Microsoft · SC-200
Endpoint response
SC-200 · Lesson 11 of 14 · 1:12:21
YouTube loads only after you press play. This chapter opens at its timestamp in the full course. Watch on YouTube ↗
In this lesson
Prepare for the SC-200 exam (Microsoft Certified: Security Operations Analyst Associate). In this lesson: the device timeline (MITRE techniques, event flags, exports), response actions (full and selective isolation, contain device, restrict app execution, antivirus scan, investigation package), live response (basic and advanced commands, the library, unsigned scripts), and incidents handled by automatic attack disruption. Includes three original practice questions.
Preview the topics
- Devices in a branch office reach the internet through a web proxy, and an analyst must cut a compromised device off the network, while making sure it can recover afterward. Which action fits best?
- During live response, an analyst must run a cleanup script on a device, but the run command cannot find it. What is missing?
- Attack disruption contained a server during a ransomware attack, and the team has now removed the threat. What should they do with the server?