Microsoft Security, Compliance, and Identity Fundamentals SC-900 Practice Question

Microsoft Defender XDR continuously collects signals from Microsoft 365 services such as Defender for Endpoint, Defender for Office 365, and Defender for Identity. When multiple alerts stem from the same underlying attack, the service automatically correlates them and groups them into a single incident. This consolidated view lets analysts focus on the full scope of a threat instead of triaging each alert separately. The other options describe abilities that belong to different Azure or Microsoft security and compliance offerings, not to Defender XDR's core threat-protection capabilities.