Exam SC-200 topic 6 question 17 discussion

Correct. Deep analysis currently supports extensive analysis of portable executable (PE) files (including .exe and .dll files). PE files typically have .exe or .dll extensions (executable programs or applications). https://learn.microsoft.com/en-us/defender-endpoint/respond-file-alerts#deep-analysis

I logged into XDR to check this and grabbed a ps1 file. On the DA tab this is the message it shows Submitting file to deep analysis collects the file from the device or from Microsoft sample store if the file already exists. Collecting the file can take up to 3 hours depending on file and device availability. The collected file is analyzed in a secured environment and a detailed report is created.  File type not supported Deep analysis currently supports analysis of portable executable (PE) files (for example, .exe and .dll files).

You need to submit files for deep analysis in Microsoft Defender XDR. PowerShell script files can you submit? Sent by Copilot: Yes, you can submit PowerShell script files for deep analysis in Microsoft Defender XDR.

https://learn.microsoft.com/en-us/defender-endpoint/respond-file-alerts#deep-analysis Note Only PE files are supported, including .exe and .dll files.

Answer generated by CoPilot: In Microsoft Defender XDR, the following file types can be submitted for deep analysis: • Executable files (.exe, .dll) • Document files (.doc, .docx, .xls, .xlsx, .ppt, .pptx) • PDF files (.pdf) • Script files (.js, .vbs, .ps1) • Archive files (.zip, .rar, .tar, .gz) Please note that the ability to submit a file for deep analysis does not guarantee that meaningful results will be obtained for all file types. The effectiveness of deep analysis can vary depending on the specific characteristics of each file type.