Describe the capabilities of Microsoft security solutions →hardMultiple ChoiceObjective-mapped

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Exhibit

Refer to the exhibit.

```kusto
DeviceInfo
| where DeviceName == "LAPTOP-01"
| project DeviceName, OSPlatform, RiskScore
```

Refer to the exhibit. A security analyst runs the KQL query in Microsoft Defender for Endpoint. The query returns no results. What is the most likely cause?

⚠ Common exam trap

Watch out — candidates often think a missing result is due to permissions or OS incompatibility, but the core prerequisite for any Defender for Endpoint query is that the device must be onboarded and actively reporting telemetry.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The device is not onboarded to Defender for Endpoint

The KQL query in Microsoft Defender for Endpoint returns no results because the device is not onboarded. Defender for Endpoint can only report on devices that have been enrolled and are actively sending telemetry. If a device is not onboarded, no data exists for it in the security portal, so any query targeting that device will return empty results.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The device has a risk score of zero
Why it's wrong here
A device with a risk score of zero would still have a corresponding DeviceInfo record in Microsoft Defender for Endpoint. The RiskScore field is an attribute within the DeviceInfo table, and a value of zero simply indicates that no active threats or vulnerabilities have been identified for that endpoint. Therefore, a KQL query targeting DeviceInfo would still return a row for such a device, displaying its name, OS platform, and the zero risk score, rather than returning no results at all.
✗
The device runs macOS
Why it's wrong here
The operating system of a device, whether it runs macOS, Windows, Linux, or another supported platform, is stored as a value within the OSPlatform column of the DeviceInfo table. If a device is onboarded to Microsoft Defender for Endpoint, its DeviceInfo record will exist, and the OSPlatform field will simply reflect the specific operating system. The presence of macOS would not cause the entire DeviceInfo record to be absent or prevent a KQL query from returning a row for that device.
✗
The analyst lacks permissions to view the device
Why it's wrong here
If an analyst lacked the necessary permissions to view device information, the KQL query would typically return an explicit "access denied" error message or filter out specific devices they are not authorized to see, rather than simply yielding an empty result set for a device that is otherwise onboarded. An empty result set strongly suggests that the underlying data record for the device does not exist in the first place, rather than a permission-based restriction preventing its display.
✓
The device is not onboarded to Defender for Endpoint
Why this is correct
The DeviceInfo table in Microsoft Defender for Endpoint exclusively stores records for devices that have been successfully onboarded and are actively reporting sensor data. If a device has not completed the onboarding process, or if its Defender for Endpoint sensor is not functioning or reporting, no corresponding entry will exist within the DeviceInfo table. Therefore, a KQL query attempting to retrieve information for such a device would correctly return an empty result set, indicating the absence of that device's data in the platform.

Go deeper

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question