SC-200 Question 98

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose C1

  Within the JSON structure of a Microsoft Defender for Cloud alert, the MITRE ATT&CK tactic information is stored within the ExtendedProperties section.

• 2

  Correct Answer: C. ExtendedProperties Explanation: The ExtendedProperties JSON key is designed to hold additional and structured information about the alert. In the context of Microsoft Defender for Cloud and other security platforms, this often includes detailed metadata such as MITRE ATT&CK tactic mappings. Therefore, searching the ExtendedProperties key will likely yield results that specifically indicate the Privilege Escalation tactic.

• 1

  Option B ("Intent") is not typically used to directly represent the MITRE ATT&CK tactics or techniques associated with an alert in Microsoft Defender for Cloud. The "Intent" field, if present in the alert data, might provide information about the suspected purpose or objective of the observed activity. However, it does not specifically indicate the MITRE ATT&CK tactic or technique being employed. On the other hand, the "ExtendedProperties" field often contains additional contextual information about the alert, including any associated MITRE ATT&CK tactics and techniques. This field is more likely to contain the specific details needed to identify alerts related to the Privilege Escalation tactic. Therefore, in the context of locating alerts related to the Privilege Escalation MITRE ATT&CK tactic, the "ExtendedProperties" field (Option C) is more relevant to search within the JSON data.