Question 780
At the Northport university IT office, analysts close incidents without documenting response evidence or status in the unified portal. Which ongoing control best prevents this issue from recurring?
Explanation
Correct Answer
This control works beyond the initial remediation because it requires the team to review reopened and unclassified incidents during shift handovers. This result addresses the stated challenge at the Northport university IT office.
Incorrect Answers
That routine supports defender for endpoint device timeline, but the relevant ongoing risk requires the team to review reopened and unclassified incidents during shift handovers. For the Northport university IT office, the direct corrective action is to use the Defender portal incident workflow to record investigation findings and resolution.
The suggested review does not track the condition behind the incident. Sustained improvement requires the team to review reopened and unclassified incidents during shift handovers. For the Northport university IT office, the direct corrective action is to use the Defender portal incident workflow to record investigation findings and resolution.
Review subscription coverage when new workloads are deployed is not the primary recurring safeguard for this problem. The team should review reopened and unclassified incidents during shift handovers. For the Northport university IT office, the direct corrective action is to use the Defender portal incident workflow to record investigation findings and resolution.