A city SOC wants correlated security incidents that span email, identity, endpoints, and cloud apps instead of siloed alerts. Which Microsoft capability fits that goal?
Select an answer to reveal the explanation.
Short Explanation
Siloed alerts are like four radios that never talk. Defender XDR stitches email, identity, endpoint, and app signals into correlated incidents so analysts see one story. Forms, To Do, and Autopilot solve different municipal problems.
Full Explanation
Microsoft Defender XDR provides cross-domain extended detection and response so a city SOC can correlate security incidents that span email, identity, endpoints, and cloud apps instead of working from siloed alerts. That correlation is the fundamentals value of XDR for municipal security operations: one incident narrative across domains rather than disconnected product queues. MS-900 expects candidates to associate XDR with extended, cross-signal investigation—not with forms or personal task apps.
Microsoft Forms for anonymous citizen surveys is not an XDR correlation platform. Microsoft To Do for personal task lists does not investigate cross-domain incidents. Windows Autopilot for device provisioning profiles enrolls devices and does not replace XDR incident correlation.
An exam caveat is that Defender XDR effectiveness depends on enabling and connecting the relevant Defender workloads; branding alone does not correlate signals that were never collected. Operationally, open an incident in the Microsoft Defender portal that includes related email and endpoint alerts, confirm analysts can pivot across those linked alerts, and use that workflow in SOC training for municipal on-call staff.