SC-200 Certification Practice Question #21

Question

You have a Microsoft 365 subscription that uses Microsoft 365 Defender.
You need to identify all the entities affected by an incident.
Which tab should you use in the Microsoft 365 Defender portal?

Accepted Answer

The question asks for the tab that lists all entities affected by an incident. MS Learn's "Investigate incidents" article states verbatim that the Evidence and Response tab "shows all the supported events and suspicious entities in the alerts in the incident," each marked with a verdict and remediation status. The top comment (31 👍) and Metasploit (8 👍, doc-quoted) reinforce this, and Most Voted is C with 33 votes. Confidence is held at 90 rather than higher because a few commenters argue for "Investigations" or the (non-listed) "Assets" tab; those are discounted because Investigations surfaces automated-investigation actions rather than the consolidated entity list, and Assets isn't an answer choice.

More SC-200 practice questions