Exam SC-200 Topic 2 Question 297 Discussion
Actual exam question for Microsoft's SC-200 exam
Question #: 297
Topic #: 2
Question #: 297
Topic #: 2
You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR.
You have a custom detection rule named Rule1 that generates an alert if more than five antivirus detections are identified on a device. Rule1 has a loopback period of 12 hours.
You need to change the loopback period to 48 hours.
What should you modify for Rule1?
You have a custom detection rule named Rule1 that generates an alert if more than five antivirus detections are identified on a device. Rule1 has a loopback period of 12 hours.
You need to change the loopback period to 48 hours.
What should you modify for Rule1?
Suggested Answer: A Vote an answer
XDR Custom Detection Rules Documentation):
In Microsoft Defender XDR, custom detection rules are scheduled KQL queries that evaluate telemetry on a recurring schedule, using a lookback (loopback) period to determine how much historical data to analyze during each run.
The loopback period determines the time window over which data i s evaluated (e.g., 12 hours, 48 hours). To change this period, administrators modify the rule's schedule configuration - specifically the frequency or recurrence settings in the custom detection rule editor. The KQL query (including summarize or where oper ators) defines the logic but not the temporal scope of data evaluation.
Therefore, extending the loopback from 12 hours to 48 hours requires adjusting the frequency (schedule) configuration of the rule, not the query itself.
# Correct Answer: A. the freque ncy
In Microsoft Defender XDR, custom detection rules are scheduled KQL queries that evaluate telemetry on a recurring schedule, using a lookback (loopback) period to determine how much historical data to analyze during each run.
The loopback period determines the time window over which data i s evaluated (e.g., 12 hours, 48 hours). To change this period, administrators modify the rule's schedule configuration - specifically the frequency or recurrence settings in the custom detection rule editor. The KQL query (including summarize or where oper ators) defines the logic but not the temporal scope of data evaluation.
Therefore, extending the loopback from 12 hours to 48 hours requires adjusting the frequency (schedule) configuration of the rule, not the query itself.
# Correct Answer: A. the freque ncy
by Adolph at Oct 26, 2026, 02:09 PM
0
0
0
10
Comments
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
Report Comment
Commenting
You can sign-up / login (it's free).