Exam SC-200 topic 7 question 10 discussion

Actual exam question from Microsoft's SC-200

Question #: 10
Topic #: 7

You have 500 on-premises Windows 11 devices that use Microsoft Defender for Endpoint.
You enable Network device discovery.

You need to create a hunting query that will identify discovered network devices and return the identity of the onboarded device that discovered each network device.

Which built-in function should you use?

A. SeenBy()
B. DeviceFromIP()
C. next()
D. current_cluster_endpoint()

Show Suggested Answer

Suggested Answer: A 🗳️

by rsanx42 at May 31, 2024, 2:29 p.m.

Comments

Submit Cancel

Blasty

4 months ago

Selected Answer: A

https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-seenby-function

upvoted 2 times

...

laddu001

1 year ago

Seenby function - https://learn.microsoft.com/en-us/defender-endpoint/device-discovery

upvoted 4 times

...

rsanx42

1 year ago

Selected Answer: A

Correct. By invoking the SeenBy function, in your advanced hunting query, you can get detail on which onboarded device a discovered device was seen by. This information can help determine the network location of each discovered device and subsequently, help to identify it in the network. https://learn.microsoft.com/en-us/defender-endpoint/device-discovery

upvoted 3 times

...