3. Respond to Security Incidents (35–40%)
Phase 2 built the machinery; this phase uses it under pressure. The exam's response domain spans almost every Microsoft security product, but the work follows one rhythm: triage the incident, understand the attack story, act in the product that owns each compromised asset, and gather the evidence that proves the attacker is gone. Sections follow that rhythm. You start in the Defender XDR incident (3.1), respond where attacks most often begin, in email, identity, and cloud apps (3.2), extend to cloud workloads and Sentinel-detected threats (3.3), act on endpoints where attackers execute (3.4), and finish with Microsoft 365 forensics (3.5). For every scenario, ask: which asset is compromised, which product owns it, and which action contains it with the least collateral damage?
Why care: response questions are where the exam rewards judgment rather than recall. Think of a hospital trauma team: stabilize the patient, find the cause, treat it, and only then discharge.
⚠️ Exam Trap: A password reset doesn't stop a stolen session token, isolating a laptop doesn't stop email compromise, and deleting one reported message doesn't remediate a campaign. Match the action to where the attacker actually has access.
