Exam SC-200 topic 6 question 7 discussion

Actual exam question from Microsoft's SC-200

Question #: 7
Topic #: 6

HOTSPOT
-

You have a Microsoft 365 subscription that uses Microsoft Defender XDR and contains a Windows device named Device1.

You investigate a suspicious process named Prod on Device1 by using a live response session.

You need to perform the following actions:

• Stop Prod.
• Send Prod for further review.

Which live response command should you run for each action? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Show Suggested Answer

Suggested Answer:

by nzxt610 at April 30, 2024, 11:38 a.m.

Comments

Submit Cancel

nzxt610

Highly Voted 1 year, 3 months ago

Correct: https://learn.microsoft.com/en-us/defender-endpoint/live-response#live-response-commands

upvoted 10 times

...

g_man_rap

Highly Voted 12 months ago

Stop Proc1: Select: remediate Reason: The remediate command in Microsoft Defender XDR is used to stop a process or remediate a threat. This is the appropriate command to stop the suspicious process named Prod. Send Proc1 for further review: Select: getfile Reason: The getfile command is used to collect a file or process for further analysis. This command is appropriate when you want to send the process or its related files for further review.

upvoted 8 times

...

Adel614

Most Recent 4 months ago

Be careful here, PROC1 is not a file, but a process. It doesn't make any sense to download a process: a process is a computer program being executed. Therefore, the answer is: 1. remediate 2. analyze Refs: - https://learn.microsoft.com/en-us/defender-endpoint/live-response - https://learn.microsoft.com/en-us/defender-endpoint/live-response-command-examples#analyze

upvoted 2 times

...

Optimizor_IT

4 months, 1 week ago

Remediate and getfile.

upvoted 1 times

...

Onimole

5 months ago

2nd tab is get file - Get a file from the device For scenarios when you'd like get a file from a device you're investigating, you can use the getfile command. This allows you to save the file from the device for further investigation https://learn.microsoft.com/en-us/defender-endpoint/live-response#live-response-commands

upvoted 1 times

...