MS-102 Practice Question: Manage security and threats by using Microsoft Defender XDR

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Check each workload portal individually and correlate manually

  Why it's wrong here

  Checking each workload portal individually—such as Microsoft Defender for Endpoint, Defender for Identity, Defender for Office 365, and Defender for Cloud Apps—and then correlating the alerts manually is inefficient and error-prone. Alert timestamps, severity schemas, and naming conventions differ across portals, making it easy to miss a critical step in an attack chain. This approach forces analysts to manually reconstruct the entire attack story, which is exactly the automation that Microsoft Defender XDR provides.

• ✗

  Review the alerts in Microsoft Defender for Identity only

  Why it's wrong here

  Reviewing only Microsoft Defender for Identity alerts narrows visibility to on-premises Active Directory and identity-focused signals, such as pass-the-hash or unusual Kerberos ticket activity. Many incidents begin in email, endpoint, or cloud apps and later manifest as identity compromise, so this limited telemetry fails to reveal the complete kill chain. The unified incident in Microsoft Defender XDR incorporates identity alerts alongside endpoint, email, and cloud app alerts to show the full scope of an attack.

• ✗

  Review the alerts in Microsoft Defender for Endpoint only

  Why it's wrong here

  Looking only at Microsoft Defender for Endpoint alerts captures process, network, and file behaviors on devices, but it omits telemetry from identities, email, and SaaS applications. A security incident typically spans multiple surfaces, and the endpoint perspective might only expose the final payload or one detection event. Without the unified incident view, you could miss the initial access vector and lateral movement that occurred outside endpoint telemetry, leaving the response incomplete.

• ✓

  Use the Microsoft Defender XDR portal to view the unified incident

  Why this is correct

  Use the Microsoft Defender XDR portal (formerly Microsoft 365 Defender) to view the unified incident, which automatically correlates alerts from all workloads—endpoint, identity, email, and cloud apps—into a single incident with an attack story. This portal provides affected assets, related alerts, evidence, and automated investigation timelines, allowing analysts to see the entire attack chain in one place. It also supports incident management actions such as commenting, assigning, and running automated responses across the integrated workloads.

Go deeper

Related to this question