A security team wants to enable the custom data collection feature in Microsoft Defender for Endpoint to collect specific registry events from a subset of devices. They have already created a custom data collection rule. What else must they do to ensure the rule applies only to the intended devices?

Enable the custom data collection rule globally and then manually disable it on devices that should not collect data.

Assign the custom data collection rule to a device group that contains only the intended devices.

Create a separate tenant for the intended devices and apply the rule there.

Use a PowerShell script to deploy the rule to each device individually.

Your organization uses Microsoft Sentinel. The SOC wants to automatically close low-impact phishing incidents that are confirmed by a playbook, but only when the incident was created by a specific analytics rule. The playbook already exists and tags incidents with a custom property. What should you configure to meet the requirement with the least administrative effort?

Create a separate playbook that runs on a schedule and closes all incidents older than 24 hours.

Modify the analytics rule to add a 'Close incident' action directly in the rule's incident settings.

Create an automation rule that triggers when incidents are created, filters by the analytics rule name and the custom property, and runs the playbook to close the incident.

Use a Logic Apps trigger that monitors the Microsoft Sentinel API and closes incidents manually.

What is the purpose of automatic attack disruption in Microsoft Defender XDR?

To configure attack surface reduction rules

To automatically contain active attacks in real time

To provide email notifications for incidents

To collect additional telemetry from endpoints

A company wants to collect additional telemetry from their Windows devices, such as custom registry keys and specific event logs, to improve threat detection. They are using Microsoft Defender for Endpoint. What should they configure?

Deploy a custom script via Intune to collect the data.

Configure a data collection rule in Microsoft Sentinel.

Use the 'Advanced features' settings to enable additional telemetry.

Enable the 'Custom data collection' feature and specify the registry keys and event logs.

Microsoft Certified:Security Operations Analyst Associate

Domain 1Objective 1

Configure Automation for Microsoft Defender XDR and Microsoft Sentinel SC-200 Practice Questions (Page 1)

Part of the Manage a security operations environment domain, which accounts for 40–45% of the SC-200 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~16–29 in this domain), expect 4–7 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

11concepts

40–45%of the exam

Questions 1–5

1application · medium
A security team wants to enable the custom data collection feature in Microsoft Defender for Endpoint to collect specific registry events from a subset of devices. They have already created a custom data collection rule. What else must they do to ensure the rule applies only to the intended devices?
Select an answer first
2application · medium
Your organization uses Microsoft Sentinel. The SOC wants to automatically close low-impact phishing incidents that are confirmed by a playbook, but only when the incident was created by a specific analytics rule. The playbook already exists and tags incidents with a custom property. What should you configure to meet the requirement with the least administrative effort?
Select an answer first
3foundation · easy
What is the purpose of automatic attack disruption in Microsoft Defender XDR?
Select an answer first
4application · medium
A company wants to collect additional telemetry from their Windows devices, such as custom registry keys and specific event logs, to improve threat detection. They are using Microsoft Defender for Endpoint. What should they configure?
Select an answer first
5foundation · easy
In Microsoft Defender for Endpoint, which security policy setting allows you to control the enforcement mode of ASR rules?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-200

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-200” is a trademark of its owner, used for identification only.

Configure Automation for Microsoft Defender XDR and Microsoft Sentinel SC-200 Practice Questions (Page 1)

Questions 1–5

What is the purpose of automatic attack disruption in Microsoft Defender XDR?

A company wants to collect additional telemetry from their Windows devices, such as custom registry keys and specific event logs, to improve threat detection. They are using Microsoft Defender for Endpoint. What should they configure?

In Microsoft Defender for Endpoint, which security policy setting allows you to control the enforcement mode of ASR rules?

Keep studying — Manage a security operations environment