Free SC-200 flashcards

In Microsoft Defender for Endpoint, which automation level remediates threats immediately with no analyst approval step?

Full - remediate threats automatically applies automated investigation and response verdicts at once, with no approval gate. It is set per device group and is the only level that guarantees immediate remediation for an unattended site, since the Semi levels queue some or all actions in the Action centre for a human.

Which attack surface reduction (ASR) rule mode silently logs would-be blocks so you can measure fleet impact before enforcing?

Audit mode evaluates the ASR rule logic but lets the action complete, writing an entry to the DeviceEvents table each time the rule would have blocked. This gives huntable, fleet-wide telemetry over a pilot window so the team can size line-of-business impact and build exclusions before promoting the same rule to Block.

Common misconceptionThat Warn mode measures an ASR rule's impact silently the way Audit mode does. Warn shows the user a dismissible prompt on every trigger, disrupting their workflow and letting them bypass the rule.

In Microsoft Defender XDR, which incident view shows how alerts from different workloads were correlated into one multi-stage attack, with a timeline and entity relationships?

The incident graph and attack story. Defender XDR automatically stitches related alerts from across its workloads into a single incident, then renders those alerts, affected entities, and their relationships as a connected, chronological view so an analyst can trace an attack from email to identity to endpoint without manually piecing the stages together.

Which Microsoft Defender XDR advanced hunting table records endpoint logon activity with the account, logon type, and remote device for tracing lateral movement?

DeviceLogonEvents. It is the Microsoft Defender for Endpoint table that captures sign-ins and authentication observed on each device, including the account, logon type, and the remote source device. Those fields let an analyst follow which users authenticated to which hosts and reconstruct lateral movement hop by hop.

Common misconceptionThat IdentityLogonEvents shows endpoint sign-ins for lateral-movement tracing. It records directory-layer authentications from domain controllers, not device-level logons.

In Microsoft Defender XDR Advanced Hunting, which table reconstructs a process execution chain on one device with both child and parent command lines?

DeviceProcessEvents is purpose-built for process creation telemetry from Microsoft Defender for Endpoint. Each row pairs the spawned process FileName and ProcessCommandLine with the InitiatingProcessFileName and InitiatingProcessCommandLine of its parent, so an analyst can walk up and down the lineage from a single table without joining across general event tables.

Which Microsoft Defender XDR Advanced Hunting table holds on-premises Active Directory authentication events with source-to-destination logon detail?

IdentityLogonEvents is populated by Microsoft Defender for Identity from monitored domain controllers and Active Directory Federation Services. It carries Kerberos and NTLM logons with the LogonType, Protocol, account, and both source and destination devices, making it the correct surface for hunting credential-based lateral movement against on-premises identities.

Common misconceptionThat SigninLogs captures on-premises domain controller authentication because it already logs sign-ins. SigninLogs is an Entra ID cloud sign-in table; IdentityLogonEvents holds the on-premises Kerberos and NTLM logon detail.