Key Capabilities of Microsoft Defender XDR
Which TWO of the following are capabilities of Microsoft Defender XDR? (Choose two.)
Quick Answer
The answer is automated investigation and response across domains, which is a core capability of Microsoft Defender XDR. This is correct because XDR, or Extended Detection and Response, is specifically designed to correlate alerts from multiple domains—such as endpoint, email, identity, and cloud apps—into a single incident, enabling cross-domain detection that reveals the full attack story in one place. On the SC-900 exam, this concept tests your understanding of how Microsoft’s security solutions integrate beyond siloed tools; a common trap is confusing XDR with a single-domain tool like Microsoft Defender for Endpoint. Remember that “X” in XDR stands for “cross-domain,” so think of it as the glue that connects alerts across email, identity, endpoints, and cloud apps. A helpful memory tip: “X marks the spot across all domains.”
⚠ Common exam trap
Many exam-takers confuse the broad security portfolio—such as DLP, SIEM, and identity governance—with the specific cross-domain correlation and automated response capabilities that define Microsoft Defender XDR.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Correlate alerts from multiple domains into a single incident
Microsoft Defender XDR correlates alerts from multiple domains—such as endpoint, email, identity, and cloud apps—into a single incident. This cross-domain correlation is a core capability of the XDR (Extended Detection and Response) solution, enabling security teams to see the full attack story in one place.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Correlate alerts from multiple domains into a single incident
Why this is correct
Defender XDR correlates alerts across endpoints, email, etc.
- ✗
Data loss prevention for sensitive information
Why it's wrong here
DLP is a Microsoft Purview capability.
- ✗
Centralized log analytics for custom queries
Why it's wrong here
Log analytics is a Microsoft Sentinel capability.
- ✗
Identity governance and access reviews
Why it's wrong here
Identity governance is a Microsoft Entra capability.
- ✓
Automated investigation and response across domains
Why this is correct
Defender XDR automates response across domains.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Extended Detection and Response
Extended Detection and Response (XDR) is a security approach that collects and analyzes data from multiple sources like endpoints, networks, servers, and email to detect and stop threats more effectively.
Key term
Incident
An incident is a security event that violates an organization's policies or threatens its data, systems, or operations, requiring a structured response.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-900
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which THREE capabilities are provided by Microsoft Defender XDR? (Choose THREE.)
medium- A.Cloud security posture management
- ✓ B.Advanced hunting
- ✓ C.Automated investigation and response
- ✓ D.Incident management
- E.Vulnerability management
Why B: Microsoft Defender XDR provides a unified security experience across various domains. Its core capabilities include **Advanced hunting**, which allows security analysts to proactively query raw data across endpoints, email, identities, and cloud apps using Kusto Query Language (KQL) to uncover sophisticated threats. It also offers **Automated investigation and response (AIR)**, which automatically investigates alerts and takes remediation actions to resolve threats efficiently. Furthermore, **Incident management** is a key capability, consolidating alerts from various Defender components into incidents for a holistic view and streamlined security operations, enabling coordinated response across the enterprise.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.