Microsoft Security Operations Analyst (SC-200) - 340 Questions

1. A security analyst needs to ensure that the SOC team receives email notifications whenever a high-severity alert is generated for devices in the 'Finance' device group. Which feature in Microsoft Defender XDR should the analyst configure?

2. A SOC team wants to prevent attackers from tampering with Microsoft Defender for Endpoint security settings on Windows endpoints. Which advanced feature should the security administrator enable?

3. A security analyst needs to remotely collect forensic artifacts and run scripts on a compromised Windows device without disrupting end users. Which Microsoft Defender for Endpoint advanced feature must be enabled first?

4. A SOC analyst is reviewing alerts and identifies a recurring benign alert generated by a known internal scanning tool. The analyst wants to stop this alert from appearing in the queue. Which feature should the analyst use?

5. A security administrator wants to block a specific malicious file hash across all onboarded endpoints using Microsoft Defender for Endpoint. Which endpoint rule setting should be used?