SC-200 Certification Practice Question #25

Question

You have a Microsoft 365 subscription that uses Microsoft Defender for Endpoint.

You need to add threat indicators for all the IP addresses in a range of 171.23.34.32-171.23.34.63. The solution must minimize administrative effort.

What should you do in the Microsoft 365 Defender portal?

Accepted Answer

The indicator entry field accepts only single IP addresses; CIDR blocks and dash-delimited ranges are explicitly unsupported, so B, C, and D all fail at import/entry time. The only way to cover all 32 addresses in 171.23.34.32–171.23.34.63 is to enumerate each IP in a CSV and bulk-import it, which minimizes administrative effort versus adding 32 indicators one at a time. This is corroborated by the Suggested Answer, the dominant Most Voted (38), and multiple lab-tested comments. Confidence is held at 84% rather than higher because a cluster of recent (Sep–Dec 2025) comments claim CIDR is "now supported" and report D on real exams; current MS Learn documentation still states the opposite, so MS Learn is used as the tiebreaker and the residual product-change risk is reflected in the score.

More SC-200 practice questions