StudyByteLearn
← SC-100: Microsoft Cybersecurity Architect
SC-100 · Server client IoT and OT security

Practice question 276 of 498 · hard

A server EDR rollout appears complete in the deployment tool, but the SOC receives no incidents. Which two checks best verify the security requirement? Select two.

Select all that apply. Every correct option and no extras are required for credit in the app.

  1. A.Assume package installation proves protection and alert delivery
  2. B.Confirm actual endpoint onboarding and usable threat telemetry
  3. C.Treat an inventory record as proof of continuous detection
  4. D.Disable the SIEM connector to reduce alert noise
  5. E.Validate the alert integration and investigation workflow end to end
Show the answer and explanation

✓ Correct answers

  • Confirm actual endpoint onboarding and usable threat telemetry
  • Validate the alert integration and investigation workflow end to end

Operational EDR requires actual telemetry and a functioning response path. Installation and inventory records alone do not prove detection. Disabling integration suppresses evidence rather than fixing delivery or tuning legitimate noise.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material. Not affiliated with or endorsed by Microsoft. These are original learning questions, not actual exam questions. Product capabilities and exam objectives can change; verify current Microsoft documentation. Practice scores do not predict or guarantee an exam result.