Question 248

You have a Microsoft 365 E5 subscription that uses Microsoft Copilot for Security. You have a Copilot for Security workspace that uses the following plugins: • Microsoft Entra • Microsoft Defender XDR From the Microsoft Defender portal, you use Copilot for Security to investigate a reported incident. You need to run a promptbook that will include information from Microsoft Entra ID Protection in the investigation. What should you do first?

• AFrom the Microsoft Defender portal, create an incident report.
• BOpen the investigation in the Copilot for Security standalone experience. ✓
• COpen the investigation in Microsoft Sentinel.
• DFrom the Microsoft Defender portal, create an advanced hunting query.