SC-200 Certification Practice Question #241

Question

You have 500 on-premises Windows 11 devices that use Microsoft Defender for Endpoint.
You enable Network device discovery.

You need to create a hunting query that will identify discovered network devices and return the identity of the onboarded device that discovered each network device.

Which built-in function should you use?

Accepted Answer

The question asks for the built-in function that returns the onboarded device that discovered each network device. MS Learn's device-discovery advanced-hunting guidance describes exactly this: invoking `SeenBy()` (e.g. `DeviceInfo | where OnboardingStatus != "Onboarded" | invoke SeenBy() | project DeviceId, DeviceName, SeenBy`) returns the onboarded device(s) that have seen a discovered device. The Suggested Answer, a unanimous Most Voted (8), and the two highly-upvoted comments all agree with the docs, so confidence is high.

More SC-200 practice questions