Exam SC-200 topic 1 question 55 discussion

C for Sure Enable live response from the advanced settings page. https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/live-response?view=o365-worldwide#before-you-begin

D. Configure role-based access control (RBAC). RBAC allows you to define and manage roles and permissions for users, ensuring that only authorized individuals can perform specific actions, such as initiating remote shell connections. By configuring RBAC, you can grant the necessary permissions to the users who need to initiate remote shell connections to the devices. The other options are not directly related to the specific task of initiating remote shell connections: A. This option is broad and doesn't specify the necessary permissions for initiating remote shell connections. B. Create a device group: Creating one is not directly related to initiating remote shell connections. C. Enabling automated investigation is a useful feature, but it is not specifically related to initiating remote shell connections.

Execution of C also requires authorization. This is often forgotten.

its D and not C. Automated investigation relates to security incident handling and does not directly pertain to enabling remote shell connections.

To initiate remote shell connections to onboarded devices from the Microsoft 365 Defender portal, you need to enable Live Response. Live Response is part of the Automated investigation and remediation (AIR) capabilities in Microsoft Defender for Endpoint, which allows administrators to remotely run commands on devices.

initiating live response is not RBAC

C. From Advanced features in the Endpoints settings of the Microsoft 365 Defender portal, enable automated investigation is the correct choice because enabling this feature allows you to use advanced capabilities such as remote shell connections. Once you've enabled this feature, you can then proceed to configure RBAC to ensure that the appropriate permissions are in place for the users who need to initiate remote shell connections.

D correct

You enable Live response from the advanced settings & then you need to configure RBAC to use this feature. Ref: https://learn.microsoft.com/en-us/defender-endpoint/live-response?view=o365-worldwide#before-you-begin

C is no good, trick answer, supposed to be automatic REMEDIATION.. so then D is the Answer.

ChatGPT No, initiating remote shell connections does not necessarily require automated investigations. Remote shell connections allow administrators to access a command-line interface on a remote device for troubleshooting, management, and other administrative tasks.

What comes first between enabling the service and assigning access? You need to have service first before you can assign access.

For enabling the service first

D is correct

"What should you do first?" A live response becomes a viable option only if the user possesses the RBAC permission to investigate, making "D" the appropriate answer. D - Configure role based access control (RBAC)

i dont know how you all say RBAC it is Purely https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/live-response?view=o365-worldwide#before-you-begin Enable live response from the advanced settings page.

Option D for Roles