SC-200 Microsoft Defender for Endpoint 3

Question 1

How far back can Advanced Hunting queries search for raw event data in Microsoft Defender for Endpoint?

Accepted Answer

30 days

Answer

Advanced Hunting in Microsoft Defender for Endpoint allows analysts to query up to 30 days of raw event data to investigate past activity and proactively hunt for threats.

Question 2

Which Attack Surface Reduction (ASR) rule is specifically designed to prevent credential theft attacks targeting the Windows Local Security Authority Subsystem?

Accepted Answer

Block credential stealing from the Windows local security authority subsystem (lsass.exe)

Answer

The ASR rule 'Block credential stealing from the Windows local security authority subsystem (lsass.exe)' prevents credential theft tools like Mimikatz from reading password hashes and tokens stored in LSASS memory.

Question 3

What is the purpose of 'Custom Detections' in Microsoft Defender for Endpoint?

Accepted Answer

To create alert rules based on Advanced Hunting KQL queries that trigger on matching events

Answer

Custom Detections allow analysts to write KQL-based Advanced Hunting queries and schedule them as detection rules that automatically generate alerts or take response actions whenever matching events are found.

Question 4

What does 'Controlled Folder Access' in Microsoft Defender for Endpoint primarily protect against?

Accepted Answer

Ransomware and malware that attempt to encrypt or modify files in protected directories

Answer

Controlled Folder Access prevents unauthorized applications from modifying or deleting files in protected folders, making it a key defense against ransomware that attempts to encrypt user and system files.

Question 5

What is a 'Device Group' in Microsoft Defender for Endpoint primarily used for?

Accepted Answer

Organizing devices for role-based access control and applying differentiated configurations

Answer

Device Groups allow administrators to organize devices into logical collections, assign them to specific RBAC roles so only authorized security personnel can view or manage them, and apply tailored policies and automation rules.

(SC-200) Microsoft Security Operations Analyst Practice Test

(SC-200) Microsoft Security Operations Analyst Practice Test

SC-200 Microsoft Defender for Endpoint 3