MS Microsoft Defender XDR: Incidents, Advanced Hunting & Secure Score

Question 1

In the Microsoft Defender portal, what does an incident represent?

Accepted Answer

A correlated collection of related alerts and affected assets across Defender products

Answer

Defender XDR correlates alerts from endpoints, identities, email, and cloud apps into incidents. This gives analysts the full attack story and the impacted assets in one place.

Question 2

Which query language is used for advanced hunting in Microsoft Defender XDR?

Accepted Answer

Kusto Query Language (KQL)

Answer

Advanced hunting uses Kusto Query Language (KQL) to query up to 30 days of raw data across tables such as DeviceProcessEvents, EmailEvents, and IdentityLogonEvents.

Question 3

You built an advanced hunting query that identifies a suspicious pattern. You want it to run automatically on a schedule and generate alerts. What should you create?

Accepted Answer

A custom detection rule

Answer

Custom detection rules run advanced hunting queries on a schedule, generate alerts when they match, and can also take automatic response actions on devices, files, or users.

Question 4

Which Defender XDR capability gives you analyst reports on emerging threats and shows whether your organization is exposed to them?

Accepted Answer

Threat analytics

Answer

Threat analytics provides expert-written reports on active threat actors and campaigns. It shows impacted assets, exposure, and recommended mitigations for your environment.

Question 5

What does Microsoft Secure Score provide?

Accepted Answer

A numeric measurement of your security posture with prioritized improvement actions

Answer

Microsoft Secure Score measures how many recommended security controls you've implemented across identity, devices, apps, and data. It lists improvement actions ranked by impact.

(MS-102) Microsoft 365 Administrator Expert Practice Test

(MS-102) Microsoft 365 Administrator Expert Practice Test

MS Microsoft Defender XDR: Incidents, Advanced Hunting & Secure Score