Exam SC-200 topic 7 question 6 discussion

Answer A: The investigation package collected by defender includes all the required information and is considerable less admin effort than running a live response session and collecting this information interactively. https://learn.microsoft.com/en-us/defender-endpoint/respond-machine-alerts?view=o365-worldwide#collect-investigation-package-from-devices

A is correct. https://learn.microsoft.com/en-us/defender-endpoint/respond-machine-alerts?view=o365-worldwide#collect-investigation-package-from-devices

Those who claim that Live Response is the correct answer are wrong. While it is true that these tasks can achieved via live Response on a Windows device, we're talking about a MacOS device here, and, as I believe (and hope) you all know, many Live Response commands are not available for MacOS devices. Hence the correct answer is A - the investigation package.

A. From Devices, click Collect investigation package for Device1. This action is the most efficient first step, as it collects a comprehensive forensic package from Device1 that includes active network connections, running processes, and login history, meeting all requirements with minimal administrative effort.

The correct answer is C. From Devices, initiate a live response session on Devic

• Minimize administrative effort. A is Correct.

Asked copilot and answer is live session. While collecting an investigation package can provide a snapshot of the device’s current state, it may not offer the same level of detailed, real-time information and control as a live response session.

A https://learn.microsoft.com/en-us/defender-endpoint/respond-machine-alerts?view=o365-worldwide#collect-investigation-package-from-devices

checked chat-gpt and the answer is C Here's why: Initiating a live response session allows you to interact with Device1 in real-time. You can run commands to check active network connections, running processes, and retrieve the login history. Minimize administrative effort: Live response sessions provide direct access and control, which minimizes the need for additional configurations or complex procedures. The other options either involve additional steps that are not immediately necessary (like collecting an investigation package, which can be more comprehensive but less direct for immediate queries) or configurations that don't directly address the investigative tasks at hand. By starting a live response session, you can quickly gather the necessary information directly from Device1, fulfilling the investigation requirements effectively.

Minimize Administrative Effort: Live response sessions allow you to interact directly with the device, minimizing administrative overhead.

By initiating a live response session, you can achieve your investigation goals while minimizing administrative effort. Remember that live response provides real-time access to the device, allowing you to perform tasks directly on Device

live response session