Exam SC-200 topic 1 question 58 discussion

Collect investigation package works with Linux and MacOS - March.8.2024

Tested this on a Linux device and collect investigation package now works so would go for C in the exam now

C correct

Collects a package of diagnostic information from the device, including logs and system information

Collect investigation package

so I had an issue with Sc-200 working with 3 generative AI but in regards to this question they all agreed it's a C so you gotta give the that

Ran it in Copilot and its C To initiate the collection of investigation packages from the Linux devices onboarded to Microsoft Defender for Endpoint, you should use: C. Collect investigation package: This action allows you to download an investigation package (ZIP file) containing relevant data and evidence related to the alert or incident. By selecting this option, you can gather the necessary information for further analysis and response.

Obviously "Collect investigation package is" (now) supported on Linux/Mac, if we can believe teh documentation here :https://learn.microsoft.com/en-us/defender-endpoint/respond-machine-alerts#collect-investigation-package-from-devices

I think now you can collect investigation package on Linux, it says here: https://learn.microsoft.com/en-us/defender-endpoint/respond-machine-alerts#collect-investigation-package-from-devices So if i see this question on exam, i will go for C)

I initially thought B. however since its not supported for linux machines its live response. so option D!

I initially thought B. however since its not supported for linux machines its live response. so option D!

D is correct. Initiate Live Response.

Linux VMs https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/respond-machine-alerts?view=o365-worldwide#initiate-live-response-session

answer is correct https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/respond-machine-alerts?view=o365-worldwide#initiate-live-response-session

Option D as it is Linux

Answer is correct. You initiate the live response on Linux and run "collect" command .