SC-200 Microsoft Defender for Endpoint 3

Question 1

How far back can Advanced Hunting queries search for raw event data in Microsoft Defender for Endpoint?

Accepted Answer

30 days

Answer

7 days

Answer

14 days

Answer

90 days

Question 2

Which Attack Surface Reduction (ASR) rule is specifically designed to prevent credential theft attacks targeting the Windows Local Security Authority Subsystem?

Accepted Answer

Block credential stealing from the Windows local security authority subsystem (lsass.exe)

Answer

Block executable files from running unless they meet a prevalence, age, or trusted list criterion

Answer

Block Office applications from creating executable content

Answer

Block untrusted and unsigned processes that run from USB

Question 3

What is the purpose of 'Custom Detections' in Microsoft Defender for Endpoint?

Accepted Answer

To create alert rules based on Advanced Hunting KQL queries that trigger on matching events

Answer

To customize the visual theme and layout of the security portal

Answer

To define custom severity labels for existing built-in alert types

Answer

To filter and suppress false positive alerts from the incident queue

Question 4

What does 'Controlled Folder Access' in Microsoft Defender for Endpoint primarily protect against?

Accepted Answer

Ransomware and malware that attempt to encrypt or modify files in protected directories

Answer

Phishing attacks delivered through email attachments

Answer

Man-in-the-middle attacks on network communications

Answer

Brute force attacks against local Windows authentication

Question 5

What is a 'Device Group' in Microsoft Defender for Endpoint primarily used for?

Accepted Answer

Organizing devices for role-based access control and applying differentiated configurations

Answer

Grouping user accounts for identity and access management policies

Answer

Clustering network devices for traffic flow analysis

Answer

Tagging devices for asset inventory and cost allocation

Question 6

Which native Microsoft Sentinel connector ingests alerts and incidents from Microsoft Defender for Endpoint into Sentinel for centralized SIEM analysis?

Accepted Answer

Microsoft 365 Defender connector

Answer

Azure Monitor Diagnostic Settings connector

Answer

CEF/Syslog over Log Analytics Agent connector

Answer

Azure Event Hubs streaming connector

Question 7

When a security analyst uses 'Restrict App Execution' on a device in Microsoft Defender for Endpoint, what is the result?

Accepted Answer

Only applications signed by Microsoft are allowed to run on the device

Answer

All applications are permanently uninstalled from the device

Answer

The device is completely isolated from the corporate network

Answer

All user-initiated application launches are blocked until the restriction is lifted