Respond to alerts and incidents in Microsoft Defender for Endpoint
13 practice questions under this official exam objective (SC-200), each with the answer key, an option-by-option explanation and instant feedback.
Questions under this objective
13 total · page 1 of 1Suppressing False Positive Alerts in Microsoft Defender for Endpoint
This question tests the correct procedure for managing false positive alerts in Microsoft Defender for Endpoint by hiding them and creating scoped sup
Least-privilege roles for Microsoft 365 Defender action approvals
This SC-200 scenario tests which roles let a security analyst use the Microsoft 365 security center and approve or reject Defender for Endpoint remedi
Identifying Zero-Hour Auto Purge (ZAP) Actions in Defender
This page explains why the Threat Protection Status report in Microsoft Defender for Office 365 is the correct method to identify ZAP email movements,
Minimize Administrative Effort for Process and Network Data in Microsoft Defender
Learn how to efficiently retrieve process and network connection data from a Windows 11 device using Microsoft Defender by collecting an investigation
Escalating Alerts in Azure Sentinel via Incident Assignment
Learn how to properly escalate specific alerts within an Azure Sentinel incident by assigning the incident to another administrator for focused invest
Manual Remediation for Malware-Infected Emails in Defender XDR
Learn which remediation action requires manual intervention in a Microsoft 365 E5 environment with AIR and MDE full automation enabled. The correct an
Enforcing MFA for Remote Workers Using Named Locations
Learn how to use Named Locations in Microsoft Entra ID Conditional Access to exempt trusted office IPs and enforce MFA for all remote users effectivel
Collecting a Defender for Endpoint investigation package to get network, process, and logi
To gather active network connections, running processes, and login history from a macOS device with least administrative effort, collect the Defender
Reviewing Prefetch files in the investigation package to find first and last execution tim
After collecting a Defender for Endpoint investigation package, you need the first and last execution time of File1.exe; the Prefetch files in the pac
Collecting a Defender for Endpoint investigation package via CLI live response only on mac
You start advanced live response sessions and must collect the investigation package by using CLI advanced commands; the Collect command is supported
Configuring Automated Investigation Packages in Microsoft Defender for Endpoint
Learn how to configure Microsoft Defender for Endpoint's Automated Alert Response to automatically collect investigation packages when malware is dete
Uploading a signed PowerShell script to the live response library before running it
To run a digitally signed PowerShell script in a Defender for Endpoint live response session, you must first upload the script to the live response li
Validate ASR Policy Impact Using Troubleshooting Mode
Learn how to use Troubleshooting mode in Microsoft Defender for Endpoint to diagnose whether an Attack Surface Reduction rule is blocking legitimate a