SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
Exhibit
Refer to the exhibit. $MDEAlert = Get-MDEAlert -Id '123456' $MDEAlert | Select-Object -Property Id, Title, Severity, Status, LastUpdateTime
Refer to the exhibit. An administrator runs the PowerShell command against Microsoft Defender for Endpoint. The output shows an alert with Severity 'High' and Status 'New'. What should the administrator do next to investigate the alert?
⚠ Common exam trap
The SC-900 exam often tests the misconception that you should immediately change severity or resolve alerts based on a single data point, rather than following the proper incident response workflow of investigating in the unified security portal.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Investigate the alert details in the Microsoft Defender XDR portal
The alert has a severity of 'High' and status 'New', indicating a potentially critical threat that requires immediate investigation. The correct next step is to use the Microsoft Defender XDR portal to examine the alert details, including the affected devices, user accounts, and related events, to determine the scope and impact of the threat. Changing severity or resolving the alert without investigation would risk missing a real security incident.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Change the severity to Medium to reduce false positives
Why it's wrong here
Changing severity won't help investigation.
- ✗
Resolve the alert as a false positive
Why it's wrong here
No evidence it's a false positive.
- ✗
Create a Microsoft Sentinel analytics rule from the alert
Why it's wrong here
The alert is already in Defender; Sentinel can ingest it, but not necessary first step.
- ✓
Investigate the alert details in the Microsoft Defender XDR portal
Why this is correct
The portal provides detailed information and actions.
Visual reference
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.