Configure detections
6 practice questions under this official exam objective (SC-200), each with the answer key, an option-by-option explanation and instant feedback.
Questions under this objective
6 total · page 1 of 1Identifying Zero-Hour Auto Purge (ZAP) Actions in Defender
This page explains why the Threat Protection Status report in Microsoft Defender for Office 365 is the correct method to identify ZAP email movements,
Counting incidents created when four independent Sentinel analytics rules all fire for one
A Sentinel workspace with four separate Microsoft security analytics rules; when User1's action matches all four, each rule generates its own alert an
Setting a custom detection rule frequency to identify C2 communication within the past 14
A custom detection rule must identify devices that communicated in the past 14 days and minimize identification delay; the Every 24 hours frequency us
Creating a scheduled query rule from a hunting query so detections generate incidents
After a hunting query finds a new MITRE-mapped attack vector, convert it into a scheduled query rule so it runs on a schedule and automatically create
Finding enabled anomaly rules in Sentinel on the Analytics page Anomalies tab
To see which anomaly detection rules are enabled in a Microsoft Sentinel workspace, review the Anomalies tab on the Analytics page, where anomaly rule
Which Devices Support Custom IoCs in Defender for Endpoint?
Custom indicators of compromise in Microsoft Defender for Endpoint are limited to devices that meet the platform and onboarding requirements. In this