In Microsoft Defender for Endpoint, what is the purpose of device groups?

To provide email notifications for incidents

To define attack surface reduction rules

To organize devices for management and apply different settings

To collect additional telemetry from endpoints

A security operations center is receiving too many alerts for a known benign application in Microsoft Defender XDR. They want to suppress these alerts while still being notified if the same application is used in a suspicious context. What should they configure?

Increase the severity threshold for the alert to 'High' so only high-severity alerts are generated.

Disable the analytics rule that generates the alert for the application.

Configure an email notification rule to ignore all alerts from the application.

Create a suppression rule for the specific alert and application, but do not suppress correlated alerts that have additional suspicious indicators.

Microsoft Certified:Security Operations Analyst Associate

Domain 1Objective 1

Configure Automation for Microsoft Defender XDR and Microsoft Sentinel SC-200 Practice Questions (Page 4)

Part of the Manage a security operations environment domain, which accounts for 40–45% of the SC-200 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~16–29 in this domain), expect 4–7 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

11concepts

40–45%of the exam

Questions 16–20

16foundation · easy
Which Azure service is commonly used to build playbooks in Microsoft Sentinel?
Select an answer first
17foundation · easy
In Microsoft Defender for Endpoint, what is the purpose of device groups?
Select an answer first
18foundation · easy
Which of the following can be configured as part of custom data collection in Microsoft Defender for Endpoint?
Select an answer first
19application · medium
A security operations center is receiving too many alerts for a known benign application in Microsoft Defender XDR. They want to suppress these alerts while still being notified if the same application is used in a suspicious context. What should they configure?
Select an answer first
20foundation · easy
Which Microsoft Defender XDR capability automatically groups related alerts into a single incident to reduce alert fatigue?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-200

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-200” is a trademark of its owner, used for identification only.

Configure Automation for Microsoft Defender XDR and Microsoft Sentinel SC-200 Practice Questions (Page 4)

Questions 16–20

Which Azure service is commonly used to build playbooks in Microsoft Sentinel?

In Microsoft Defender for Endpoint, what is the purpose of device groups?

Which of the following can be configured as part of custom data collection in Microsoft Defender for Endpoint?

A security operations center is receiving too many alerts for a known benign application in Microsoft Defender XDR. They want to suppress these alerts while still being notified if the same application is used in a suspicious context. What should they configure?

Which Microsoft Defender XDR capability automatically groups related alerts into a single incident to reduce alert fatigue?

Keep studying — Manage a security operations environment