exam questions

Exam SC-200 All Questions

View all questions & answers for the SC-200 exam

Exam SC-200 topic 1 question 46 discussion

Actual exam question from Microsoft's SC-200
Question #: 46
Topic #: 1
[All SC-200 Questions]

51 HOTSPOT

You have a custom detection rule that includes the following KQL query.



For each of the following statements, select Yes if True. Otherwise, select No.

NOTE: Each correct selection is worth one point.

Show Suggested Answer Hide Answer
Suggested Answer:

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
cris_exam
Highly Voted 1 year, 1 month ago
NO - https://learn.microsoft.com/en-us/microsoft-365/security/defender/custom-detection-rules?view=o365-worldwide#actions-on-emails "The columns NetworkMessageId and RecipientEmailAddress must be present in the output results of the query to apply actions to email messages." Since NetworkMessageID is not mentioned in the sumarize, it won't work. YES - https://learn.microsoft.com/en-us/microsoft-365/security/defender/custom-detection-rules?view=o365-worldwide#actions-on-devices YES - https://learn.microsoft.com/en-us/microsoft-365/security/defender/custom-detection-rules?view=o365-worldwide#actions-on-files I couldn't actually test it now, but if someone could give it a test to confirm that would be great. :)
upvoted 26 times
HectorF09
8 months, 2 weeks ago
That is a documented answer. Thanks a lot!
upvoted 3 times
...
kazaki
10 months, 2 weeks ago
yes it is NO yes yes for emails actions you need NetworkMessageId and it is not there
upvoted 2 times
kazaki
10 months, 2 weeks ago
https://learn.microsoft.com/en-us/microsoft-365/security/defender/custom-detection-rules?view=o365-worldwide#4-specify-actions
upvoted 2 times
...
...
Gurulee
1 year, 1 month ago
I agree with you.
upvoted 2 times
danb67
1 year ago
Deletion of files and restricting an app are not an option for custom detection rule automation. You can't automate these actions with a custom detection rule. So should it not be no No NO No?
upvoted 2 times
kabooze
1 year ago
seems N/N/N to me as well because NetworkMessageId is missing
upvoted 1 times
kabooze
1 year ago
Ignore my above comment. I was wrong.
upvoted 1 times
...
...
...
...
smanzana
8 months, 3 weeks ago
👍🏻 No - Yes - Yes
upvoted 2 times
...
...
mc250616
Highly Voted 11 months, 2 weeks ago
Hi, I have just right Query in lab environemnt and try to create an custom rule based on it. Query works and I got some result. When I try to create query anfd follow the steps; Custom Detections: Impactec Entities: Device---> Device ID Mailbox--> RecipientEmail Address User ---> RecipientObjectId From the actions in this link "https://learn.microsoft.com/en-us/microsoft-365/security/defender/custom-detection-rules?view=o365-worldwide#4-specify-actions" 1) All device actions includes "restrict app execution" is active and can be implemented. 2) for Files : Allow/Block active delete is inactive 3) for users: Mar user as compromised active 4) for Emails no action is active. On the base of this teswt on lab environment I will go with "No, yes, No" Opption.
upvoted 5 times
paraze
10 months, 2 weeks ago
Just tested it also here and have the same results.
upvoted 1 times
...
...
Harryd82
Most Recent 6 months ago
No, Yes, Yes
upvoted 1 times
...
Kodoi
7 months, 3 weeks ago
N,Y,Y. Both "RecipientEmailAddress" and "NetworkMessageId" are required to automatically remove an email message from a user's mailbox. If the "Device ID" column is printed in the query results, the app can be automatically restricted from running. If the query outputs one of the "SHA1", "InitiatingProcessSHA1", or "SHA256" columns, you can automatically restrict the execution of your app. https://learn.microsoft.com/en-us/microsoft-365/security/defender/custom-detection-rules?view=o365-worldwide
upvoted 2 times
Kodoi
6 days, 16 hours ago
N,Y,Nに修正。3問目を誤認していた。
upvoted 1 times
...
...
Pradeep064
9 months, 2 weeks ago
Tested in the lab, "Deletion of email messages from user mailbox based on RecipientEmailAddress" - No "Restrict the App execution using DeviceId" - Yes "Deletion of file based on SHA256" - No
upvoted 3 times
...
smanzana
12 months ago
No-Yes-Yes
upvoted 2 times
...
chepeerick
1 year ago
Option Yes, No, No as Detection Rule cannot delete or restrict
upvoted 2 times
kabooze
1 year ago
