SC-200 Certification Practice Question #244

Question

You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR.

You are investigating an incident.

You need to review the incident tasks that were performed.

What can you use on the Incident page?

Accepted Answer

The Microsoft Defender portal Incident page exposes incident **Tasks**, the **Activities** tab / **Activity log** (a unified timeline of every manual and automated action on the incident), and an **alert timeline** in the attack-story/Summary view that orders alerts chronologically. All three are available to review what was performed, so the complete superset answer D is correct. The official Suggested Answer, the highest community vote, and the strongest comment all align with D; the lone B dissent leaned on a Sentinel doc rather than the XDR Incident page, so confidence is high but trimmed slightly to reflect that split.

More SC-200 practice questions