Knowledge Check

1.

You're investigating a high-severity incident in Microsoft Defender portal. Copilot automatically generates an incident summary, but you need more details about the PowerShell script that was executed. What's the most effective next step?

Manually reverse engineer the PowerShell script by reading the command line character by character

Export the script to a file and run it in a sandbox environment to observe behavior

Ask Copilot: 'Analyze the PowerShell script from this incident' or use the 'Analyze script' button

2.

An IT administrator receives 12 help desk tickets about devices failing Intune compliance checks. Using Copilot in the Intune admin center, what's the most efficient approach to troubleshoot these issues?

Ask Copilot: 'Compare a noncompliant device to a compliant device and identify configuration differences'

Use Copilot to get a device summary for one noncompliant device, then manually check the other 11 devices using the same steps

Manually review all compliance policy settings in Intune for each device

3.

After containing a ransomware incident, you need to brief the CISO on what happened. The CISO doesn't have a technical background. Which Copilot capability would be most useful?

Ask Copilot: 'Create an executive summary of this incident for the CISO' to get a non-technical business-impact summary

Generate a detailed technical report with MITRE ATT&CK techniques, IOCs, and registry modifications

Export the raw alert data to Excel and send it to the CISO

4.

Your organization deploys Microsoft Security Copilot for the first time. Analysts are unsure how to get started with incident investigation. What's the best initial approach?

Create custom promptbooks immediately for every possible incident type

Start with automatic incident summaries and built-in prompted questions, then gradually move to custom prompts as team expertise grows

Disable Copilot in the Defender portal and only use the standalone Security Copilot portal

Check your knowledge

Feedback