ExamTopics Logo
Mail Us[email protected]
Menu
Microsoft Discussions
exam questions

Exam SC-200 All Questions

View all questions & answers for the SC-200 exam
Go to Exam

Exam SC-200 topic 6 question 34 discussion

Actual exam question from Microsoft's SC-200
Question #: 34
Topic #: 6
[All SC-200 Questions]

DRAG DROP
-

You have an on-premises Windows 11 Pro device named Device1 that is onboarded to Microsoft Defender for Endpoint.

You have a Microsoft 365 subscription.

You need to identify the processes running on Device1 and which network connections the processes have open. The solution must minimize administrative effort.

Which four actions should you perform in the Microsoft Defender portal in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Show Suggested Answer Hide Answer
Suggested Answer:
by Charles_2002 at March 3, 2025, 1:29 p.m.

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
Submit Cancel
G57
Highly Voted 3 months, 1 week ago
Navigate to the device page> collect investigation package>from the action center, invoke an action>extract the content of the zip file. I work with Defender on a daily basis and this is the way it's done.
upvoted 5 times
JNGuru
3 days, 13 hours ago
Source: Trust me bro
upvoted 1 times
...
Krayzr
2 months, 3 weeks ago
Don't you have to INITIATE LIVE RESPONSE SESSION ? https://learn.microsoft.com/en-us/defender-endpoint/respond-machine-alerts#initiate-live-response-session
upvoted 1 times
...
...
ca5baba
Most Recent 1 week, 4 days ago
To get live running processes and their open network connections and as per ChatGPT 1. Navigate to Device for Device1 Page 2. Initiate a Live Response session 3. Run the netstat utility 4. Select view Map.
upvoted 1 times
...
JustLooking50
1 month, 1 week ago
navigate to device in Defender collect investigation package Action centre and invoke action, download the package basically Extract contend from zipped package
upvoted 2 times
...
Openbpo
3 months, 2 weeks ago
Navigate & Collect investigation package & from action invokee an action & Extract , read the doc https://learn.microsoft.com/en-us/defender-endpoint/respond-machine-alerts https://learn.microsoft.com/en-us/defender-endpoint/respond-machine-alerts
upvoted 1 times
...
d9b53a0
3 months, 3 weeks ago
The correct order is: Navigate to the device page for Device1 Select View Map. From the Action center, invoke an action. