AB-900 Certification Practice Question #27

Question

Your organization has a Microsoft 365 subscription.
You need to investigate security incidents and alerts raised from the Windows 11 devices in your organization.
What should you use?

Accepted Answer

Investigating **security incidents and alerts from Windows 11 devices** is the job of **Microsoft Defender for Endpoint** — the endpoint detection and response (EDR) platform that surfaces device alerts, correlates them into incidents, and supports automated investigation. Entra ID Protection covers identity sign-in risk, Defender for Identity covers on-premises Active Directory, and Insider Risk Management covers data exfiltration — none is the device-level investigation tool.

More AB-900 practice questions