Task 2.1: Respond to alerts and incidents in Microsoft Defender XDR

• AThe analyst selects Soft delete directly and the lead reviews the Action center History tab afterward

  Incorrect

  Direct approval runs the action at once, so nothing waits for the lead.

• BThe analyst uses Add to remediation, and the lead approves it with the Search and Purge role

  Correct

  Add to remediation creates a pending item that someone with the approval permission must approve.

• CThe analyst starts an automated investigation, which always deletes the cluster after the lead's comment

  Incorrect

  AIR proposes actions for approval; a comment doesn't approve anything.

• DThe analyst selects Delete sender's copy, which holds the action for the lead

  Incorrect

  Delete sender's copy is an extra delete option, not an approval step.

In Explorer, users can take direct action or use the two-step approval path: Add to remediation places the messages in a remediation container that appears on the Action center Pending tab. Approval needs the Search and Purge role (or Email & collaboration advanced actions in unified RBAC). After approval the action moves to the History tab.

• ANothing; ZAP quarantines the messages within the next day

  Incorrect

  ZAP's search covers only the last 48 hours of delivered email.

• BTurn on ZAP for malware in the anti-spam policy

  Incorrect

  ZAP for malware is set in anti-malware policies and is already on.

• CAdd the file hash to the Tenant Allow/Block List and wait for ZAP

  Incorrect

  A block entry affects new mail; ZAP still won't reach messages delivered three days ago.

• DFind the messages in Threat Explorer and remediate them

  Correct

  Messages older than ZAP's 48-hour window must be remediated manually.

ZAP retroactively acts on malicious messages, but its search is limited to the last 48 hours of delivered email. Messages delivered earlier need manual remediation, for example by selecting them in Threat Explorer and soft deleting them.

• ASubmit the URL on the Submissions page, select I've confirmed it's clean, then select Allow this URL

  Correct

  For high confidence phishing verdicts, allow entries come from the Submissions page.

• BAdd a URL allow entry directly in the Tenant Allow/Block List

  Incorrect

  Allow entries can't be created directly for high confidence phishing verdicts.

• CRelease each message from quarantine as it arrives

  Incorrect

  Releasing messages doesn't stop new ones from being quarantined.

• DAdd the URL to the advanced delivery policy as a simulation URL

  Incorrect

  Advanced delivery is for non-Microsoft phishing simulation URLs, not partner portals.

Allow entries for URLs, domains, email addresses and files with malware or high confidence phishing verdicts can't be added directly to the Tenant Allow/Block List. Submit the item on the Submissions page, mark it as confirmed clean, and choose Allow this URL to create the allow entry.

• ATurn on alerts in each DLP policy again

  Incorrect

  The policies still raise alerts; the change happened on the Defender side.

• BAssign the analysts the Information Protection Analyst role

  Incorrect

  Missing roles would hide the alerts from some users, not turn them into behaviors.

• CDisable the built-in DLP alert tuning rule in Settings > Microsoft Defender XDR > Alert tuning

  Correct

  That built-in rule now sets DLP signals as behaviors instead of alerts.

• DCreate a custom detection on BehaviorInfo for each DLP policy

  Incorrect

  It rebuilds alerts by hand instead of removing the rule that suppresses them.

A built-in alert tuning rule for DLP signals took effect in early October 2026. It sets DLP signals as behaviors, so they don't generate alerts in Defender XDR and stay available in BehaviorInfo and BehaviorEntities. To keep seeing DLP signals as alerts, disable that rule.

• ACreate a suppression rule on the Security alerts page and select the management group

  Incorrect

  The portal and REST API create suppression rules for subscriptions.

• BAssign the suppression through Azure Policy at the management group

  Correct

  Suppressing alerts for a management group is done with Azure Policy.

• CCreate an alert tuning rule in the Defender portal with the Hide alert action

  Incorrect

  Hide alert applies only to Defender for Endpoint alerts.

• DDismiss the alerts each day with the bulk Change status option

  Incorrect

  Bulk status changes don't stop future alerts.

Defender for Cloud suppression rules dismiss matching alerts. They can be applied to management groups through Azure Policy, or to subscriptions in the Azure portal or the REST API. A rule applies only to alert types that have triggered at least once.

• ADisable the account in Active Directory, for example with the Defender for Identity Disable action

  Correct

  On-premises settings override Entra for synced users, so the account must be disabled at the source.

• BRun Suspend user again with Notify additional users

  Incorrect

  Notifications don't stop the sync from reverting the suspension.

• CUse Require user to sign in again on the account

  Incorrect

  It signs the user out but leaves the account enabled.

• DUse Confirm user compromised so the policy suspends permanently

  Incorrect

  It raises the user's risk level in Entra; the account still syncs as enabled from AD.

When Microsoft Entra ID syncs users from on-premises Active Directory, the on-premises settings override Entra settings and the Suspend user governance action is reverted. Disable the account in Active Directory; Defender for Identity can do this with its Disable action.

• ADismiss the user's risk so the policy stops prompting

  Incorrect

  Dismissing removes the risk without securing the account.

• BBlock the user from signing in

  Correct

  Blocking is advised when the attacker can reset the password or do MFA.

• CRequire the user to change the password at the next sign-in

  Incorrect

  A password change after MFA can be completed by the attacker who controls the MFA method.

• DExclude the user from the user risk policy during the investigation

  Incorrect

  Exclusion removes protection from a confirmed compromised account.

