Exam SC-200 topic 5 question 29 discussion

Actual exam question from Microsoft's SC-200

Question #: 29
Topic #: 5

DRAG DROP
-

You have a Microsoft 365 subscription. The subscription contains 500 Windows 11 devices that are onboarded to Microsoft Defender for Endpoint.

You need to perform the following actions in Microsoft Defender XDR:

• For your company’s finance department, populate random endpoints with fake cached credentials.
• Ensure that an incident is created in Microsoft Defender XDR if an attacker attempts to use the fake cached credentials.

The solution must ensure that the fake cached credentials are planted only on endpoints of the finance department.

Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

NOTE: More than one order of answer choices is correct. You will receive credit for any of the correct orders you select.

Show Suggested Answer

Suggested Answer:

by Krayzr at June 13, 2025, 8:26 p.m.

Comments

Submit Cancel

Krayzr

1 day, 19 hours ago

From the Microsoft Defender XDR settings, assign a device tag. This step helps identify and group the finance department's devices. From Endpoints settings, create an advanced lure. Advanced lures allow you to plant fake cached credentials on specific tagged devices. From Endpoints settings, create a custom detection rule. This ensures that an incident is created if an attacker attempts to use the fake credentials.

upvoted 2 times

...