SC-200 · Domain 2 of 3

SC-200 Domain 2: Respond to security incidents

This group is the heart of the SOC analyst role. It covers investigating and remediating alerts and incidents across Microsoft Defender XDR, Defender for Endpoint and Microsoft 365, including agentic AI with Security Copilot and complex multi-stage attacks.

Exam weight
35–40%
Official functional groups
3
Estimated questions estimate
15–22
Suggested study time estimate
30–40 hrs

About 11 min read Reviewed October 2026

Overview

Responding to security incidents covers the analyst's day-to-day work after a detection fires. It covers responding to alerts and incidents in Defender XDR, including threats in Defender for Office 365, Purview, Defender for Cloud workload protections, Defender for Cloud Apps, compromised identities in Entra ID, alerts from Defender for Identity, and incidents in Sentinel, plus investigating with agentic AI and embedded Security Copilot, handling complex multi-stage and lateral-movement attacks, and case management. It covers responding in Defender for Endpoint, including device timelines, live response, collecting investigation packages, evidence and entity investigation, and automatic attack disruption. It covers investigating Microsoft 365 activities through Purview Audit, Content search in eDiscovery and Microsoft Graph activity logs.

This group follows the detections built in group 1 and leads into the proactive hunting of group 3. It is where the analyst triages, investigates across the Defender XDR portal, takes containment and remediation actions, and documents the incident.

How it's tested

Expect scenario questions that describe an alert, a compromised entity or a multi-product incident and ask which product to investigate in, what response action to take, or what to do next in the workflow. The exam rewards knowing each product's scope and the unified Defender XDR investigation experience.

  • Which product investigates?

    A threat on email, identity, endpoint, SaaS or a cloud workload is described, and you must choose the Defender product that owns it.

  • Right response action

    An incident is described, and you must choose the containment or remediation action, such as isolating a device or running live response.

  • Workflow next step

    An investigation is partway through, and you must choose the correct next step in the incident response workflow.

Reasoning it through

An analyst sees alerts that a user account was compromised on-premises, with suspicious lateral movement across domain controllers. Entra ID covers cloud identity, but the activity is in on-premises Active Directory. Microsoft Defender for Identity is the product that detects and investigates on-premises identity threats such as lateral movement, so the investigation and remediation of this identity compromise belong there.

Functional groups 3

Official functional groups from the Microsoft outline, in outline order.

2.1 Respond to alerts and incidents in Microsoft Defender XDRInvestigate and remediate across Office 365, Purview, Defender for Cloud, Cloud Apps, Entra ID, Defender for Identity and Sentinel, with Security Copilot and case management.
What it means
This covers investigating and remediating threats across the Defender XDR suite: Defender for Office 365 including automatic attack disruption, Purview-identified threats, Defender for Cloud workload protection alerts, Defender for Cloud Apps risks, compromised identities in Entra ID, alerts from Defender for Identity, and Sentinel incidents. It also covers investigating with agentic AI and embedded Microsoft Security Copilot, handling complex multi-stage, multi-domain and lateral-movement attacks, and managing incidents with case management.
What to understand
Each Defender product owns a domain: Office 365 for email and collaboration, Entra ID for cloud identity, Defender for Identity for on-premises identity, Defender for Cloud Apps for SaaS, and Defender for Cloud for workloads. Defender XDR correlates alerts from all of them into unified incidents. Security Copilot assists investigation with AI-generated summaries and guidance that the analyst still validates.
How it shows up
A threat in a specific area is described, and you must choose the product that investigates it or the response action.
Common confusion
Confusing Entra ID with Defender for Identity. Entra ID covers cloud identity; Defender for Identity covers on-premises Active Directory.
2.2 Respond to alerts and incidents in Microsoft Defender for EndpointDevice timelines, live response, investigation packages, evidence investigation and attack disruption.
What it means
This covers responding to endpoint incidents: investigating device timelines, performing device actions including live response and collecting investigation packages, performing evidence and entity investigation, and investigating and remediating incidents identified by automatic attack disruption.
What to understand
The device timeline shows the sequence of events on an endpoint for investigation. Live response gives a remote command shell to investigate and remediate a device. Collecting an investigation package gathers forensic data. Device actions include isolating a device to contain it, and attack disruption can contain active attacks automatically.
How it shows up
An endpoint incident is described, and you must choose the response action, such as device isolation, live response or collecting an investigation package.
Common confusion
Confusing device isolation with live response. Isolation contains the device; live response gives a remote shell to investigate and act.
2.3 Investigate Microsoft 365 activities to identify threatsPurview Audit, Content search in eDiscovery and Microsoft Graph activity logs.
What it means
This covers investigating Microsoft 365 activity using Purview Audit to review logged user and admin actions, Content search in Purview eDiscovery to find relevant content, and Microsoft Graph activity logs to investigate API-level activity.
What to understand
Purview Audit records a wide range of Microsoft 365 activities and is the primary source for who did what and when. Content search locates content across Microsoft 365 for investigation. Graph activity logs capture Microsoft Graph API requests, useful for investigating application and automated activity.
How it shows up
An investigation need in Microsoft 365 is described, and you must choose Purview Audit, Content search or Graph activity logs.
Common confusion
Confusing Purview Audit with Content search. Audit records activities; Content search finds content.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Defender product scope

    Each Defender product owns a domain: Office 365 for email, Entra ID for cloud identity, Defender for Identity for on-premises identity, Cloud Apps for SaaS, Defender for Cloud for workloads.

