SC-200 Microsoft Defender for Endpoint 2

Question 1

What query language is used for Advanced Hunting in Microsoft Defender for Endpoint?

Accepted Answer

Kusto Query Language (KQL)

Answer

SQL (Structured Query Language)

Answer

PowerShell Query Language (PSQL)

Answer

Splunk Processing Language (SPL)

Question 2

Which Advanced Hunting table in Microsoft Defender for Endpoint contains information about process creation events and associated command-line arguments?

Accepted Answer

DeviceProcessEvents

Answer

DeviceNetworkEvents

Answer

DeviceLogonEvents

Answer

DeviceFileEvents

Question 3

What is 'Threat and Vulnerability Management' (TVM) in Microsoft Defender for Endpoint?

Accepted Answer

A built-in capability that continuously discovers, prioritizes, and helps remediate endpoint vulnerabilities and misconfigurations

Answer

A module for subscribing to external threat intelligence feeds

Answer

A third-party integration for running authenticated vulnerability scans

Answer

A manual workflow for reviewing CVEs published in the National Vulnerability Database

Question 4

How does Microsoft Defender for Endpoint use custom 'Indicators of Compromise' (IoCs)?

Accepted Answer

Custom IoCs allow security teams to block or allow specific file hashes, IP addresses, URLs, and domains

Answer

Custom IoCs are used only for reporting dashboards and do not affect detections

Answer

IoCs are automatically imported from all OSINT threat intelligence feeds

Answer

IoC matching is limited to file hash values only

Question 5

What is the purpose of 'Network Protection' in Microsoft Defender for Endpoint?

Accepted Answer

To prevent devices from connecting to malicious domains and IP addresses from any application

Answer

To encrypt all outbound network traffic from managed endpoints

Answer

To monitor and report on total network bandwidth consumption per device

Answer

To enforce mandatory VPN connections for remote workers

Question 6

Which response action in Microsoft Defender for Endpoint disconnects a compromised device from the network to prevent lateral movement while maintaining the Defender service connection?

Accepted Answer

Device Isolation

Answer

Device Encryption

Answer

Device Wipe

Answer

Restrict App Execution

Question 7

What does the 'Exposure Score' in Microsoft Defender for Endpoint's Threat and Vulnerability Management represent?

Accepted Answer

An aggregated measure of how exposed the organization is to cyberattacks based on discovered vulnerabilities and misconfigurations

Answer

The count of active malware infections currently running on endpoints

Answer

The percentage of devices with outdated antivirus signature definitions

Answer

The number of high-severity alerts generated in the past 30 days