Microsoft · SC-200
Incidents, cases, and Copilot
SC-200 · Lesson 8 of 14 · 54:12
YouTube loads only after you press play. This chapter opens at its timestamp in the full course. Watch on YouTube ↗
In this lesson
Prepare for the SC-200 exam (Microsoft Certified: Security Operations Analyst Associate). In this lesson: incidents in the Defender portal (attack story, assets, evidence, classification, incident cases), complex multi-stage attacks and blast radius analysis, case management (incident and generic cases, tasks, SLA policies, the SecurityCaseEvent table), and Security Copilot (summaries, guided responses, reports, query assistant, agents). Includes three original practice questions.
Preview the topics
- During an incident, an analyst must see which critical assets an attacker could reach next, from a compromised account. What should they open?
- A SOC lead must track a quarterly review of firewall rules, with tasks, owners, and due dates, although no incident exists. What should they create?
- A junior analyst must write a query to find a sign-in pattern, but barely knows KQL. Which Copilot capability helps most?