SC-200 Practice Question 3761
Exam: SC-200
Domain: Respond to security incidents
Difficulty: medium
An analyst finds an unknown malicious executable file on a compromised server. The analyst needs to prevent this specific file from ever executing on any other machine in the organization. What should the analyst create in Defender for Endpoint?
Answer Options
A
A custom File Hash Indicator of Compromise set to Block and Remediate
B
An Exchange transport rule matching file names
C
A local hosts file redirection
D
A BitLocker encryption policy
Correct Answer
A: A custom File Hash Indicator of Compromise set to Block and Remediate
Explanation
Under Settings > Endpoints > Indicators, add a custom File Hash Indicator of Compromise (IoC) with the action set to "Block and Remediate".