Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location US
Mob_nav_barsMENU

Microsoft Exam SC-200 Topic 2 Question 59 Discussion

Actual exam question for Microsoft's SC-200 exam
Question #: 59
Topic #: 2
[All SC-200 Questions]

You have a Microsoft 365 subscription that uses Microsoft Defender XDR. You need to implement deception rules. The solution must ensure that you can limit the scope of the rules.

What should you create first?

Show Suggested Answer Hide Answer
Suggested Answer: A

A workbook is a data-driven interactive report in Microsoft Sentinel. You can use workbooks to create custom reports based on data from your Azure subscription. Reference: https://docs.microsoft.com/en-us/azure/sentinel/workbooks-overview


by Trinidad at Oct 07, 2023, 01:44 AM

Limited Time Offer

25%

Off

Get Premium SC-200 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel
Reita
2 months ago
The answer is clearly B - device tags. I mean, come on, who doesn't love a good tagging party? Just be careful you don't end up with a bunch of 'Device: Sneaky Hacker' tags, am I right?
upvoted 0 times
...
Aileen
2 months ago
Device groups, device tags, honeytoken entity tags... They're all like a buffet of deception options. But I think D is the way to go. Sensitive entity tags will really add that extra layer of spice to your traps. Just don't want anyone to get too 'sensitive' about it, if you know what I mean.
upvoted 0 times
Carin
28 days ago
Absolutely, sensitive entity tags will definitely make the deception rules more effective in Microsoft Defender XDR.
upvoted 0 times
...
Alonso
1 months ago
I think it's important to have that extra level of protection, especially when it comes to deception tactics.
upvoted 0 times
...
Reita
1 months ago
Yeah, they will definitely help in limiting the scope of the rules and adding an extra layer of security.
upvoted 0 times
...
Rashad
2 months ago
I agree, sensitive entity tags seem like the best choice for implementing deception rules.
upvoted 0 times
...
...
Lorrie
3 months ago
C, all the way! Honeytoken entity tags are where it's at. I bet you can make some real juicy lures with those. Just don't let the bad guys get too sticky-fingered, am I right?
upvoted 0 times
...
Vallie
3 months ago
Ah, gotta go with B on this one. Device tags are the way to go. You can get super specific with your deception traps that way. Although, I do wonder if they have a 'honey-flavored' option.
upvoted 0 times
Phuong
1 months ago
I'm not sure about a 'honey-flavored' option, but device tags will help limit the scope of the rules.
upvoted 0 times
...
Camellia
2 months ago
Yeah, device tags allow for more specific and targeted deception traps.
upvoted 0 times
...
Olen
2 months ago
I agree, device tags are definitely the way to go for implementing deception rules.
upvoted 0 times
...
...
Lilli
3 months ago
Hmm, device groups seem like the logical choice here. I mean, how else are you going to limit the scope of those deception rules? It's like trying to catch a fly with a baseball bat.
upvoted 0 times
Florinda
2 months ago
I think honeytoken entity tags could be a good option for creating deception rules as well.
upvoted 0 times
...
Tarra
2 months ago
Yeah, device tags could also be useful for organizing and managing devices in the subscription.
upvoted 0 times
...
Jeanice
3 months ago
I agree, device groups would definitely help in limiting the scope of the deception rules.
upvoted 0 times
...
...
My
4 months ago
I'm not sure, maybe we should consider device tags as well to better organize the devices.
upvoted 0 times
...
Gail
4 months ago
I agree with Jaclyn, honeytoken entity tags would help limit the scope of the deception rules.
upvoted 0 times
...
Jaclyn
4 months ago
I think we should create honeytoken entity tags first.
upvoted 0 times
...

Save Cancel