Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location US
Mob_nav_barsMENU

Microsoft SC-200 Exam - Topic 10 Question 11 Discussion

You have the following advanced hunting query in Microsoft 365 Defender.You need to receive an alert when any process disables System Restore on a device managed by Microsoft Defender during the last 24 hours.Which two actions should you perform? Each correct answer presents part of the solution.NOTE: Each correct selection is worth one point.
A) Create a detection rule. and E) Add DeviceId and ReportId to the output of the query.
B) Create a suppression rule.
C) Add | order by Timestamp to the query.
D) Replace DeviceProcessEvents with DeviceNetworkEvents.

Microsoft SC-200 Exam - Topic 10 Question 11 Discussion

Actual exam question for Microsoft's SC-200 exam
Question #: 11
Topic #: 10
[All SC-200 Questions]

You have the following advanced hunting query in Microsoft 365 Defender.

You need to receive an alert when any process disables System Restore on a device managed by Microsoft Defender during the last 24 hours.

Which two actions should you perform? Each correct answer presents part of the solution.

NOTE: Each correct selection is worth one point.

Show Suggested Answer Hide Answer
Suggested Answer: A, E

https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/custom-detection- rules

by Glendora at May 06, 2022, 05:40 PM

Limited Time Offer

25%

Off

Get Premium SC-200 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

0/2000 characters
Submit Cancel
Fletcher
7 months ago
Agreed, the timestamp ordering is a must for accurate alerts!
upvoted 0 times
...
Chana
7 months ago
Wait, can you really replace DeviceProcessEvents with DeviceNetworkEvents? That sounds off.
upvoted 0 times
...
Frederica
8 months ago
Not sure about the suppression rule though, seems unnecessary.
upvoted 0 times
...
Joanna
8 months ago
I think adding DeviceId and ReportId is also important!
upvoted 0 times
...
Eileen
8 months ago
You definitely need to create a detection rule for this.
upvoted 0 times
...
Dell
8 months ago
I practiced a similar question where we had to modify a query. Adding | order by Timestamp might help us focus on the last 24 hours, right?
upvoted 0 times
...
Steffanie
8 months ago
I'm not entirely sure, but I remember something about suppression rules being used to filter out noise. Is that relevant here?
upvoted 0 times
...
Deandrea
8 months ago
I think we need to create a detection rule to catch when System Restore is disabled. That seems like a key step.
upvoted 0 times
...
Bong
8 months ago
I feel like replacing DeviceProcessEvents with DeviceNetworkEvents doesn't fit this scenario. We need to track process events specifically, not network events.
upvoted 0 times
...
Carin
8 months ago
Hmm, I'm not sure about this one. I was thinking maybe B. Trending, since that could also show popular products. But Collaborative Filtering makes sense too.
upvoted 0 times
...
Lacey
8 months ago
I'm pretty confident that Latency is the correct answer here. The question is specifically asking about the symptom, and that seems to fit the best.
upvoted 0 times
...
Viva
8 months ago
I'm a bit confused by this question. I'm not entirely sure what a "supplier bank header" is or what the mandatory fields would be. I'll have to guess on this one.
upvoted 0 times
...

Save Cancel