StudyByteLearn
← SC-100: Microsoft Cybersecurity Architect
SC-100 · Security operations detection and response

Practice question 83 of 498 · medium

A SOC connects Sentinel to Defender XDR. Which two checks directly validate coordinated incident handling? Select two.

Select all that apply. Every correct option and no extras are required for credit in the app.

  1. A.Test status and owner synchronization
  2. B.Delete source incidents immediately after import
  3. C.Confirm associated alerts and entities arrive
  4. D.Grant analysts Global Administrator
  5. E.Assume every advanced hunting table is populated
Show the answer and explanation

✓ Correct answers

  • Test status and owner synchronization
  • Confirm associated alerts and entities arrive

Arriving context and synchronized status/owner validate the integration. Raw-table coverage is separate, deleting source incidents damages investigation, and Global Administrator is excessive and does not verify synchronization.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material. Not affiliated with or endorsed by Microsoft. These are original learning questions, not actual exam questions. Product capabilities and exam objectives can change; verify current Microsoft documentation. Practice scores do not predict or guarantee an exam result.