SC-200 Microsoft Defender for Endpoint 2 — Questions and Answers
Question 1: What query language is used for Advanced Hunting in Microsoft Defender for Endpoint?
- SQL (Structured Query Language)
- PowerShell Query Language (PSQL)
- Kusto Query Language (KQL) (Correct answer)
- Splunk Processing Language (SPL)
Correct answer: Kusto Query Language (KQL)
Advanced Hunting uses Kusto Query Language (KQL), the same language used across Microsoft's security and monitoring platform including Microsoft Sentinel and Azure Monitor Logs.
Question 2: Which Advanced Hunting table in Microsoft Defender for Endpoint contains information about process creation events and associated command-line arguments?
- DeviceNetworkEvents
- DeviceProcessEvents (Correct answer)
- DeviceLogonEvents
- DeviceFileEvents
Correct answer: DeviceProcessEvents
The DeviceProcessEvents table stores data about process creation events, including process names, command-line arguments, parent process information, and file hashes, making it essential for detecting malicious process execution.
Question 3: What is 'Threat and Vulnerability Management' (TVM) in Microsoft Defender for Endpoint?
- A module for subscribing to external threat intelligence feeds
- A built-in capability that continuously discovers, prioritizes, and helps remediate endpoint vulnerabilities and misconfigurations (Correct answer)
- A third-party integration for running authenticated vulnerability scans
- A manual workflow for reviewing CVEs published in the National Vulnerability Database
Correct answer: A built-in capability that continuously discovers, prioritizes, and helps remediate endpoint vulnerabilities and misconfigurations
TVM is a built-in Defender for Endpoint module that continuously discovers software vulnerabilities and security misconfigurations across managed devices, prioritizing them by risk to guide remediation efforts.
Question 4: How does Microsoft Defender for Endpoint use custom 'Indicators of Compromise' (IoCs)?
- Custom IoCs are used only for reporting dashboards and do not affect detections
- Custom IoCs allow security teams to block or allow specific file hashes, IP addresses, URLs, and domains (Correct answer)
- IoCs are automatically imported from all OSINT threat intelligence feeds
- IoC matching is limited to file hash values only
Correct answer: Custom IoCs allow security teams to block or allow specific file hashes, IP addresses, URLs, and domains
Microsoft Defender for Endpoint allows security teams to create custom IoCs for file hashes, IP addresses, URLs, and domains to explicitly block, allow, or alert on matching activity, supplementing automated detections with threat intelligence.
Question 5: What is the purpose of 'Network Protection' in Microsoft Defender for Endpoint?
- To encrypt all outbound network traffic from managed endpoints
- To prevent devices from connecting to malicious domains and IP addresses from any application (Correct answer)
- To monitor and report on total network bandwidth consumption per device
- To enforce mandatory VPN connections for remote workers
Correct answer: To prevent devices from connecting to malicious domains and IP addresses from any application
Network Protection extends Microsoft Defender SmartScreen beyond the browser by blocking connections to malicious domains, IP addresses, and URLs from any application on the device at the OS network level.
Question 6: Which response action in Microsoft Defender for Endpoint disconnects a compromised device from the network to prevent lateral movement while maintaining the Defender service connection?
- Device Encryption
- Device Isolation (Correct answer)
- Device Wipe
- Restrict App Execution
Correct answer: Device Isolation
Device Isolation cuts off all network communication from the compromised device except for the connection to the Defender for Endpoint service, containing the threat while the device remains available for investigation.
Question 7: What does the 'Exposure Score' in Microsoft Defender for Endpoint's Threat and Vulnerability Management represent?
- The count of active malware infections currently running on endpoints
- An aggregated measure of how exposed the organization is to cyberattacks based on discovered vulnerabilities and misconfigurations (Correct answer)
- The percentage of devices with outdated antivirus signature definitions
- The number of high-severity alerts generated in the past 30 days
Correct answer: An aggregated measure of how exposed the organization is to cyberattacks based on discovered vulnerabilities and misconfigurations
The Exposure Score in TVM is a dynamic metric that quantifies the organization's overall vulnerability to attack based on the vulnerabilities and misconfigurations discovered across all managed devices, helping prioritize remediation efforts.
SC-200 Microsoft Defender for Endpoint 2
What query language is used for Advanced Hunting in Microsoft Defender for Endpoint?