SC-200 Respond to security incidents Practice Question
Your organization uses Microsoft Defender XDR. The incident queue shows multiple alerts related to a single endpoint: malware detected, suspicious PowerShell execution, and data exfiltration attempts. The analyst needs to investigate the incident. Which tool should the analyst use to correlate these events?
⚠ Common exam trap
Many exam-takers confuse the purpose of Advanced hunting (a cross-domain query engine) with Microsoft Sentinel’s incident workspace (a SIEM incident management interface), leading them to choose Option D because they think a SIEM is always the best correlation tool, even though the question specifically asks for correlation within Defender XDR.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Advanced hunting in Microsoft Defender XDR.
Advanced hunting in Microsoft Defender XDR allows the analyst to query across multiple data sources—including endpoint detection and response (EDR), identity, email, and cloud app data—using Kusto Query Language (KQL). This enables correlation of the malware detection, suspicious PowerShell execution, and data exfiltration alerts on the same device by joining tables such as DeviceEvents, DeviceProcessEvents, and DeviceNetworkEvents, providing a unified timeline of the attack chain.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Defender for Office 365 Explorer.
Why it's wrong here
Microsoft Defender for Office 365 Explorer provides investigation capabilities limited to email and collaboration content such as phishing detections, mail flow, and user-reported messages. It does not expose endpoint telemetry like process creation, network connections, or file hashes from devices. For an incident that spans multiple domains, you need a tool that can query signals across all of them, not just the mailbox and SharePoint layers.
- ✗
Microsoft Defender for Cloud Apps activity log.
Why it's wrong here
The Microsoft Defender for Cloud Apps activity log records user and admin actions across connected cloud applications, such as sign-ins, file accesses, and permission changes. While useful for identifying risky app behavior, it lacks endpoint-side data such as process execution, persistence mechanisms, or lateral movement artifacts. You cannot use this log alone to reconstruct an endpoint-centric attack chain or to join with device telemetry for cross-domain correlation.
- ✓
Advanced hunting in Microsoft Defender XDR.
Why this is correct
Advanced hunting in Microsoft Defender XDR lets you query raw telemetry across the entire Microsoft ecosystem—endpoints, emails, cloud apps, identities, and more—using Kusto Query Language (KQL). You can perform multi-table joins to correlate low-level events, like a suspicious PowerShell process on one device that contacted a malicious URL previously phished in an email. This unified schema is built specifically for proactive and reactive incident hunting and is the correct native tool for a cross-domain Defender XDR incident.
- ✗
Microsoft Sentinel incident workspace.
Why it's wrong here
Microsoft Sentinel's incident workspace is a management and triage interface within the SIEM, built around cases and alerts from connected log sources, not a direct query surface for Defender XDR telemetry. Even when Defender XDR is integrated, you would pivot to Log Analytics queries or the incident's related alerts, but the workspace itself does not provide the raw Advanced Hunting tables. Since the question target is Defender XDR, using Sentinel's incident UI adds an unnecessary layer and is not the native path for hunting.
Go deeper
Related to this question
About these practice questions
One of 673 original SC-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.