Microsoft Exam SC-200 Topic 2 Question 59 Discussion

Actual exam question for Microsoft's SC-200 exam

Question #: 59
Topic #: 2

You have a Microsoft 365 subscription that uses Microsoft Defender XDR. You need to implement deception rules. The solution must ensure that you can limit the scope of the rules.

What should you create first?

Adevice groups

Bdevice tags

Choneytoken entity tags

Dsensitive entity tags

Show Suggested Answer

Suggested Answer: A

A workbook is a data-driven interactive report in Microsoft Sentinel. You can use workbooks to create custom reports based on data from your Azure subscription. Reference: https://docs.microsoft.com/en-us/azure/sentinel/workbooks-overview

by Trinidad at Oct 07, 2023, 01:44 AM

Limited Time Offer

25%

Off

Get Premium SC-200 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Lilli

6 days ago

Hmm, device groups seem like the logical choice here. I mean, how else are you going to limit the scope of those deception rules? It's like trying to catch a fly with a baseball bat.

upvoted 0 times

...