    Remember
    Match the threat to the product that owns that domain.
    Tested as
    Product selection questions.
    Trap
    Choosing the wrong Defender product for the threat type.

  • Entra ID vs. Defender for Identity

    Entra ID covers cloud identity; Defender for Identity covers on-premises Active Directory.

    Remember
    On-premises lateral movement is a Defender for Identity signal.
    Tested as
    Identity threat questions.
    Trap
    Using Entra ID for on-premises identity threats.

  • Unified Defender XDR incidents

    Defender XDR correlates alerts from all products into one incident.

    Remember
    Investigate the correlated incident, not isolated alerts.
    Tested as
    Incident workflow questions.
    Trap
    Treating related alerts as separate incidents.

  • Device isolation

    A Defender for Endpoint action that cuts a device off the network to contain it.

    Remember
    It contains the device while allowing Defender communication.
    Tested as
    Response action questions.
    Trap
    Confusing it with live response.

  • Live response

    A remote command shell to investigate and remediate an endpoint.

    Remember
    It lets analysts run commands and collect artifacts remotely.
    Tested as
    Response action questions.
    Trap
    Confusing it with isolation.

  • Investigation package

    A collection of forensic data gathered from a device.

    Remember
    Used for deeper offline analysis.
    Tested as
    Endpoint investigation questions.
    Trap
    Confusing it with the device timeline.

  • Device timeline

    A chronological view of events on an endpoint.

    Remember
    It shows the sequence of activity for investigation.
    Tested as
    Endpoint investigation questions.
    Trap
    Expecting it to take remediation actions.

  • Embedded Security Copilot

    Agentic AI that assists investigation with summaries and guidance inside Defender XDR.

    Remember
    Its output supports the analyst but must be validated.
    Tested as
    AI investigation questions.
    Trap
    Treating Copilot output as authoritative.

  • Automatic attack disruption

    Contains an active, high-confidence attack automatically across Defender XDR.

    Remember
    It limits spread during the incident, not just after.
    Tested as
    Response questions.
    Trap
    Confusing it with automated investigation and response.

  • Purview Audit vs. Content search

    Audit records activities; Content search finds content across Microsoft 365.

    Remember
    Use Audit for who did what, Content search to locate content.
    Tested as
    Microsoft 365 investigation questions.
    Trap
    Using the wrong tool for the investigation goal.

  • Case management

    Managing security incidents as cases within the portal.

    Remember
    It tracks investigation and response for an incident.
    Tested as
    Incident management questions.
    Trap
    Overlooking documentation and tracking.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Which Defender product owns the threat

ConceptMeaningKey differenceCommon trap
Defender for Office 365 Email and collaboration threats Phishing, malicious links and attachments Using it for identity threats
Entra ID / Defender for Identity Cloud identity / on-premises identity Entra ID for cloud, Defender for Identity for on-premises AD Swapping the two
Defender for Cloud Apps SaaS application risks Shadow IT and cloud app governance Confusing it with Defender for Cloud
Defender for Cloud Cloud workload protections Servers, containers and cloud resources Confusing it with Defender for Cloud Apps

Device isolation vs. live response vs. investigation package

ConceptMeaningKey differenceCommon trap
Device isolation Cuts the device off the network Contains the threat Expecting it to let you investigate interactively
Live response Remote command shell on the device Investigate and remediate interactively Confusing it with isolation
Investigation package Collected forensic data For offline analysis Confusing it with the timeline

Purview Audit vs. Content search vs. Graph activity logs

ConceptMeaningKey differenceCommon trap
Purview Audit Records user and admin activities Who did what and when Using it to find content
Content search Finds content across Microsoft 365 Locates relevant data Using it for activity history
Graph activity logs Records Microsoft Graph API activity API-level and application activity Overlooking it for automated activity

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Entra ID for on-premises

    What candidates pick
    Investigate on-premises lateral movement in Entra ID.
    Why it looks right
    Entra ID handles identity.
    Why it's wrong
    Entra ID covers cloud identity. On-premises Active Directory identity threats are Defender for Identity.

