A county public-health department wants to relate citywide threat intelligence to Defender alerts affecting finance staff. What is the sound fundamentals approach?
Select an answer to reveal the explanation.
Short Explanation
Citywide intel is the briefing; Defender alerts are the desk-level tickets. Put them on the same table and finance incidents suddenly have priority and pattern. Trying to name the actor, auto-isolate devices, or build new rules goes beyond what you need, so you don't get the prioritized picture you'll actually use.
Full Explanation
Threat intelligence provides broader campaign and adversary context; Defender alerts surface tenant-specific activity affecting finance staff. Correlating those inputs helps a county public-health department—and peer municipal finance teams—prioritize incidents, spot related mailbox or endpoint events, and respond with citywide awareness instead of alert-by-alert tunnel vision. Connecting intelligence context to Defender alerts is the sound fundamentals approach.
Fusing finance-staff Defender alerts with citywide threat intelligence to identify specific threat actors fails because attribution goes beyond the fundamentals goal, which is correlating context to prioritize finance-staff incidents rather than definitively naming the adversary. Enriching finance-staff Defender alerts with citywide threat intelligence to automatically isolate affected devices fails because it jumps from correlation to containment, while the sound approach is to use intelligence to better prioritize incidents before taking response actions. Querying finance-staff Defender alerts against citywide threat intelligence to generate new detection rules fails because rule creation is detection engineering rather than relating existing alerts to intelligence to prioritize active finance-staff incidents.
Exam caveat: Describe-level AB-900 items emphasize the value of relating intelligence to protection signals, not mastering every Defender XDR investigation blade. Public-health and finance framing still sits under Microsoft 365 threat concepts. Do not treat alert noise as justification for disabling protection.
Operational check: Select recent Defender alerts tied to finance users, attach available threat-intelligence context (related IOCs, campaign notes), prioritize by business impact, and track closure without deleting the alert stream wholesale. Confirm finance mailboxes remain in the protected Microsoft 365 environment with auditing intact.
Prefer to study offline? Printable PDF study book + test engine ($7.50, unofficial). These questions stay free here.