Exam SC-200 topic 6 question 10 discussion

1.putfile 2. & putfile - Puts a file from the library to the device. Files are saved in a working folder and are deleted when the device restarts by default. https://learn.microsoft.com/en-us/defender-endpoint/live-response#live-response-commands

Another vague question it seems. putfile command will download the file from the "live response Library" to Device (The "device" here is the one with which you are connected via live response session.) getfile command will download a file from the Device. The "device" here is the one with which you are connected via live response session. Interestingly, as per the docs only the "getfile" command supports the background downloading. I did not see this mentioned for the "putfile" command. Ref: https://learn.microsoft.com/en-us/defender-endpoint/live-response#basic-commands

getfile: This is the correct command to use in the Microsoft Defender for Endpoint's live response session when you want to download a file from the library to the target device. The getfile command is specifically designed for retrieving files from the library to the device. &: The & symbol is used to indicate that the file download should be executed as a background process. This ensures that the command runs asynchronously, allowing other processes to continue without waiting for the file download to complete.

1) putfile 2) &

Correct answer: Here is the command getfile "C:\windows\some_file.exe" & (Starts downloading a file named some_file.exe in the background) https://learn.microsoft.com/en-us/defender-endpoint/live-response#put-a-file-in-the-library

PUTFILE is correct: PutFile: Puts a file from the library to the device. Files are saved in a working folder and are deleted when the device restarts by default. GetFile: Collect file from a device.

Correct: https://learn.microsoft.com/en-us/defender-endpoint/live-response#download-a-file-in-the-background

these answers should be, 1. Putfile - this command is used to download a file from the library to the device 2. & to make this a background task You have an Azure subscription that contains a user named User1 and a Microsoft Sentinel workspace named WS1. WS1 uses Microsoft Defender for Cloud. You have the Microsoft security analytics rules shown in the following table. User1 performs an action that matches Rule1, Rule2, Rule3, and Rule4. https://learn.microsoft.com/en-us/defender-endpoint/live-response#advanced-commands