• ERevoke the user's refresh tokens

  Correct

  Revoking refresh tokens ends existing sessions the attacker holds.

After confirming compromise, if a risk policy didn't remediate the user, take actions such as requesting a password change, blocking the user if you suspect the attacker can reset the password or do MFA, revoking refresh tokens, and disabling compromised devices.

• AConfigure a gMSA action account on the AD FS sensor

  Incorrect

  Sensors on AD FS servers don't perform remediation actions.

• BTurn on Unified RBAC for identities

  Incorrect

  Permissions affect who can start an action, not which sensor executes it.

• CMark the user as compromised in Microsoft Entra ID first

  Incorrect

  Marking compromised acts in Entra ID and doesn't disable the AD account.

• DInstall a sensor on a domain controller in that domain

  Correct

  Active Directory actions are executed by sensors on domain controllers.

Defender for Identity runs Active Directory remediation actions through the sensor on a domain controller, using the domain controller's local system account. Sensors on AD FS, AD CS or Microsoft Entra Connect servers don't perform remediation actions.

• AMove each alert from one incident to the other

  Incorrect

  Merging is preferred because moving alerts doesn't keep all the incident information.

• BClose one incident so the engine merges it into the other

  Incorrect

  Closed incidents aren't merged.

• CRemove the assignment from one incident, then merge them manually

  Correct

  Different assignees block merging; after that's fixed, a manual merge keeps the incident history.

• DGive both incidents the same tag and wait for correlation

  Incorrect

  Tags don't drive the merge decision.

Defender doesn't merge incidents that are assigned to two different people, closed, or differently classified. After fixing the cause, merge them manually; merging keeps information such as the activity log, which moving alerts doesn't. Up to five incidents can be merged at a time.

• AThe agent needs the Defender for Endpoint plugin enabled

  Incorrect

  The agent activates the Defender XDR, Threat Intelligence and agent plugins itself.

• BThe built-in Auto-Resolve rule for user-reported phish resolves the alerts first

  Correct

  The agent doesn't triage alerts resolved by alert tuning.

• CUser reports must go to Microsoft only, not to a reporting mailbox

  Incorrect

  Any of the reported message destinations works.

• DAnalysts need Security Administrator to see the agent's verdicts

  Incorrect

  Viewing results needs the same permissions as the agent; Security Administrator is for managing settings.

The Phishing Triage Agent works on alerts of type Email reported by user as malware or phish. It doesn't triage alerts that alert tuning has resolved, so the built-in Auto-Resolve - Email reported by user as malware or phish rule and any custom tuning rules that resolve this alert must be disabled.

• ASecurity operations > Alerts (manage)

  Correct

  It lets the user create and manage generic cases and tasks.

• BSecurity operations > Security data basics (read)

  Incorrect

  It only lets the user view cases, tasks and comments.

• CAuthorization and settings > Core security settings (manage)

  Incorrect

  It also configures templates, custom fields and SLA policies.

• DSecurity Data Manage on incident cases only

  Incorrect

  Incident case permissions don't cover generic cases.

Generic cases use their own permissions: Security data basics (read) or Microsoft Sentinel Reader to view, Alerts (manage) or Microsoft Sentinel Responder to create and manage cases, and Core security settings (manage) or Microsoft Sentinel Contributor to configure case templates, custom fields and SLA policies.

• AHard delete

  Incorrect

  Hard delete purges the message, so users can't recover it.

• BSoft delete

  Correct

  Soft delete moves the message to Recoverable Items\Deletions, where users and admins can recover it.

• CDelete sender's copy only

  Incorrect

  It acts on the sender's Sent Items, not the recipients' copies.

• DMove to inbox

  Incorrect

  It leaves the message in front of users.

Soft delete removes the message from the Deleted Items folder into the Recoverable Items\Deletions folder, where the user and admins can recover it. Hard delete purges the message, so users can't recover it.

• ATake action > Trigger automated response

  Correct

  This section triggers a logic app as a response to the alert.

• BTake action > Prevent future attacks

  Incorrect

  It lists security recommendations to harden the resource.

• CTake action > Suppress similar alerts

  Incorrect

  It creates a suppression rule.

• DAlert details > Inspect resource context

  Incorrect

  It opens the resource's activity logs.

The Take action tab of a Defender for Cloud alert offers Inspect resource context, Mitigate the threat, Prevent future attacks, Trigger automated response (run a logic app) and Suppress similar alerts.

• AUser Administrator

  Incorrect

  It isn't the role ID Protection requires for dismissing user risk.

• BConditional Access Administrator

  Incorrect

  It manages Conditional Access policies.

• CGlobal Administrator

  Incorrect

  It works but is far more privileged than needed.

• DSecurity Operator

  Correct

  It's the least privileged role required to dismiss user risk.

In Microsoft Entra ID Protection, Security Operator is the least privileged role to dismiss user risk, Security Administrator to create or edit risk-based policies, and Conditional Access Administrator to manage Conditional Access policies.

• AContainment

  Incorrect

  Containment recommends actions that contain the incident.

• BRemediation

  Incorrect

  Remediation recommends actions on specific entities.

• CTriage

  Correct

  Triage includes the recommendation to classify the incident.

• DInvestigation

  Incorrect

  Investigation recommends further investigative steps.

Copilot in Defender generates guided responses when you open an incident page. They fall into Triage (classify the incident as informational, true positive or false positive), Containment, Investigation and Remediation.