SC-200 Practice Question 3800
Exam: SC-200
Domain: Respond to security incidents
Difficulty: medium
How can a security operations analyst verify if a quarantined file in Defender for Endpoint was executed on any other machine prior to detection?
Answer Options
A
Query DeviceFileEvents and DeviceProcessEvents using the SHA256 file hash
B
Check the local print spooler on the print server
C
Inspect the email inbox of the company CEO
D
Reboot all client computers simultaneously
Correct Answer
A: Query DeviceFileEvents and DeviceProcessEvents using the SHA256 file hash
Explanation
Query the DeviceFileEvents and DeviceProcessEvents tables in Advanced Hunting using the file SHA256 hash to identify all execution instances across the fleet.