Exam SC-200 All Questions

View all questions & answers for the SC-200 exam

Exam SC-200 topic 6 question 34 discussion

Actual exam question from Microsoft's SC-200

Question #: 34
Topic #: 6

DRAG DROP
-

You have an on-premises Windows 11 Pro device named Device1 that is onboarded to Microsoft Defender for Endpoint.

You have a Microsoft 365 subscription.

You need to identify the processes running on Device1 and which network connections the processes have open. The solution must minimize administrative effort.

Which four actions should you perform in the Microsoft Defender portal in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Show Suggested Answer

Suggested Answer:

by Charles_2002 at March 3, 2025, 1:29 p.m.

Comments

Submit Cancel

G57

1 month, 1 week ago

Navigate to the device page> collect investigation package>from the action center, invoke an action>extract the content of the zip file. I work with Defender on a daily basis and this is the way it's done.

upvoted 3 times

Krayzr

2 weeks, 6 days ago

Don't you have to INITIATE LIVE RESPONSE SESSION ? https://learn.microsoft.com/en-us/defender-endpoint/respond-machine-alerts#initiate-live-response-session

upvoted 1 times

...

Openbpo

1 month, 2 weeks ago

Navigate & Collect investigation package & from action invokee an action & Extract , read the doc https://learn.microsoft.com/en-us/defender-endpoint/respond-machine-alerts https://learn.microsoft.com/en-us/defender-endpoint/respond-machine-alerts

upvoted 1 times

...

d9b53a0

1 month, 3 weeks ago

The correct order is: Navigate to the device page for Device1 Select View Map. From the Action center, invoke an action. Initiate a live response session.

upvoted 1 times

...

rkrau

2 months ago

I go with Navigate to the device page for Device1 Initiate a live response session Collect and investigation package Extract the contents of the ZIP file

upvoted 2 times

G57

1 month ago

Why run a live response session if you need to download the investigation package?

upvoted 1 times

...

a_kto_to

2 months ago

Navigate to the device page for Device1 Collect and investigation package From the Action center, invoke an action Extract the contents of the ZIP file here link: https://learn.microsoft.com/en-us/defender-endpoint/respond-machine-alerts

upvoted 4 times

Krayzr

2 weeks, 6 days ago

Don't you have to INITIATE LIVE RESPONSE SESSION ? https://learn.microsoft.com/en-us/defender-endpoint/respond-machine-alerts#initiate-live-response-session

upvoted 1 times

...

Optimizor_IT

2 months ago

Navigate to the device page for Device1 Initiate a live response session From the Action center, invoke an action (run ps and net) Collect an investigation package (optional, for records, though not needed for live data)

upvoted 1 times

...

54c341a

3 months, 1 week ago

The first step as initiate live response session doesn't make sense. Initiating a live response session does nothing without then running commands. None of them really fit but the closest I think would be 'From the Action centre, invoke an action, with the action being collect an investigation package. Navigate to the device page for Device1 From the Action center, invoke an action Collect and investigation package Extract the contents of the ZIP file

upvoted 1 times

...

Charles_2002

3 months, 2 weeks ago

Navigate to Endpoints > Device inventory and select a device to investigate. The devices page opens first https://learn.microsoft.com/en-us/defender-endpoint/live-response

upvoted 1 times

Optimizor_IT

2 months ago

And your answer to the question is?

upvoted 1 times

...