SC-200 Certification Practice Question #198

Question

You have a Microsoft 365 subscription that uses Microsoft Defender XDR.

You have a query that contains the following statements.

You need to configure a custom detection rule that will use the query. The solution must minimize how long it takes to be notified about events that match the query.

Which frequency should you select for the rule?

Accepted Answer

The displayed query begins with `union DeviceEvents, DeviceProcessEvents`, and MS Learn states a custom detection can run Continuous (NRT) only if it references a single table and uses no unions/joins — so NRT (B) is disqualified despite being the fastest in theory. Among the remaining scheduled frequencies (every 3h, 12h, 24h, and every hour), "Every hour" is the fastest, so it best satisfies "minimize how long it takes to be notified." Suggested Answer A, the 8-vote Most Voted A, and two ≥3 👍 comments citing the exact MS Learn rule all agree. Confidence is held at 85 (not higher) because two reasoned dissents exist — sapphire's NRT pick and OneplusOne's 12h pick — but both misread the technical constraint or the "minimize latency" goal, so A clearly wins.

More SC-200 practice questions