Microsoft Security Operations Analyst — Question 75

You have a Microsoft 365 subscription that uses Microsoft Defender XDR. The subscription contains 500 Windows 11 devices that are onboarded to Microsoft Defender for Endpoint.

You discover unauthorized changes to the membership of the Administrators group for the devices.

You need to configure a solution that meets the following requirements:

• Every hour, check the Administrators group membership of each endpoint.
• When a change to the Administrators group membership is detected, create an incident in Microsoft Defender XDR.

What should you create first?

Answer options

• A. a device group
• B. an advanced hunting query
• C. an alert tuning rule
• D. a detection rule

Correct answer: B

Explanation

The correct answer is B, as an advanced hunting query allows you to continuously monitor and query the membership of the Administrators group on the endpoints. The other options do not provide the necessary capability to perform the hourly checks and detect changes effectively: A is for grouping devices, C is for managing alerts, and D is focused on defining detection logic rather than querying existing data.