- ✗
Azure Security Center
Why it's wrong here
Azure Security Center, now part of Microsoft Defender for Cloud, provides cloud security posture management (CSPM) and workload protection for Azure resources and hybrid infrastructure. While it surfaces security alerts and integrates with some Defender plans, it is scoped to infrastructure threats and does not aggregate incidents from Microsoft 365 workloads like email, identity, and collaboration apps. Therefore, it is not the unified incident queue for Microsoft 365 Defender signals.
- ✗
Microsoft Endpoint Manager admin center
Why it's wrong here
Microsoft Endpoint Manager admin center is the management plane for Intune and Configuration Manager, focusing on device enrollment, configuration policies, device compliance, and application deployment. Its security-related features, such as security baselines and vulnerability management reports, are administrative configurations rather than a security incident correlation engine. It does not provide a cross-workload incident queue with correlated alerts and automated response actions.
- ✗
Microsoft Purview compliance portal
Why it's wrong here
Microsoft Purview compliance portal is designed for compliance and governance needs, including data classification, data loss prevention (DLP), eDiscovery, retention, and audit log search. Although DLP alerts appear there, the portal does not aggregate or correlate threat incidents from Defender for Endpoint, Office 365, Identity, or Cloud Apps. Unified incident management for security threats is not a function of Purview; that capability is exclusive to the Microsoft 365 Defender portal.
Go deeper
Related to this question
Learn chapter
Microsoft 365 Tenant Setup
Key term
Defender for Office 365
Microsoft Defender for Office 365 is a cloud-based email security service that protects organizations against advanced threats like phishing, malware, and business email compromise by scanning emails, attachments, and links in real time.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
One of 241 original MS-102 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.