Which Microsoft Defender XDR notification type is used to inform administrators about new threat analytics reports?

Email notifications for incidents

Email notifications for threat analytics

Email notifications for actions

Which of the following is an advanced feature that can be configured in Microsoft Defender for Endpoint?

Threat intelligence integration

In Microsoft Defender for Endpoint, what is the purpose of custom data collection?

To collect additional telemetry from endpoints beyond default data

To replace the default data collection with custom data

To collect data from non-Microsoft devices

To send data to a third-party SIEM

A company has a mix of critical and non-critical devices. They want automated investigation to run at 'Full' for critical devices but at 'Semi' for non-critical devices. They also want to ensure that the security team can override automated actions if needed. What should they configure?

Set the automation level to 'Semi' for all devices and manually run full automation on critical devices.

Use a single device group and set automation to 'Full', then use exclusions for non-critical devices.

Create two device groups: one for critical devices with 'Full' automation, and one for non-critical with 'Semi' automation.

Set the automation level to 'Full' for all devices and rely on the security team to manually revert actions.

Microsoft Certified:Security Operations Analyst Associate

Domain 1Objective 1

Configure Automation for Microsoft Defender XDR and Microsoft Sentinel SC-200 Practice Questions (Page 3)

Part of the Manage a security operations environment domain, which accounts for 40–45% of the SC-200 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~16–29 in this domain), expect 4–7 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

11concepts

40–45%of the exam

Questions 11–15

11foundation · easy
Which Microsoft Defender XDR notification type is used to inform administrators about new threat analytics reports?
Select an answer first
12foundation · easy
In Microsoft Defender XDR, which feature allows you to automatically suppress alerts that match specific criteria, such as a known false positive?
Select an answer first
13foundation · easy
Which of the following is an advanced feature that can be configured in Microsoft Defender for Endpoint?
Select an answer first
14foundation · easy
In Microsoft Defender for Endpoint, what is the purpose of custom data collection?
Select an answer first
15expert · medium
A company has a mix of critical and non-critical devices. They want automated investigation to run at 'Full' for critical devices but at 'Semi' for non-critical devices. They also want to ensure that the security team can override automated actions if needed. What should they configure?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-200

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-200” is a trademark of its owner, used for identification only.