SC-200 Question #77: Real Exam Question with Answer & Explanation

Question

You are using the Microsoft 365 Defender portal to conduct an investigation into a multi-stage incident related to a suspected malicious document. After reviewing all the details, you have determined that the alert tied to this potentially malicious document is also related to another incident in your environment. However, the alert is not currently listed as a part of that second incident. Your investigation into the alert is ongoing, as is your investigation into the two related incidents. You need to appropriately categorize the alert and ensure that it is associated with the second incident. What two actions should you take in the Manage alert pane to fulfill this part of the investigation? Each correct answer presents a part of the solution.

Options

• ASelect the Link alert to another incident option.
• BSet classification to True alert.
• CSet status to New.
• DSet status to In progress.
• EEnter the Incident ID of the related incident in the Comment section.