What is the primary purpose of attack surface reduction (ASR) rules in Microsoft Defender for Endpoint?

To collect additional telemetry from endpoints

To reduce the attack surface by blocking certain behaviors

To provide email notifications for incidents

To automatically remediate detected threats

In Microsoft Defender for Endpoint, which advanced feature enables the collection of additional raw data from devices for deeper analysis?

Threat intelligence integration

A security team wants to ensure that only the 'Security Admins' group can view and manage incidents for a specific set of servers. They also want automated investigation to run at full automation for those servers. What should they configure?

Use a conditional access policy to restrict access to the servers.

Configure the servers' security policy to allow only Security Admins.

Create a role group in Microsoft Entra ID and assign it to the servers.

Create a device group, assign the Security Admins group with appropriate permissions, and set the automation level to 'Full'.

Which of the following can be controlled by device group permissions in Microsoft Defender for Endpoint?

Access to security recommendations

Microsoft Certified:Security Operations Analyst Associate

Domain 1Objective 1

Configure Automation for Microsoft Defender XDR and Microsoft Sentinel SC-200 Practice Questions (Page 5)

Part of the Manage a security operations environment domain, which accounts for 40–45% of the SC-200 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~16–29 in this domain), expect 4–7 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

11concepts

40–45%of the exam

Questions 21–25

21foundation · easy
What is the primary purpose of attack surface reduction (ASR) rules in Microsoft Defender for Endpoint?
Select an answer first
22foundation · easy
In Microsoft Defender for Endpoint, which advanced feature enables the collection of additional raw data from devices for deeper analysis?
Select an answer first
23foundation · easy
Which setting controls whether automated investigation actions are taken automatically or require approval in Microsoft Defender XDR?
Select an answer first
24application · medium
A security team wants to ensure that only the 'Security Admins' group can view and manage incidents for a specific set of servers. They also want automated investigation to run at full automation for those servers. What should they configure?
Select an answer first
25foundation · easy
Which of the following can be controlled by device group permissions in Microsoft Defender for Endpoint?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-200

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-200” is a trademark of its owner, used for identification only.