Microsoft Exam SC-200 Topic 2 Question 59 Discussion

Actual exam question for Microsoft's SC-200 exam

Question #: 59
Topic #: 2

You have a Microsoft 365 subscription that uses Microsoft Defender XDR. You need to implement deception rules. The solution must ensure that you can limit the scope of the rules.

What should you create first?

Adevice groups

Bdevice tags

Choneytoken entity tags

Dsensitive entity tags

Show Suggested Answer

Suggested Answer: A

A workbook is a data-driven interactive report in Microsoft Sentinel. You can use workbooks to create custom reports based on data from your Azure subscription. Reference: https://docs.microsoft.com/en-us/azure/sentinel/workbooks-overview

by Trinidad at Oct 07, 2023, 01:44 AM

Limited Time Offer

25%

Off

Get Premium SC-200 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

My

2 days ago

I'm not sure, maybe we should consider device tags as well to better organize the devices.

upvoted 0 times

...

Gail

4 days ago

I agree with Jaclyn, honeytoken entity tags would help limit the scope of the deception rules.

upvoted 0 times

...

Jaclyn

5 days ago

I think we should create honeytoken entity tags first.

upvoted 0 times

...