SC-200 Question #150: Real Exam Question with Answer & Explanation

Question

You are using the Microsoft 365 Defender portal to conduct an investigation into a multi-stage incident related to a suspected malicious document. After reviewing all the details, you have determined that the alert tied to the potentially malicious document is also related to another incident in your environment. However, the alert is not currently listed as a part of that second incident. Your investigation into the alert is ongoing, as it is your investigation into the two related incidents. You need to appropriately categorize the alert and ensure that it is associated with the second incident. What two actions should you take in the Manage alert pane to fulfill this part of the investigation? (Choose two)

Options

• ASet status to In progress
• BSet status to New
• CSet classification to True alert
• DEnter the Incident ID of the related incident in the Comment section.
• ESelect the Link alert to another incident option.

Explanation

In the Manage alert pane of the Microsoft 365 Defender portal, two actions are needed: (A) Set the status to 'In progress,' because the investigation is actively ongoing and 'New' would misrepresent that no work has started, and (E) Select 'Link alert to another incident,' which is the formal mechanism to associate the alert with the second related incident. Option D (entering an incident ID in the Comment section) documents context but does not formally link the alert. Option C (classification as True alert) relates to confirming legitimacy, not to the association or status requirements described. 'New' status (B) is incorrect because investigation has already begun.

No community discussion yet for this question.