Microsoft · SC-200
Defender for Endpoint settings
SC-200 · Lesson 2 of 14 · 8:47
YouTube loads only after you press play. This chapter opens at its timestamp in the full course. Watch on YouTube ↗
In this lesson
Prepare for the SC-200 exam (Microsoft Certified: Security Operations Analyst Associate). In this lesson: advanced features (tamper protection, EDR in block mode, allow or block file, custom network indicators, live response), indicators of compromise and their actions, asset rule management and dynamic tags, custom data collection into Microsoft Sentinel, and attack surface reduction rules (block, audit, warn, standard protection rules). Includes three original practice questions.
Preview the topics
- Your team confirms a malicious file hash. It must never run on any device, and copies already on devices must be dealt with. Which indicator action fits?
- Hunters need every script run on domain controllers, beyond the default telemetry, and they query it in Sentinel. What should they configure?
- A new ASR rule might break a business app. The team wants to see what the rule would block, without affecting users. Which mode should they use first?