Exam SC-200 topic 7 question 31 discussion

Actual exam question from Microsoft's SC-200

Question #: 31
Topic #: 7

You have a Microsoft 365 subscription that uses Microsoft Defender XDR. The subscription contains 500 Windows 11 devices that are onboarded to Microsoft Defender for Endpoint.

You discover unauthorized changes to the membership of the Administrators group for the devices.

You need to configure a solution that meets the following requirements:

• Every hour, check the Administrators group membership of each endpoint.
• When a change to the Administrators group membership is detected, create an incident in Microsoft Defender XDR.

What should you create first?

A. a device group
B. an advanced hunting query
C. an alert tuning rule
D. a detection rule

Show Suggested Answer

Suggested Answer: B 🗳️

by Krayzr at June 13, 2025, 8:46 p.m.

Comments

Submit Cancel

Krayzr

1 day, 19 hours ago

Selected Answer: B

B. an advanced hunting query. Here’s the process and why this is the first step: Advanced Hunting Query (First Step): Before you can automate anything, you need to define the logic to find the specific event you're looking for. You must first create and test an advanced hunting query using Kusto Query Language (KQL) to search for events related to local group membership changes (e.g., Event ID 4732: "A member was added to a security-enabled local group"). Detection Rule (Second Step): Once you have a working advanced hunting query, you then create a detection rule. This rule takes your query, runs it automatically on a schedule you define (such as every hour), and triggers an action—like creating an alert and a new incident—whenever the query returns results.

upvoted 1 times

...