ExamTopics Logo
Mail Us[email protected]
Menu
Microsoft Discussions
exam questions

Exam SC-200 All Questions

View all questions & answers for the SC-200 exam
Go to Exam

Exam SC-200 topic 7 question 21 discussion

Actual exam question from Microsoft's SC-200
Question #: 21
Topic #: 7
[All SC-200 Questions]

You have a Microsoft 365 E5 subscription that uses Microsoft Copilot for Security.

You have a Copilot for Security workspace that uses the following plugins:

• Microsoft Entra
• Microsoft Defender XDR

From the Microsoft Defender portal, you use Copilot for Security to investigate a reported incident.

You need to run a promptbook that will include information from Microsoft Entra ID Protection in the investigation.

What should you do first?

  • A. From the Microsoft Defender portal, create an incident report.
  • B. Open the investigation in the Copilot for Security standalone experience.
  • C. Open the investigation in Microsoft Sentinel.
  • D. From the Microsoft Defender portal, create an advanced hunting query.
Show Suggested Answer Hide Answer
Suggested Answer: B 🗳️
by a_kto_to at March 10, 2025, 8 a.m.

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
Submit Cancel
a_kto_to
4 days, 4 hours ago
Selected Answer: B
ChatGTP: The correct answer is: ✅ B. Open the investigation in the Copilot for Security standalone experience. 💡 Explanation: Since the promptbook needs to include data from Microsoft Entra ID Protection, and the investigation is currently in the Microsoft Defender portal, you must switch to the Copilot for Security standalone experience first. Here's why: 🔍 Why Option B is correct: The Microsoft Defender portal currently limits plugin access mostly to Defender XDR-related services. To leverage additional plugins, such as Microsoft Entra, you need to use the standalone Copilot for Security portal. Only in the standalone portal can you run promptbooks that include multiple plugin data sources — including Microsoft Entra ID Protection.
upvoted 2 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
exam
Someone Bought Contributor Access for:
SY0-701
London, 1 minute ago