SC-200 Certification Practice Question #234

Question

You have a Microsoft 365 subscription that uses Microsoft Defender XDR.

You have an Azure subscription that uses Microsoft Security Copilot.

You need to create a custom promptbook in Security Copilot that will gather the following information about an incident ID:

•	An incident summary
•	Threat intelligence on the identified threat actors
•	A detailed analysis of the users affected by the incident
•	A detailed analysis of the devices affected by the incident

Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Accepted Answer

Building a custom promptbook follows the MS Learn sequence — start from a session, run the prompts you want to capture, select the checkboxes beside those prompts, then Create promptbook. Because the incident must yield four distinct outputs (summary, threat-actor intel, affected users, affected devices), the gathering step is "Enter the four prompts" (one per output), not the single-prompt tile. Promptbooks are authored and managed in the Security Copilot standalone portal, so the standalone-session tile is the correct entry point over the Defender XDR tile. Confidence is held at 84 because no Suggested Answer or Most-Voted marker is recorded and two comments split on the portal entry point, but MS Learn and the higher-voted comment align on the standalone four-prompt ordering.

More SC-200 practice questions