Free SC-200 flashcards

Which attack surface reduction (ASR) rule mode silently logs would-be blocks so you can measure fleet impact before enforcing?

Audit mode evaluates the ASR rule logic but lets the action complete, writing an entry to the DeviceEvents table each time the rule would have blocked. This gives huntable, fleet-wide telemetry over a pilot window so the team can size line-of-business impact and build exclusions before promoting the same rule to Block.

Setting an ASR rule to Block with per-application exclusions is a safe way to measure impact during a trial.

Block enforces immediately, which violates a requirement to measure impact silently first. Chasing breakages with exclusions reacts only after disruption has occurred. Audit mode logs would-be blocks to DeviceEvents without stopping any action, so it measures impact safely.

In Microsoft Defender XDR, which incident view shows how alerts from different workloads were correlated into one multi-stage attack, with a timeline and entity relationships?

The incident graph and attack story. Defender XDR automatically stitches related alerts from across its workloads into a single incident, then renders those alerts, affected entities, and their relationships as a connected, chronological view so an analyst can trace an attack from email to identity to endpoint without manually piecing the stages together.

The Microsoft Defender vulnerability management dashboard shows how an incident's cross-workload alerts were correlated into a single attack timeline.

It does not. Vulnerability management ranks device exposure and misconfigurations to drive proactive hardening; it neither correlates alerts nor renders an incident timeline. The correlated end-to-end picture comes from the incident graph and attack story.

In Microsoft Defender XDR Advanced Hunting, which table reconstructs a process execution chain on one device with both child and parent command lines?

DeviceProcessEvents is purpose-built for process creation telemetry from Microsoft Defender for Endpoint. Each row pairs the spawned process FileName and ProcessCommandLine with the InitiatingProcessFileName and InitiatingProcessCommandLine of its parent, so an analyst can walk up and down the lineage from a single table without joining across general event tables.

DeviceEvents is the general endpoint table, so it records a row per process creation with both parent and child command lines.

DeviceEvents is a catch-all table for miscellaneous security and audit events such as protection toggles and ASR rule triggers. It does not provide a dedicated per-spawn row carrying both the child and initiating-parent command lines, so lineage reconstruction would be incomplete. Use DeviceProcessEvents for process creation telemetry.