Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location US
Mob_nav_barsMENU

Microsoft Exam SC-200 Topic 2 Question 59 Discussion

Actual exam question for Microsoft's SC-200 exam
Question #: 59
Topic #: 2
[All SC-200 Questions]

You have a Microsoft 365 subscription that uses Microsoft Defender XDR. You need to implement deception rules. The solution must ensure that you can limit the scope of the rules.

What should you create first?

Show Suggested Answer Hide Answer
Suggested Answer: A

A workbook is a data-driven interactive report in Microsoft Sentinel. You can use workbooks to create custom reports based on data from your Azure subscription. Reference: https://docs.microsoft.com/en-us/azure/sentinel/workbooks-overview


by Trinidad at Oct 07, 2023, 01:44 AM

Limited Time Offer

25%

Off

Get Premium SC-200 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel
Reita
17 days ago
The answer is clearly B - device tags. I mean, come on, who doesn't love a good tagging party? Just be careful you don't end up with a bunch of 'Device: Sneaky Hacker' tags, am I right?
upvoted 0 times
...
Aileen
18 days ago
Device groups, device tags, honeytoken entity tags... They're all like a buffet of deception options. But I think D is the way to go. Sensitive entity tags will really add that extra layer of spice to your traps. Just don't want anyone to get too 'sensitive' about it, if you know what I mean.
upvoted 0 times
Rashad
3 days ago
I agree, sensitive entity tags seem like the best choice for implementing deception rules.
upvoted 0 times
...
...
Lorrie
20 days ago
C, all the way! Honeytoken entity tags are where it's at. I bet you can make some real juicy lures with those. Just don't let the bad guys get too sticky-fingered, am I right?
upvoted 0 times
...
Vallie
22 days ago
Ah, gotta go with B on this one. Device tags are the way to go. You can get super specific with your deception traps that way. Although, I do wonder if they have a 'honey-flavored' option.
upvoted 0 times
...
Lilli
1 months ago
Hmm, device groups seem like the logical choice here. I mean, how else are you going to limit the scope of those deception rules? It's like trying to catch a fly with a baseball bat.
upvoted 0 times
Tarra
9 days ago
Yeah, device tags could also be useful for organizing and managing devices in the subscription.
upvoted 0 times
...
Jeanice
20 days ago
I agree, device groups would definitely help in limiting the scope of the deception rules.
upvoted 0 times
...
...
My
2 months ago
I'm not sure, maybe we should consider device tags as well to better organize the devices.
upvoted 0 times
...
Gail
2 months ago
I agree with Jaclyn, honeytoken entity tags would help limit the scope of the deception rules.
upvoted 0 times
...
Jaclyn
2 months ago
I think we should create honeytoken entity tags first.
upvoted 0 times
...

Save Cancel