Exam SC-200 topic 5 question 20 discussion

Actual exam question from Microsoft's SC-200

Question #: 20
Topic #: 5

HOTSPOT
-

You have a Microsoft 365 subscription that contains three users named User1, User2 and User3 and the resources shown in the following table.

You have a Microsoft Defender XDR detection rule named Rule1 that has the following configurations:

• Scope:DevGroup1
• File hash: File1.exe
• Actions
o Devices: Collect investigation package
o User: Mark as compromised
o Files: Block

Each user attempts to run File1.exe on their device.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.

Show Suggested Answer

Suggested Answer:

by rkrau at April 10, 2025, 8:06 a.m.

Comments

Submit Cancel

BenTornado

1 month ago

Risk Level = HIGH

upvoted 1 times

...

cyber_shieldmaiden

3 months ago

Answer is correct. Learn Article: Create and manage custom detections rules Section: *Actions on users* When selected, the Mark user as compromised action is taken on users in the AccountObjectId, InitiatingProcessAccountObjectId, or RecipientObjectId column of the query results. This action sets the users risk level to "high" in Microsoft Entra ID, triggering corresponding identity protection policies. https://learn.microsoft.com/en-us/defender-xdr/custom-detection-rules#actions-on-users

upvoted 3 times

...

a_kto_to

3 months, 3 weeks ago

In my opinion correct

upvoted 2 times

...

rkrau

3 months, 3 weeks ago

User2 will be marked with a risk level of medium (level indicates suspicious behavior that warrants further investigation but is not immediately critical.), if he attempts to run file1.exe on their device, so Answer should be NYY

upvoted 2 times

...