ExamTopics Logo
Mail Us[email protected]
Menu
Microsoft Discussions
exam questions

Exam SC-200 All Questions

View all questions & answers for the SC-200 exam
Go to Exam

Exam SC-200 topic 7 question 17 discussion

Actual exam question from Microsoft's SC-200
Question #: 17
Topic #: 7
[All SC-200 Questions]

You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR.

You are investigating an incident.

You need to review the incident tasks that were performed.

What can you use on the Incident page?

  • A. Tasks only
  • B. Tasks and Activity log only
  • C. Tasks and Alert timeline only
  • D. Tasks, Activity log, and Alert timeline
Show Suggested Answer Hide Answer
Suggested Answer: D 🗳️
by chiquito at Jan. 17, 2025, 4:21 a.m.

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
Submit Cancel
jamspurple
1 week ago
Selected Answer: B
I'd say B, Tasks and activity log https://learn.microsoft.com/en-us/azure/sentinel/investigate-incidents No mention of alert timeline
upvoted 2 times
...
chiquito
1 month, 4 weeks ago
Selected Answer: D
The correct answer is: D. Tasks, Activity log, and Alert timeline Reference: https://learn.microsoft.com/en-us/azure/sentinel/investigate-incidents
upvoted 2 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
exam
Someone Bought Contributor Access for:
SY0-701
London, 1 minute ago