Free Preparation Discussions
MENU
Microsoft SC-200 Exam Questions
Free Microsoft SC-200 Exam Actual Questions
Note: Premium Questions for SC-200 were last updated On Oct. 29, 2026 (see below)
You have a Microsoft 365 subscription that uses Microsoft Defender XDR. The subscription contains 500 Windows 11 devices that are onboarded to Microsoft Defender for Endpoint You discover unauthorized changes to the membership of the Administrators group on the devices. You need to configure a solution that meets the following requirements:
* Every hour, check the Administrators group membership of each endpoint.
* When a change to the Administrators group membership is detected, create an incident in Microsoft Defender XDR.
What should you create first?
You have a Microsoft 365 subscription that uses Microsoft Defender XDR.
You are investigating an incident.
You need to review the incident tasks that were performed. The solution must include a query that will display the incidents in a workbook, and then display the tasks of each incident in another grid.
Which table should you target in the query?
In Microsoft Defender XDR (and Microsoft Sentinel), the table that stores information about incidents---including their status, severity, classification, associated alerts, and related tasks---is the SecurityIncident table. This table is part of the advanced hunting schema and Microsoft Sentinel workspace schema when Microsoft Defender XDR incidents are synchronized to Log Analytics.
Microsoft's documentation for the SecurityIncident table describes it as:
''Contains information about incidents generated in Microsoft Sentinel or Microsoft 365 Defender, including incident title, ID, description, severity, provider, owner, and related entities. It can be used to track and analyze incidents and their associated alerts or tasks.''
When you need to display incidents in a workbook and also visualize incident tasks or actions performed under each one, you must query the SecurityIncident table. From there, you can join or expand incident details such as tasks or alert relationships for deeper investigation.
Other options are not suitable for this requirement:
SecurityEvent -- contains raw Windows event log data (e.g., logon events, process creation) and is unrelated to incident-level information.
SentinelAudit -- contains audit trail records of changes and administrative actions within Sentinel (e.g., who modified analytics rules), not incidents or tasks.
SecurityAlert -- contains individual alerts that may belong to incidents, but it doesn't include incident tasks or groupings by incident.
Therefore, to query incident information and related tasks in a workbook, the correct target table is SecurityIncident.
You have a Microsoft 365 subscription.
You have 1,000 Windows devices that have a third-party antivirus product installed and Microsoft Defender Antivirus in passive mode. You need to ensure that the devices are protected from malicious artifacts that were undetected by the third-party antivirus product Solution: You enable automated investigation and response (AIR).
Does this meet the goal?
Automated Investigation and Response (AIR) automates investigation and remediation actions for alerts that Defender already detects: it triages alerts, runs investigation playbooks, and can execute remediation (quarantine files, terminate processes, remove persistence) based on the investigation outcome. AIR is powerful for reducing analyst load and quickly remediating detected threats. However, AIR only runs in response to detections/alerts it receives---if the third-party AV completely misses an artifact and no EDR/behavioral detection generates an alert, AIR will not be triggered. In contrast, EDR in block mode is specifically built to catch post-breach detections that the primary AV missed and to remediate them. Therefore, enabling AIR alone does not guarantee protection from artifacts missed by the third-party antivirus; AIR helps remediate once a detection exists but does not itself create the missed detection coverage that EDR in block mode provides.
You have a Microsoft 365 E5 subscription that contains 500 Windows 11 devices.
You have a Microsoft Defender for Endpoint deployment that has the following settings:
Discovery mode: Basic
Live Response: Disabled
Enable EDR in block mode: Off
Tamper Protection: Off
You need to implement automatic attack disruption in Microsoft Defender XDR.
What should you do?
Microsoft Defender XDR's Automatic attack disruption requires EDR in block mode to be enabled. This feature allows Defender for Endpoint to block or contain malicious activities, even when the primary antivirus engine fails to detect or block them initially.
According to Microsoft Defender documentation, attack disruption relies on real-time EDR response capabilities and EDR in block mode to isolate compromised users or devices automatically. Without EDR in block mode, Defender can only alert --- not stop --- ongoing attacks.
Enabling EDR in block mode integrates the EDR layer with Microsoft Defender Antivirus to automatically contain lateral movement and credential theft activities. While Tamper Protection, Live Response, and Standard Discovery are valuable, they do not directly enable automatic attack disruption.
Correct Answe r: A. Set Enable EDR in block mode to On
You have a Microsoft 365 E5 subscription that uses Microsoft Copilot for Security. You plan to run the following code to create a custom Copilot for Security plugin.
You need to specify a format and complete the code segment. Which format should you use for the
When authoring a custom plugin for Copilot for Security that queries security telemetry and returns structured results, the expected query/target format is Kusto Query Language (KQL). Copilot for Security integrates with Microsoft security data platforms (Microsoft Sentinel/Log Analytics and Defender tables) where investigative and hunting queries are expressed in KQL. Official plugin examples and guidance show the plugin invoking a KQL query against a workspace or a Defender table and returning the results in the plugin response payload. KQL is the language used to interrogate event, alert, and entity tables (for example, DeviceProcessEvents, SecurityAlert, MicrosoftGraphActivityLogs) and is the supported format when a plugin's purpose is to retrieve and return telemetry to Copilot for Security. Other formats listed (API, GPT, SQL) are not the standard query language for Defender/Sentinel data: APIs are endpoints for programmatic access, GPT is a model format, and SQL is not used for Azure Monitor / Sentinel tables. Therefore when the plugin's <target> must specify the query format against security telemetry, KQL is the correct choice.
- Select Question Types you want
- Set your Desired Pass Percentage
- Allocate Time (Hours : Minutes)
- Create Multiple Practice tests with Limited Questions
- Customer Support
Daniel Young
29 days agoRachel Martinez
2 months agoRobert Hall
2 months agoDavid Robinson
3 months agoAshley Lewis
3 months agoDina Ansari
29 days agoAndrew Miller
4 months agoJennifer Taylor
4 months agoEmily Harris
5 months agoRichard Wright
5 months agoKenji Do
1 month agoCarol Evans
6 months agoMelissa Torres
6 months agoDaniel Taylor
6 months agoAmanda Nelson
6 months agoKenneth Martinez
6 months agoKaren Green
6 months agoStephen Hill
5 months agoKattie
7 months agoPansy
7 months agoEun
7 months agoKayleigh
8 months agoAhmed
8 months agoErnest
8 months agoKristofer
8 months agoOretha
9 months agoArleen
9 months agoVincenza
9 months agoWade
9 months agoBlondell
10 months agoPaola
10 months agoAlba
10 months agoLeota
10 months agoLorrie
11 months agoBok
11 months agoJeannetta
11 months agoLuis
11 months agoAndra
12 months agoLing
12 months agoPenney
1 year agoHerminia
1 year agoJoye
1 year agoNadine
1 year agoFreeman
1 year agoGlennis
1 year agoAhmed
1 year agoRuthann
1 year agoRhea
1 year agoLynda
1 year agoNina
1 year agoGayla
2 years agoAnnabelle
2 years agoRoxane
2 years agoPatrick
2 years agoLettie
2 years agoHorace
2 years agoMacy
2 years agoAlishia
2 years agoAdell
2 years agoJennifer
2 years agoLucina
2 years agoAsha
2 years agoRyan
2 years agoMichal
2 years agoLeigha
2 years agoLinsey
2 years agoDell
2 years agoSantos
2 years agoSabra
2 years agoClaudio
2 years agoMila
2 years agoJoni
2 years agoDella
2 years agoMaryann
2 years agoGerald
2 years agoTenesha
2 years agodarrena
2 years agokalasan
2 years ago