Exam SC-200 topic 5 question 12 discussion

Identify the devices where you intend to plant the lures in the scope section. You can select to plant lures in all Windows client devices or in clients with specific tags. The deception feature currently covers Windows clients. https://learn.microsoft.com/en-us/defender-xdr/configure-deception

First, tag the 10 devices (e.g., Security.microsoft.com > Devices > select 10 devices > Manage tags > “DeceptionTargets”). Then, create the deception rule and scope it to “Devices with specific tags,” selecting “DeceptionTargets.”

You're right to question that! While device groups are generally useful for managing devices in Defender for Endpoint, they are not the primary way to target specific devices for custom deception rules.

correct answer >> Microsoft Defender >> Rules Managmenet > Apply a tag in Choose which actions to apply to this rule.

ChatGpt4 answer: Option C: Add the devices to a group. Correct. In Microsoft 365 and Defender for Endpoint, devices are often managed in groups (known as device groups or device collections). By adding the specific devices to a group, you can then configure the rule to apply only to that group. This ensures that the rule is only applied to the 10 devices you intend to target. Option D: Assign a tag to the devices. Incorrect. Assigning a tag to devices can help with organization and management within Microsoft Defender for Endpoint, but it doesn’t directly control rule application. Tags are useful for filtering and reporting but not for determining rule scope.

with Deception rules scope you only get the option to (1) All Windows Client devices or (2) Devices with specific Tags. Therefore, "D".

It's (D) first [tag 10 devices], and then when you create the rule, you chose the lure (A), and then you chose the decoys ( the 10 devices you tagged ) https://learn.microsoft.com/en-us/defender-xdr/configure-deception

A: Add custom lures to the rule "In the rule creation pane, add a rule name, description, and select what lure types to create. You can select both" https://learn.microsoft.com/en-us/defender-xdr/configure-deception

Add the devices to a group.