Exam MS-102 topic 1 question 176 discussion

Actual exam question from Microsoft's MS-102

Question #: 176
Topic #: 1

You have a Microsoft 365 tenant that contains a Windows 10 device. The device is onboarded to Microsoft Defender for Endpoint.

From Microsoft 365 Defender portal, you perform a security investigation.

You need to run a PowerShell script on the device to collect forensic information.

Which action should you select on the device page?

A. Collect investigation package
B. Go hunt
C. Initiate Live Response Session
D. Initiate Automated Investigation

Show Suggested Answer

Suggested Answer: C 🗳️

by Vincent1966 at Sept. 13, 2023, 3:23 p.m.

Comments

Submit Cancel

poesklap

Highly Voted 1 year, 7 months ago

Selected Answer: C

The Live Response Session feature allows you to interactively run scripts and collect forensic information on the device. This option will give you the capability to execute PowerShell scripts and perform other live investigation actions on the device.

upvoted 5 times

...

004b54b

Most Recent 2 months, 1 week ago

Selected Answer: C

Explanation by Vincent1966 is right - Answer C

upvoted 1 times

...

badguytoo

7 months, 1 week ago

Live response is designed to enhance investigations by enabling you to collect forensic data, run scripts, send suspicious entities for analysis, remediate threats, and proactively hunt for emerging threats.

upvoted 1 times

...

Vincent1966

1 year, 9 months ago

C: Live response is designed to enhance investigations by enabling you to collect forensic data, run scripts, send suspicious entities for analysis, remediate threats, and proactively hunt for emerging threats. https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/respond-machine-alerts?view=o365-worldwide

upvoted 4 times

...