Respond to alerts and incidents in Microsoft Defender XDR
11 practice questions under this official exam objective (SC-200), each with the answer key, an option-by-option explanation and instant feedback.
Questions under this objective
11 total · page 1 of 1Detect Data Theft by Departing Users with Insider Risk Management
This question tests knowledge of Insider Risk Management in Microsoft Purview. The correct answer is an insider risk policy, which is designed to dete
Least-privilege roles for Microsoft 365 Defender action approvals
This SC-200 scenario tests which roles let a security analyst use the Microsoft 365 security center and approve or reject Defender for Endpoint remedi
Using the Evidence and Response tab to see all entities affected by a Defender XDR inciden
To identify all entities affected by a Microsoft Defender XDR incident, use the Evidence and Response tab, which aggregates every related entity (devi
Containing a Defender for Identity pass-the-ticket alert by quarantining only the affected
A Defender for Identity 'Suspected identity theft (pass-the-ticket)' alert on Device1 means a forged Kerberos ticket resides on that device; quarantin
Responding to Compromised Linux Endpoints in Microsoft Defender XDR
Learn how to respond to security incidents involving compromised Linux endpoints in Microsoft Defender XDR by using the Isolate device action to block
Identifying the incident remediation action that requires manual action despite full autom
With AIR in Defender for Office 365 and full automation in Defender for Endpoint, email remediation (soft/hard delete) and many device actions are aut
Querying IdentityLogonEvents to hunt LDAP simple binds to AD DS domain controllers
To hunt LDAP simple binds to on-premises Active Directory Domain Services domain controllers in Defender for Identity advanced hunting, query the Iden
Submitting only PE files for Microsoft Defender XDR deep analysis
In Microsoft Defender XDR deep analysis, only portable executable (PE) files (.exe and .dll) are supported; the PowerShell script File1.ps1 is not a P
Using a Conditional Access policy to revoke or force re-authentication of a compromised Ou
To ensure a compromised user's Outlook on the web session token can be revoked, configure a Microsoft Entra Conditional Access policy (for example, ba
Using Defender XDR alert tuning rules to hide or resolve alerts and reduce alert fatigue
To tune alerts from a commonly used executable that causes alert fatigue in Defender XDR, an alert tuning rule can hide the alerts (remove them from t
Collecting Forensic Data in Microsoft Defender XDR
Learn how to efficiently collect forensic data from Windows devices in Microsoft Defender XDR using the Investigation Package feature to capture proce