SC-200 Microsoft Defender for Endpoint

Question 1

Which portal serves as the unified security console for managing Microsoft Defender for Endpoint?

Accepted Answer

Microsoft 365 Defender portal (security.microsoft.com)

Answer

Azure Portal (portal.azure.com)

Answer

Microsoft Endpoint Manager (endpoint.microsoft.com)

Answer

Microsoft Defender Security Center (legacy securitycenter.windows.com)

Question 2

What is the primary purpose of Attack Surface Reduction (ASR) rules in Microsoft Defender for Endpoint?

Accepted Answer

To block behaviors commonly used by malware before malicious activity occurs

Answer

To encrypt endpoint data at rest

Answer

To monitor network traffic for anomalous patterns

Answer

To generate vulnerability reports for patch management teams

Question 3

In Microsoft Defender for Endpoint, what is the relationship between an 'alert' and an 'incident'?

Accepted Answer

An alert represents a single suspicious event; an incident is a collection of correlated alerts

Answer

Alerts come from third-party tools; incidents originate from Microsoft Defender tools

Answer

Incidents are low-severity findings; alerts are always high-severity

Answer

Alerts require manual investigation; incidents are always auto-remediated

Question 4

What does the 'Live Response' feature in Microsoft Defender for Endpoint enable a security analyst to do?

Accepted Answer

Access a remote shell to investigate and remediate a device in real time

Answer

View a real-time video feed of the endpoint user's screen

Answer

Automatically deploy security patches to a compromised endpoint

Answer

Stream security event logs to a SIEM in real time

Question 5

Which onboarding method is recommended for deploying Microsoft Defender for Endpoint sensors to a large number of Windows enterprise devices managed by Microsoft Endpoint Configuration Manager?

Accepted Answer

Microsoft Endpoint Configuration Manager

Answer

Local script executed on each device individually

Answer

Group Policy Object (GPO) deployment

Answer

Manual download from the Microsoft 365 Defender portal

Question 6

Which Microsoft Defender for Endpoint capability uses behavioral analysis and machine learning to detect advanced threats that evade signature-based antivirus?

Accepted Answer

Endpoint Detection and Response (EDR)

Answer

Next-generation antivirus protection

Answer

Network Protection

Answer

Controlled Folder Access

Question 7

What is the primary function of 'Automated Investigation and Remediation' (AIR) in Microsoft Defender for Endpoint?

Accepted Answer

Automatically investigating alerts and taking remediation actions to reduce analyst workload

Answer

Manually reviewing alerts to identify false positives

Answer

Generating compliance reports for security auditors

Answer

Scheduling periodic vulnerability scans across endpoints