SC-200 Microsoft Defender for Endpoint 2

Question 1

What query language is used for Advanced Hunting in Microsoft Defender for Endpoint?

Accepted Answer

Kusto Query Language (KQL)

Answer

Advanced Hunting uses Kusto Query Language (KQL), the same language used across Microsoft's security and monitoring platform including Microsoft Sentinel and Azure Monitor Logs.

Question 2

Which Advanced Hunting table in Microsoft Defender for Endpoint contains information about process creation events and associated command-line arguments?

Accepted Answer

DeviceProcessEvents

Answer

The DeviceProcessEvents table stores data about process creation events, including process names, command-line arguments, parent process information, and file hashes, making it essential for detecting malicious process execution.

Question 3

What is 'Threat and Vulnerability Management' (TVM) in Microsoft Defender for Endpoint?

Accepted Answer

A built-in capability that continuously discovers, prioritizes, and helps remediate endpoint vulnerabilities and misconfigurations

Answer

TVM is a built-in Defender for Endpoint module that continuously discovers software vulnerabilities and security misconfigurations across managed devices, prioritizing them by risk to guide remediation efforts.

Question 4

How does Microsoft Defender for Endpoint use custom 'Indicators of Compromise' (IoCs)?

Accepted Answer

Custom IoCs allow security teams to block or allow specific file hashes, IP addresses, URLs, and domains

Answer

Microsoft Defender for Endpoint allows security teams to create custom IoCs for file hashes, IP addresses, URLs, and domains to explicitly block, allow, or alert on matching activity, supplementing automated detections with threat intelligence.

Question 5

What is the purpose of 'Network Protection' in Microsoft Defender for Endpoint?

Accepted Answer

To prevent devices from connecting to malicious domains and IP addresses from any application

Answer

Network Protection extends Microsoft Defender SmartScreen beyond the browser by blocking connections to malicious domains, IP addresses, and URLs from any application on the device at the OS network level.

(SC-200) Microsoft Security Operations Analyst Practice Test

(SC-200) Microsoft Security Operations Analyst Practice Test

SC-200 Microsoft Defender for Endpoint 2