A security manager wants to assess which attack techniques are covered by the current custom detection rules in Microsoft Defender XDR. They need a visual representation of coverage against the MITRE ATT&CK framework and want to identify gaps. What should they use?

Custom detection rule report in Microsoft Sentinel

Advanced Hunting query to list all alerts

The MITRE ATT&CK coverage view in Microsoft Defender XDR

Which setting is essential to configure when creating a scheduled analytics rule in Microsoft Sentinel?

The query and the schedule frequency

A security operations team has a custom detection rule in Microsoft Defender XDR that generates a high volume of false positives. The rule was created from an Advanced Hunting query that detects suspicious logon activity. The team wants to reduce false positives without losing detection of genuine threats. They also want to track the effectiveness of the change. What should they do?

Disable the custom detection rule and create a new one from scratch with a completely different query.

Increase the frequency of the rule to run more often, so that alerts are generated more quickly and can be triaged sooner.

Edit the custom detection rule to add a filter that excludes known benign IP addresses, and then review the rule's impact in the Microsoft 365 Defender portal.

Change the rule's severity to Informational so that false positives are less visible in the queue.

A security architect is using the MITRE ATT&CK coverage view in Microsoft Defender XDR and notices that the organization has no detections for 'Persistence' techniques. They want to create a custom detection rule that covers multiple persistence techniques, but they are concerned about performance impact on the Advanced Hunting queries. What is the best approach?

Create multiple custom detection rules, one for each persistence technique, to improve performance.

Use Advanced Hunting to manually investigate persistence techniques.

Use a built-in detection rule for persistence.

Create a single custom detection rule with a query that covers multiple persistence techniques, and schedule it to run at a reasonable frequency.

A large enterprise uses Microsoft Sentinel. They want to detect a new, unknown malware variant that does not match any known signature. They have a large volume of endpoint telemetry. Which analytics rule type should they use to identify this novel threat without writing custom detection logic?

Scheduled analytics rule with a known IOC query

Microsoft security rule from Defender for Endpoint

Machine learning (ML) analytics rule using a built-in anomaly model

Near-real-time rule with a threshold on process creation

Microsoft Certified:Security Operations Analyst Associate

Domain 1Objective 4

Configure Detections SC-200 Practice Questions (Page 7)

Part of the Manage a security operations environment domain, which accounts for 40–45% of the SC-200 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~16–29 in this domain), expect 4–7 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

8concepts

40–45%of the exam

Questions 31–35

31application · medium
A security manager wants to assess which attack techniques are covered by the current custom detection rules in Microsoft Defender XDR. They need a visual representation of coverage against the MITRE ATT&CK framework and want to identify gaps. What should they use?
Select an answer first
32foundation · easy
Which setting is essential to configure when creating a scheduled analytics rule in Microsoft Sentinel?
Select an answer first
33application · medium
A security operations team has a custom detection rule in Microsoft Defender XDR that generates a high volume of false positives. The rule was created from an Advanced Hunting query that detects suspicious logon activity. The team wants to reduce false positives without losing detection of genuine threats. They also want to track the effectiveness of the change. What should they do?
Select an answer first
34expert · medium
A security architect is using the MITRE ATT&CK coverage view in Microsoft Defender XDR and notices that the organization has no detections for 'Persistence' techniques. They want to create a custom detection rule that covers multiple persistence techniques, but they are concerned about performance impact on the Advanced Hunting queries. What is the best approach?
Select an answer first
35application · medium
A large enterprise uses Microsoft Sentinel. They want to detect a new, unknown malware variant that does not match any known signature. They have a large volume of endpoint telemetry. Which analytics rule type should they use to identify this novel threat without writing custom detection logic?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-200

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-200” is a trademark of its owner, used for identification only.

Configure Detections SC-200 Practice Questions (Page 7)

Questions 31–35

A security manager wants to assess which attack techniques are covered by the current custom detection rules in Microsoft Defender XDR. They need a visual representation of coverage against the MITRE ATT&CK framework and want to identify gaps. What should they use?

Which setting is essential to configure when creating a scheduled analytics rule in Microsoft Sentinel?

A large enterprise uses Microsoft Sentinel. They want to detect a new, unknown malware variant that does not match any known signature. They have a large volume of endpoint telemetry. Which analytics rule type should they use to identify this novel threat without writing custom detection logic?

Keep studying — Manage a security operations environment