Chapter 2 of 3 · Microsoft SC-200
Respond to Security Incidents
Defender XDR, Defender for Endpoint, identities, cloud, Sentinel and Microsoft 365 investigations.
- 5topics
- 30 minfast track
- 1diagrams and exhibits
- 35–40%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Responding in Defender XDR, Office 365 and PurviewSC-200 incident response: Defender XDR incidents, Defender for Office 365 Threat Explorer and ZAP, Purview alerts, Defender for…Diagram6 min
- 2Identities, Defender for Identity and Sentinel IncidentsSC-200 identity response: compromised Entra identities, Defender for Identity alerts, Sentinel incidents, entities, bookmarks and…6 min
- 3Agentic AI, Complex Attacks and Case ManagementSC-200 advanced response: embedded Security Copilot, multi stage and lateral movement attacks, the incident graph and case…6 min
- 4Responding in Defender for EndpointSC-200 endpoint response: device timeline, isolate, live response commands, investigation packages, deep analysis, evidence…6 min
- 5Investigating Microsoft 365 ActivitiesSC-200 Microsoft 365 investigations: Purview Audit operations and retention, content search with purge, and Microsoft Graph…6 min
About this chapter
What this chapter covers
This domain, worth 35 to 40 percent of the exam, is the daily work of a security analyst. It covers triaging and investigating alerts and incidents across the Microsoft security products, taking response actions, and digging into Microsoft 365 activity to find out what an attacker did.
The questions describe an attack and ask what to look at, which action to take, or which tool answers the question fastest.
How the topics fit together
An investigation moves from the incident, to the entities involved, to the evidence.
- Responding in Defender XDR, Office 365 and Purview covers incidents, email threats, compromised entities from Purview, cloud workloads and cloud apps.
- Identities, Defender for Identity and Sentinel incidents covers compromised identities, identity alerts and Sentinel incidents.
- Agentic AI, complex attacks and case management covers Security Copilot, multi stage attacks and managing incidents as cases.
- Responding in Defender for Endpoint covers the device timeline, live response, investigation packages and evidence.
- Investigating Microsoft 365 activities covers Purview Audit, content search and Microsoft Graph activity logs.
Start every investigation from the incident, not from a single alert. The incident already links the related alerts, entities and evidence.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with examples and tables.
- What to remember for the exam: the facts to memorise and how questions are phrased.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Ready for more practice?
The full Microsoft SC-200 question bank has 650 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.