A SOC receives Defender for Cloud incidents through XDR but lacks details and sees duplicates from an older subscription connector. Which two design changes best fit documented integration behavior? Select two.

Select all that apply. Every correct option and no extras are required for credit in the app.

A.Remove overlapping legacy alert and incident-creation paths
B.Ingest only the incident title as evidence
C.Assign subscription Owner to every investigator
D.Enable the tenant-based Defender for Cloud alert/entity connector
E.Treat the empty incident as proof there were no cloud alerts

Show the answer and explanation

✓ Correct answers

Remove overlapping legacy alert and incident-creation paths
Enable the tenant-based Defender for Cloud alert/entity connector

The tenant-based connector supplies synchronized cloud alert/entity details, and removing legacy overlap prevents duplicates. A title omits evidence, broad Owner permissions are unnecessary, and empty details indicate an integration gap rather than absence of alerts.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material. Not affiliated with or endorsed by Microsoft. These are original learning questions, not actual exam questions. Product capabilities and exam objectives can change; verify current Microsoft documentation. Practice scores do not predict or guarantee an exam result.