MENU
You have the following advanced hunting query in Microsoft 365 Defender.
You need to receive an alert when any process disables System Restore on a device managed by Microsoft Defender during the last 24 hours.
Which two actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
Suggested Answer: A, E
Get Premium SC-200 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
12 comments · newest first
FL
Fletcher
12 months ago
Agreed, the timestamp ordering is a must for accurate alerts!
CH
Chana
1 year ago
Wait, can you really replace DeviceProcessEvents with DeviceNetworkEvents? That sounds off.
FR
Frederica
1 year ago
Not sure about the suppression rule though, seems unnecessary.
JO
Joanna
1 year ago
I think adding DeviceId and ReportId is also important!
EI
Eileen
1 year ago
You definitely need to create a detection rule for this.
DE
Dell
1 year ago
I practiced a similar question where we had to modify a query. Adding | order by Timestamp might help us focus on the last 24 hours, right?
ST
Steffanie
1 year ago
I'm not entirely sure, but I remember something about suppression rules being used to filter out noise. Is that relevant here?
DE
Deandrea
1 year ago
I think we need to create a detection rule to catch when System Restore is disabled. That seems like a key step.
BO
Bong
1 year ago
I feel like replacing DeviceProcessEvents with DeviceNetworkEvents doesn't fit this scenario. We need to track process events specifically, not network events.
CA
Carin
1 year ago
Hmm, I'm not sure about this one. I was thinking maybe B. Trending, since that could also show popular products. But Collaborative Filtering makes sense too.
LA
Lacey
1 year ago
I'm pretty confident that Latency is the correct answer here. The question is specifically asking about the symptom, and that seems to fit the best.
VI
Viva
1 year ago
I'm a bit confused by this question. I'm not entirely sure what a "supplier bank header" is or what the mandatory fields would be. I'll have to guess on this one.