Describe the capabilities of Microsoft security solutions →hardMultiple ChoiceObjective-mapped

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Exhibit

{
  "alerts": [
    {
      "id": "alert-123",
      "title": "Suspicious inbound email with malware",
      "category": "Malware",
      "severity": "High",
      "incidentId": "inc-456"
    }
  ]
}

Refer to the exhibit. A security analyst is reviewing an alert from Microsoft 365 Defender. The alert is associated with an incident. What is the best first step to investigate this alert?

⚠ Common exam trap

The trap here is that candidates often jump to an immediate containment action (like isolating a device) without first gathering context, but Microsoft's incident-first approach emphasizes investigation before remediation to avoid false positives and ensure proportional response.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Open the associated incident to view all related alerts and entities.

Microsoft 365 Defender incidents aggregate multiple alerts and entities (users, devices, mailboxes) into a single view, providing the full context needed to understand the attack chain. Opening the incident first allows the analyst to correlate the alert with related alerts, affected assets, and the incident timeline, which is the recommended initial step in incident response workflows.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Open the associated incident to view all related alerts and entities.
Why this is correct
An incident aggregates multiple related alerts and entities (users, devices, mailboxes, IP addresses) into a single investigation unit. This holistic view is crucial for understanding the scope, impact, and attack chain, preventing siloed investigations of individual alerts. It allows for comprehensive threat hunting and response planning, making it the most effective initial step for a security analyst.
✗
Isolate the affected user's device immediately.
Why it's wrong here
While device isolation is a critical containment action, performing it immediately without understanding the full context of the alert or incident can be premature and potentially disruptive. It might hinder further investigation by cutting off forensic data collection or prevent the analyst from observing the attacker's next moves. Isolation should be a deliberate step taken once the scope and impact are better understood, or if there's an immediate, critical threat of lateral movement.
✗
Mark the alert as resolved.
Why it's wrong here
Marking an alert as resolved without proper investigation is a significant security risk, as it prematurely closes a potential threat and prevents further analysis. This action could allow an active attack to persist undetected, leading to greater compromise. A proper resolution workflow requires validating the alert, investigating its root cause, confirming remediation, and ensuring no related threats remain, often by linking it to a broader incident for comprehensive closure.
✗
Run an automated simulation to test the alert.
Why it's wrong here
Running an automated simulation is a proactive measure used to test the effectiveness of security controls and detection rules, typically as part of a red team exercise or security posture management. It is not an appropriate action during a live investigation of an active alert or incident. The immediate priority is to understand and respond to the current threat, not to validate the detection mechanism itself, which has already proven effective by generating the alert.

Go deeper

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question