MENU
You have a Microsoft 365 subscription that uses Microsoft Defender for Endpoint.
All the devices in your organization are onboarded to Microsoft Defender for Endpoint.
You need to ensure that an alert is generated if malicious activity was detected on a device during the last 24 hours.
What should you do?
Suggested Answer: C
Get Premium MS-102 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
17 comments · newest first
SH
Shala
1 month ago
C is definitely the way to go for alerts.
KI
Kindra
1 month ago
Exactly, we need to detect, not suppress.
KA
Katlyn
1 month ago
Suppression rule in B seems unnecessary.
FL
Florencia
2 months ago
C gives you direct control over detections.
LA
Laurel
2 months ago
I agree, DLP policy won't help with alerts.
WI
Willodean
2 months ago
I feel like D is not relevant here.
GE
Gertude
2 months ago
Yeah, creating a query makes sense.
MA
Marvel
2 months ago
I think option C is the best choice.
SH
Shawnee
3 months ago
I agree, C makes the most sense for detecting malicious activity.
RO
Ronny
3 months ago
Wait, can you really generate alerts from Advanced hunting? Sounds cool!
AD
Adelle
3 months ago
Not sure about that, DLP policies don’t seem relevant here.
RU
Ruth
3 months ago
I think option C is definitely the way to go.
AL
Alaine
3 months ago
You need to use Advanced hunting for that!
GL
Glory
3 months ago
The DLP policy option seems off for this scenario; I don't think it relates to detecting malicious activity directly.
AL
Alline
4 months ago
I feel like creating a detection rule is the right approach, but I can't recall the exact steps to do that in Advanced hunting.
AN
Antonio
4 months ago
I remember practicing with suppression rules, but I don't think that's what we need here since we want to generate an alert.
GI
Giovanna
4 months ago
I think we might need to use Advanced hunting for this one, but I'm not entirely sure how to set up the query correctly.