Microsoft MDE-XDR Practice Test

MDE-XDR practice test: what's covered

• Incidents
• Attack story
• Blast radius
• Attack disruption
• Advanced hunting

Free MDE-XDR sample questions

1. A SOC queue shows five endpoint, identity, and mailbox alerts with the same user and timeline. The analyst wants the fastest way to understand the attack story. What should the analyst open first?

   • A. Open the correlated incident and review the attack story before closing individual alerts
   • B. Export each alert title to a spreadsheet and classify them independently
   • C. Disable every account in the tenant before checking affected entities
   • D. Create one manual incident per product so each queue remains separate
   Show answer

   Correct: A. Microsoft Defender XDR incidents aggregate related alerts into one attack story with timelines, tactics, entities, evidence, and automated response logs. Reviewing that incident first preserves cross-workload context. The other choices fragment the story, over-contain without evidence, or add manual work that the correlation engine is designed to reduce.

2. During morning handover, an incident has a high priority score and recommended actions in the summary pane. What is the best first triage step before deep investigation?

   • A. Use the summary pane to confirm priority drivers, impacted assets, related threats, and recommended actions
   • B. Skip the summary pane and immediately mark the incident resolved to reduce queue count
   • C. Delete the lowest-severity alert because it probably created noise
   • D. Start a KQL hunt with no time range to collect every tenant event
   Show answer

   Correct: A. The incident summary pane is intended for initial triage because it exposes priority assessment, incident details, impacted assets, recommendations, and related threats. Closing or deleting without context risks losing active response work, while an unbounded hunt is inefficient and may miss the immediate triage decisions.

3. An alert from Sentinel analytics appears inside the Defender portal incident queue after Sentinel is onboarded. What explains this behavior?

   • A. The Defender portal can correlate onboarded Sentinel data and expose related alerts in unified incidents
   • B. Sentinel alerts must be manually copied into Defender XDR by exporting CSV files
   • C. Defender XDR ignores Sentinel telemetry unless every alert has identical severity
   • D. The alert moved because endpoint protection was disabled on the affected device
   Show answer

   Correct: A. Microsoft documents that when Sentinel is onboarded to the Defender portal, the correlation experience can use raw Sentinel data and show Sentinel-related alerts in unified investigations. Manual CSV copying, identical severity, or disabled endpoint protection are not required explanations and would not provide the same correlation behavior.

4. An incident includes many alerts and the graph is difficult to read. The analyst needs to focus on only high-severity Defender for Endpoint alerts. Which control is most appropriate?

   • A. Apply incident graph filters for severity and service source before reviewing the narrowed entities
   • B. Hide every entity type and then close the incident because the graph is empty
   • C. Remove Defender for Endpoint from the tenant until the incident queue is quiet
   • D. Change all alert severities to low so the incident no longer appears urgent
   Show answer

   Correct: A. The incident graph supports filters such as severity, status, and service sources to simplify large incidents. Filtering focuses the investigation while preserving evidence. Hiding everything, removing workloads, or changing severity to reduce pressure damages investigation quality and does not answer the operational requirement.

5. A lead analyst splits a ransomware incident into tasks for a shift handoff. Which two outcomes should this improve?

   • A. Accountability for investigation and response work across analysts
   • B. Efficiency when multiple responders handle parts of the same incident
   • C. The ability to bypass role-based access controls for urgent cases
   • D. The guarantee that every alert is malicious without validation
   Show answer

   Correct: A and B. Microsoft describes incident tasks as a way to investigate and resolve incidents collaboratively with better accountability and efficiency. Tasks do not bypass RBAC and they do not prove alerts are malicious. Analysts still need classification, evidence review, and appropriate response approval.

Last updated: 2026-10-19

MDE-XDR practice test FAQ

Related practice tests

• Microsoft SC-200 practice test
• Microsoft Sentinel practice test
• Security Copilot SOC analyst practice test
• Defender for Cloud Apps session control practice test
• Microsoft SC-900 practice test
• CySA+ CS0-003 practice test