    Clue to watch for The activity is in on-premises Active Directory or on domain controllers.

  2. Cloud Apps is Cloud

    What candidates pick
    Use Defender for Cloud to investigate a risky SaaS application.
    Why it looks right
    The names are similar.
    Why it's wrong
    Defender for Cloud Apps governs SaaS apps; Defender for Cloud protects cloud workloads such as servers and containers.

    Clue to watch for The threat is a SaaS app versus a cloud workload.

  3. Isolate to investigate

    What candidates pick
    Isolate a device when the goal is to run commands and collect artifacts on it.
    Why it looks right
    Isolation is a strong response.
    Why it's wrong
    Isolation contains the device. Interactive investigation and remediation use live response.

    Clue to watch for The analyst needs to run commands or collect files from the device.

  4. Audit to find content

    What candidates pick
    Use Purview Audit to locate specific documents or emails.
    Why it looks right
    Audit covers Microsoft 365.
    Why it's wrong
    Audit records activities. Finding content across Microsoft 365 uses Content search in eDiscovery.

    Clue to watch for The goal is to locate content rather than review actions.

  5. Copilot is authoritative

    What candidates pick
    Act on a Security Copilot summary without verifying it.
    Why it looks right
    The AI produced a clear conclusion.
    Why it's wrong
    Agentic AI assists the analyst, but its output must be validated against the evidence.

    Clue to watch for The question asks about relying on AI-generated conclusions.

  6. Alerts not incidents

    What candidates pick
    Investigate several related alerts as separate events.
    Why it looks right
    Each alert looks distinct.
    Why it's wrong
    Defender XDR correlates related alerts into one incident, which should be investigated as a whole.

    Clue to watch for The alerts span multiple products but one attack.

Answer framework

For any Domain 2 incident scenario, use these steps before choosing an answer.

  1. Identify the domain of the threat, whether email, cloud identity, on-premises identity, endpoint, SaaS or a cloud workload, and choose the Defender product that owns it.
  2. Investigate the correlated Defender XDR incident as a whole rather than treating related alerts as separate events.
  3. For endpoints, choose the right action: device isolation to contain, live response to investigate interactively, or an investigation package for forensics.
  4. For Microsoft 365, choose Purview Audit for activity history, Content search for locating content, or Graph activity logs for API-level activity.
  5. Use agentic AI and Security Copilot to assist, but validate its output, and record the incident through case management.

Practice question

An analyst must investigate a compromised identity showing suspicious authentication and lateral movement across on-premises domain controllers. Which Microsoft product is the primary tool for investigating this threat?

Want more like this? The SC-200 practice test has questions for every domain.

Checklist

0 of 11

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Start by building a clear map of the Microsoft security products and the domain each owns, because most questions in this group turn on choosing the right product. Drill the pairs candidates confuse: Entra ID versus Defender for Identity, and Defender for Cloud Apps versus Defender for Cloud.

Next, learn the unified Defender XDR incident experience, so you investigate a correlated incident rather than isolated alerts. Then study the Defender for Endpoint response actions in detail: device isolation, live response, investigation packages and timelines, and when each applies.

Then cover the Microsoft 365 investigation tools, keeping Purview Audit, Content search and Graph activity logs distinct. Give some attention to the newer agentic AI and Security Copilot content, remembering that its output assists but is validated.

Hands-on time in a Defender XDR trial, walking an incident from alert to remediation, makes this group far easier. Afterwards, move to group 3, threat hunting, which proactively searches the same data.

FAQ

How much of SC-200 is this functional group?

Respond to security incidents is 35 to 40% of the exam, the second-largest group.

What is the difference between Entra ID and Defender for Identity?

Entra ID (with Identity Protection) covers cloud identity threats. Microsoft Defender for Identity covers on-premises Active Directory identity threats such as lateral movement.

What is the difference between Defender for Cloud Apps and Defender for Cloud?

Defender for Cloud Apps governs SaaS application use and risk. Microsoft Defender for Cloud protects cloud workloads such as servers, containers and cloud resources.

When should I use live response versus device isolation?

Use device isolation to contain a device by cutting it off the network. Use live response to open a remote shell and investigate or remediate interactively.

How does Defender XDR handle related alerts?

It correlates alerts from across its products into a single incident, which the analyst investigates as a whole rather than as separate events.

How is Security Copilot used in incident response?

Embedded agentic AI assists investigation with summaries and guidance inside Defender XDR, but the analyst validates its output against the evidence.

How does this group connect to the rest of the exam?

It responds to the detections configured in group 1 and shares data with the proactive threat hunting in group 3.

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 2 knowledge

You have covered investigating and remediating incidents across Defender XDR, Defender for Endpoint and Microsoft 365. Test whether you can pick the right product and action under exam conditions.

Take the SC-200 practice test Check your SC-200 readiness

Keep going