Questions

To make sure you understand the extended detection and response subjects covered in this chapter, why not test yourself with the following questions?

1. Which of the following is a device response action? Choose all that apply:
   1. Isolate device
   2. Run an antivirus scan
   3. Delete the device
   4. Collect investigation package
2. Which of the following describes how an XDR differs from a SIEM solution?
   1. XDR platforms integrate with SaaS platform logs, but SIEM solutions cannot
   2. XDR platforms do not have native response capabilities, but traditional SIEM solutions do
   3. An XDR can be offered as a managed service but a traditional SIEM solution cannot
   4. An XDR also adds the response capability, which a traditional SIEM solution doesn’t provide natively
3. Which of the following is the last stage of incident response, and not one really covered by Microsoft 365 Defender?
   1. Forensics
   2. Automated actions
   3. Recovery