Microsoft Security Operations Analyst Associate SC-200 Practice Question

In Microsoft Defender for Endpoint, Device discovery offers two main modes. Basic discovery relies only on passive monitoring of network traffic captured by already-onboarded Windows devices. It does not send any active probes, so it uncovers unmanaged devices without adding network load or potentially disruptive scans. In contrast, Standard discovery and a standalone network sensor in active mode both perform active interrogation (for example, via ARP, SNMP, or port scanning), which the security team wants to avoid. Enabling Microsoft Defender for Cloud's auto-provisioning targets cloud resources, not on-premises network devices, so it will not meet the requirement. Therefore, enabling Device discovery in Basic (passive) mode is the correct choice.