SC-200 · Question #331
You have 500 on-premises Windows 11 devices that use Microsoft Defender for Endpoint. You enable Network device discovery. You need to create a hunting query that will identify discovered network…
The correct answer is A. SeenBy(). By invoking the SeenBy function, in your advanced hunting query, you can get detail on which onboarded device a discovered device was seen by. This information can help determine the network location of each discovered device and subsequently, help to identify it in the…
Question
You have 500 on-premises Windows 11 devices that use Microsoft Defender for Endpoint. You enable Network device discovery. You need to create a hunting query that will identify discovered network devices and return the identity of the onboarded device that discovered each network device. Which built-in function should you use?
Options
- ASeenBy()
- BDeviceFromIP()
- Cnext()
- Dcurrent_cluster_endpoint()
How the community answered
(52 responses)- A85% (44)
- B2% (1)
- C10% (5)
- D4% (2)
Explanation
By invoking the SeenBy function, in your advanced hunting query, you can get detail on which onboarded device a discovered device was seen by. This information can help determine the network location of each discovered device and subsequently, help to identify it in the network. https://learn.microsoft.com/en-us/defender-endpoint/device-discovery
Community Discussion
No community discussion yet for this question.