Microsoft · SC-200
Defender XDR settings
SC-200 · Lesson 1 of 14 · 3:16
YouTube loads only after you press play. Watch on YouTube ↗
In this lesson
Prepare for the SC-200 exam (Microsoft Certified: Security Operations Analyst Associate). In this lesson: email notifications in the Defender portal (incidents, actions, threat analytics), their filters and permissions, alert tuning (hide alert, resolve alert, set as behavior), alert correlation and incident merging, the primary Sentinel workspace, and scoped device group correlation. Includes three original practice questions.
Preview the topics
- The SOC lead wants an email for every new high-severity incident from Defender for Identity, and nothing else. What should they create?
- A nightly vulnerability scan triggers the same Defender for Endpoint alert on known servers. The team wants no incident at all, but the alert data must stay searchable. Which alert tuning action fits?
- Two Sentinel workspaces are onboarded to the Defender portal, and alerts from the second one never join incidents with Defender alerts. What explains this?