It can. It's No: The columns NetworkMessageId and RecipientEmailAddress must be present in the output results of the query to apply actions to email messages. Yes: Restrict app execution—sets restrictions on device to allow only files that are signed with a Microsoft-issued certificate to run. Yes: When selected, the Quarantine file action can be applied to files in the SHA1, InitiatingProcessSHA1, SHA256, or InitiatingProcessSHA256 column of the query results. This action deletes the file from its current location and places a copy in quarantine. I agree that the 3rd one could be dubious because of the quarantine, but it DOES delete the file.
upvoted 2 times
...
...
Dracula666
1 year ago
Yes, No, No Keyword is | where EntityType in ("User", "Mailbox") so actions available are For "User" : Mark user as compromised Disable user Force password reset For "Mailbox" : Move to Mailbox folder Delete Mail Ref : https://learn.microsoft.com/en-us/microsoft-365/security/defender/custom-detection-rules?view=o365-worldwide#4-specify-actions
upvoted 2 times
...
pigl3t
1 year, 1 month ago
not correct. Definitely not for email ( The columns NetworkMessageId and RecipientEmailAddress must be present in the output results of the query to apply actions to email messages.) But seems ok for the other two. So I go with NO for email and yes for the other two.
upvoted 2 times
chepeerick
1 year, 1 month ago
restrict apps and delete files are not possible with custom detections rules
upvoted 2 times
kabooze
1 year ago
they are. No: The columns NetworkMessageId and RecipientEmailAddress must be present in the output results of the query to apply actions to email messages. Yes: Restrict app execution—sets restrictions on device to allow only files that are signed with a Microsoft-issued certificate to run. Yes: When selected, the Quarantine file action can be applied to files in the SHA1, InitiatingProcessSHA1, SHA256, or InitiatingProcessSHA256 column of the query results. This action deletes the file from its current location and places a copy in quarantine. I agree that the 3rd one could be dubious because of the quarantine, but it DOES delete the file.
upvoted 1 times
...
danb67
1 year ago
I agree therefore the answer should be No/No/No?
upvoted 2 times
...
...
...
ant0b1
1 year, 1 month ago
The answers seems to be correct based on this source: https://learn.microsoft.com/en-us/microsoft-365/security/defender/custom-detection-rules?view=o365-worldwide#4-specify-actions
upvoted 3 times
oddsol
1 year ago
The link you provided specifically shows that "The columns NetworkMessageId and RecipientEmailAddress must be present in the output results of the query to apply actions to email messages.". How did you come to that conclusion? There is nothing in the query indicating that NetworkMessageId is provided, or am i missing something?
upvoted 2 times
...
Unlikely
1 year, 1 month ago
I don't get why actions #2 and #3 would be impossible. DeviceId and SHA256 are in the output
upvoted 1 times
danb67
1 year ago
restrict apps and delete files are not possible with custom detections rules
upvoted 1 times
kabooze
1 year ago
No: The columns NetworkMessageId and RecipientEmailAddress must be present in the output results of the query to apply actions to email messages. Yes: Restrict app execution—sets restrictions on device to allow only files that are signed with a Microsoft-issued certificate to run. Yes: When selected, the Quarantine file action can be applied to files in the SHA1, InitiatingProcessSHA1, SHA256, or InitiatingProcessSHA256 column of the query results. This action deletes the file from its current location and places a copy in quarantine. I agree that the 3rd one could be dubious because of the quarantine, but it DOES delete the file.
upvoted 2 times
...
kabooze
1 year ago
Sigh. I guess this is one of those questions where microsoft leaves too much interpretation "When selected, the Quarantine file action can be applied to files in the SHA1, InitiatingProcessSHA1, SHA256, or InitiatingProcessSHA256 column of the query results. This action deletes the file from its current location and places a copy in quarantine." So yes it's "deleted". I would also say "no", but tbh it's just guessing.
upvoted 1 times
...
...
...
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
Loading ...
exam
Someone Bought Contributor Access for:
SY0-701
London, 1 minute ago