SC-200 Certification Practice Question #50

Question

You have a Microsoft 365 subscription that uses Microsoft Defender XDR.

You need to implement deception rules. The solution must ensure that you can limit the scope of the rules.

What should you create first?

Accepted Answer

The question asks what to create *first* to limit the scope of deception rules in Microsoft Defender XDR. The deception rule configuration UI scopes by device tags, and per MS Learn the device-targeting model is explicitly two-stage: you create device tags first, then build device groups on top of those tags. So device tags are the foundational object that must exist before any scoping. Suggested Answer, the dominant community vote (20), and the highly-voted Dogfather comment all converge on B, with MS Learn confirming the tags-then-groups order. Confidence is held at 86 (not higher) because of a real minority (device groups) that reasonably argues groups are what rules attach to; however, the doc ordering and the deception UI both make tags the correct *first* step, so the dissent is outweighed.

More SC-200 practice questions