MS-102 Practice Question: Manage security and threats by using Microsoft Defender XDR
You are a Microsoft 365 administrator for a company that uses Microsoft Defender XDR. A security analyst needs to view a unified list of incidents and alerts from Microsoft Defender for Endpoint, Microsoft Defender for Office 365, and Microsoft Defender for Identity. Where should the analyst go to see this unified view?
⚠ Common exam trap
The trap here is thinking that the individual Defender portals or Azure Sentinel provide the native unified incident view; only the Microsoft 365 Defender portal aggregates incidents across all Defender XDR workloads out of the box.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft 365 Defender portal (security.microsoft.com) under Incidents.
The Microsoft 365 Defender portal at security.microsoft.com is the centralized console for Microsoft Defender XDR. It aggregates alerts and incidents from Defender for Endpoint, Office 365, Identity, and Cloud Apps into a single queue, enabling analysts to investigate and respond across domains without switching portals.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft 365 Defender portal (security.microsoft.com) under Incidents.
Why this is correct
The Microsoft 365 Defender portal at security.microsoft.com provides a unified incidents queue that aggregates alerts from Microsoft Defender for Endpoint, Office 365, Identity, and Cloud Apps. This is the central location for cross-domain incident management, meeting the analyst's need for a unified view.
- ✗
Azure Sentinel (azure.microsoft.com/services/azure-sentinel) under Incidents.
Why it's wrong here
Azure Sentinel is a separate SIEM/SOAR solution that can ingest Microsoft Defender alerts, but it is not the native unified portal for Microsoft Defender XDR. It requires additional configuration and does not provide the out-of-the-box unified view.
- ✗
Microsoft Defender for Endpoint portal (securitycenter.windows.com) under Alerts.
Why it's wrong here
The Microsoft Defender for Endpoint portal shows only alerts from Defender for Endpoint, not from Office 365 or Identity. It does not provide a unified view across all Microsoft Defender XDR workloads, so it does not meet the requirement.
- ✗
Microsoft 365 compliance center (compliance.microsoft.com) under Alerts.
Why it's wrong here
The Microsoft 365 compliance center focuses on compliance and data governance alerts, not security incidents from Defender workloads. It does not aggregate alerts from Defender for Endpoint, Office 365, or Identity into a unified incident view.
Go deeper
Related to this question
Learn chapter
Endpoint DLP for Windows Devices
Key term
Defender for Office 365
Microsoft Defender for Office 365 is a cloud-based email security service that protects organizations against advanced threats like phishing, malware, and business email compromise by scanning emails, attachments, and links in real time.
Key term
Anti-phishing policy
An anti-phishing policy is a set of rules and technical controls that organizations use to detect, block, and respond to email or message-based attacks that trick users into revealing sensitive information.
About these practice questions
This MS-102 question is part of Courseiva's 712-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.