Describe the capabilities of Microsoft security solutions →mediumMultiple Choice

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Exhibit

Refer to the exhibit.
$MDEAlert = Get-MDEAlert -Id '123456'
$MDEAlert | Select-Object -Property Id, Title, Severity, Status, LastUpdateTime

Refer to the exhibit. An administrator runs the PowerShell command against Microsoft Defender for Endpoint. The output shows an alert with Severity 'High' and Status 'New'. What should the administrator do next to investigate the alert?

⚠ Common exam trap

The SC-900 exam often tests the misconception that you should immediately change severity or resolve alerts based on a single data point, rather than following the proper incident response workflow of investigating in the unified security portal.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Investigate the alert details in the Microsoft Defender XDR portal

The alert has a severity of 'High' and status 'New', indicating a potentially critical threat that requires immediate investigation. The correct next step is to use the Microsoft Defender XDR portal to examine the alert details, including the affected devices, user accounts, and related events, to determine the scope and impact of the threat. Changing severity or resolving the alert without investigation would risk missing a real security incident.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Change the severity to Medium to reduce false positives
Why it's wrong here
Severity reflects the detection's assessed risk, not a tunable filter; lowering it hides a genuine high-severity detection from triage queues. It is tempting because severity tuning is genuinely used to suppress noisy, low-fidelity detections after analysis, but a New alert must be investigated before any such tuning is justified.
✗
Resolve the alert as a false positive
Why it's wrong here
Resolving as false positive closes the alert without investigation, discarding potential evidence of compromise. It is tempting because false-positive resolution is genuinely the correct closure for alerts already verified as benign, but a New High alert has not yet been triaged, so the stem requires investigation first.
✗
Create a Microsoft Sentinel analytics rule from the alert
Why it's wrong here
Analytics rules generate detections from log data; they do not investigate an existing Defender alert. It is tempting because Sentinel rules are genuinely used to correlate and alert on telemetry across sources, but the stem asks what to do next with a New alert, which is manual investigation, not rule authoring.
✓
Investigate the alert details in the Microsoft Defender XDR portal
Why this is correct
The alert is already generated in Defender for Endpoint, so the administrator opens it in the Microsoft Defender XDR portal to review evidence, affected devices and related incidents, then decide on response actions. Investigation precedes remediation, satisfying the requirement to investigate the high-severity new alert.

Visual reference

Go deeper

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question