Configure Detections SC-200 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is a common reason to modify an existing custom detection rule in Microsoft Defender XDR?

   • ATo reduce false positives by refining the query conditions
   • BTo assign licenses to users
   • CTo change the Microsoft 365 tenant ID
   • DTo increase the storage quota for the security portal
   Reveal Solution Discussion Select an answer first
2. 2expert · medium

   A security analyst has created a custom detection rule in Microsoft Defender XDR from an Advanced Hunting query. The rule is working, but the analyst wants to reduce the number of false positives. They also want to ensure the rule is mapped to the correct MITRE ATT&CK technique. What is the best way to tune the rule?

   • AChange the rule to a scheduled rule in Microsoft Sentinel.
   • BIncrease the frequency of the rule to run more often.
   • CEdit the query to add more specific conditions and update the MITRE technique mapping.
   • DDisable the rule and create a new one from scratch.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   In Microsoft Sentinel, what is the primary purpose of a scheduled analytics rule?

   • ATo automatically remediate threats without human intervention
   • BTo provide real-time detection of threats as they occur
   • CTo run a query at regular intervals and generate alerts based on the results
   • DTo visualize threat data on dashboards
   Reveal Solution Discussion Select an answer first
5. 4expert · medium

   A SOC team in Microsoft Sentinel has a scheduled analytics rule that uses threat intelligence to detect malicious IP addresses. The rule runs every hour and has a high false-positive rate because the TI feed includes many broad IP ranges. The team wants to reduce false positives while maintaining detection of critical threats. They also want to map the rule to MITRE ATT&CK technique T1078. What should they do?

   • AIncrease the run frequency to every 5 minutes to catch more threats.
   • BModify the KQL query to filter the TI feed to only high-confidence indicators and adjust the alert threshold.
   • CChange the rule to an NRT rule to get faster alerts.
   • DDisable the rule and rely on manual TI lookups.
   Reveal Solution Discussion Select an answer first
6. 5expert · medium

   A security team at Fabrikam has a custom detection rule in Microsoft Defender XDR that was created from an Advanced Hunting query. The rule is generating a high number of false positives, and the team suspects that the query is too broad. They want to reduce false positives while maintaining detection of true positives. They also want to ensure that the rule continues to run without interruption. What should they do?

   • AIncrease the frequency of the rule to run more often, so that alerts are generated more quickly and can be triaged sooner.
   • BDisable the custom detection rule and create a new one from scratch with a completely different query.
   • CChange the rule's severity to Informational so that false positives are less visible in the queue.
   • DEdit the custom detection rule to add more specific filters to the query, and then test the rule in the Microsoft 365 Defender portal before enabling it.
   Reveal Solution Discussion Select an answer first