SC-200 Manage a security operations environment Practice Question
You are the lead security operations analyst for a company that uses Microsoft Defender XDR. The company has recently deployed Microsoft Copilot for Security to help analysts investigate incidents. During a recent incident involving a potential ransomware attack on multiple devices, the analysts used Copilot to generate an investigation summary and recommended actions. However, the analysts report that Copilot's responses are not specific to the incident; they are generic and do not include device-specific details. You need to ensure that Copilot provides context-aware responses that include specific device information from the incident. What should you do?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Instruct analysts to use the 'Investigate' capability in Copilot and provide the incident ID.
To get context-aware responses with device-specific details, analysts must use the 'Investigate' capability within Copilot and provide the incident ID. This enables Copilot to retrieve and analyze data specific to that incident, including device information from Defender XDR. Option A is incorrect because assigning a role in Entra ID does not affect Copilot's access to incident details. Option B is incorrect because the Defender XDR data connector in Sentinel is for ingesting data into Sentinel, not for providing context to Copilot. Option D is incorrect because Copilot does not rely on custom plugins for this functionality; the built-in 'Investigate' capability is designed for this purpose.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Assign the Microsoft 365 Defender role to the analysts in Microsoft Entra ID.
Why it's wrong here
Roles are already assigned; this does not affect Copilot context.
- ✗
Enable the Microsoft Defender XDR data connector in Microsoft Sentinel.
Why it's wrong here
Copilot for Security uses its own data access, not Sentinel connectors.
- ✓
Instruct analysts to use the 'Investigate' capability in Copilot and provide the incident ID.
Why this is correct
Copilot can access incident details when given the incident ID, providing context-aware responses.
- ✗
Configure a custom plugin in Copilot to fetch device data from Defender XDR.
Why it's wrong here
Copilot has built-in integration; custom plugins are not required.
Go deeper
Related to this question
About these practice questions
This SC-200 question is part of Courseiva's 209-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.