SC-200 · Question #409
You have a Microsoft 365 subscription that uses Microsoft Defender XDR. The subscription contains 500 Windows 11 devices that are onboarded to Microsoft Defender for Endpoint. You discover…
The correct answer is B. an advanced hunting query. To implement a solution that checks Administrator group membership on a schedule and creates incidents on changes, you must first create an advanced hunting query (B) - before creating a detection rule. The advanced hunting query is the KQL logic that identifies changes to the…
Question
You have a Microsoft 365 subscription that uses Microsoft Defender XDR. The subscription contains 500 Windows 11 devices that are onboarded to Microsoft Defender for Endpoint. You discover unauthorized changes to the membership of the Administrators group for the devices. You need to configure a solution that meets the following requirements:
- Every hour, check the Administrators group membership of each
endpoint.
- When a change to the Administrators group membership is detected,
create an incident in Microsoft Defender XDR. What should you create first?
Options
- Aa device group
- Ban advanced hunting query
- Can alert tuning rule
- Da detection rule
How the community answered
(17 responses)- B82% (14)
- C12% (2)
- D6% (1)
Explanation
To implement a solution that checks Administrator group membership on a schedule and creates incidents on changes, you must first create an advanced hunting query (B) - before creating a detection rule. The advanced hunting query is the KQL logic that identifies changes to the Administrators group (e.g., querying DeviceEvents or IdentityDirectoryEvents). Once the query is validated and confirmed to return accurate results, you then create a custom detection rule based on it, setting the frequency to hourly. The detection rule is what ultimately generates incidents. You cannot create a detection rule without a working query, making the query the first required step. A device group (A) and alert tuning rule (C) do not address the detection requirement.
Community Discussion
No community discussion yet for this question.