Describe the capabilities of Microsoft security solutions →hardMultiple ChoiceObjective-mapped

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Exhibit

Refer to the exhibit.

```json
{
  "alert": {
    "id": "alert-123",
    "title": "Suspicious sign-in from unknown location",
    "severity": "medium",
    "category": "Anomalous user behavior",
    "entities": [
      {
        "type": "user",
        "name": "jdoe@contoso.com"
      },
      {
        "type": "ip",
        "address": "203.0.113.50"
      }
    ]
  },
  "incident": {
    "id": "inc-456",
    "status": "active",
    "severity": "high",
    "assignedTo": "analyst1"
  }
}
```

You are investigating an alert in Microsoft Sentinel. The exhibit shows the JSON output of an alert that was generated from a sign-in log. The alert is linked to an active incident. Which action should you take to prioritize the incident for investigation?

⚠ Common exam trap

Watch out — candidates often confuse 'reassigning' with 'prioritizing,' but reassignment only changes the owner, not the incident's severity or position in the queue, while severity directly controls triage order in Sentinel.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Change the incident severity to critical

Changing the incident severity to critical in Microsoft Sentinel directly influences the prioritization and triage workflow. By elevating the severity, the incident is flagged for immediate attention, ensuring it appears at the top of the queue for investigation. This action aligns with the incident management best practice of using severity levels to indicate business impact and urgency.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Change the incident severity to critical
Why this is correct
In Microsoft Sentinel, changing an incident's severity to "Critical" directly impacts its prioritization within the security operations center (SOC) workflow. This action signals to analysts that the incident requires immediate attention and resources, often triggering specific escalation procedures or service level agreements (SLAs) to ensure rapid investigation and remediation. It effectively moves the incident to the top of the queue, ensuring it receives the necessary focus.
✗
Close the incident as a false positive
Why it's wrong here
Closing an incident as a false positive in Microsoft Sentinel would prematurely terminate any ongoing investigation and prevent further analysis of the associated alerts. This action is appropriate only when it has been definitively determined that the alert does not represent a genuine security threat, which contradicts the goal of prioritizing an active investigation. It would effectively de-prioritize it to zero, rather than elevating its importance.
✗
Delete the alert from the incident
Why it's wrong here
Deleting a specific alert from an incident in Microsoft Sentinel removes that particular piece of evidence but does not resolve the underlying security incident itself. The incident could still contain other related alerts or require further investigation based on remaining context. This action would merely remove data, potentially hindering a complete investigation, rather than escalating the incident's priority or ensuring its resolution.
✗
Reassign the incident to another analyst
Why it's wrong here
Reassigning an incident to a different security analyst in Microsoft Sentinel primarily shifts the responsibility for its investigation without inherently altering the incident's priority level. While a new analyst might bring fresh perspective or be more available, this administrative action does not automatically elevate the incident's severity or its position in the overall investigation queue. The incident's urgency remains unchanged unless its severity is explicitly modified.

Go deeper

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question