Exam SC-200 topic 7 question 10 discussion

Actual exam question from Microsoft's SC-200

Question #: 10
Topic #: 7

You have 500 on-premises Windows 11 devices that use Microsoft Defender for Endpoint.
You enable Network device discovery.

You need to create a hunting query that will identify discovered network devices and return the identity of the onboarded device that discovered each network device.

Which built-in function should you use?

A. SeenBy()
B. DeviceFromIP()
C. next()
D. current_cluster_endpoint()

Show Suggested Answer

Suggested Answer: A 🗳️

by rsanx42 at May 31, 2024, 2:29 p.m.

Comments

Submit Cancel

rsanx42

Highly Voted 1 year, 2 months ago

Selected Answer: A

Correct. By invoking the SeenBy function, in your advanced hunting query, you can get detail on which onboarded device a discovered device was seen by. This information can help determine the network location of each discovered device and subsequently, help to identify it in the network. https://learn.microsoft.com/en-us/defender-endpoint/device-discovery

upvoted 5 times

...

Blasty

Most Recent 5 months, 2 weeks ago

Selected Answer: A

https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-seenby-function

upvoted 2 times

...

laddu001

1 year, 1 month ago

Seenby function - https://learn.microsoft.com/en-us/defender-endpoint/device-discovery

upvoted 4 times

...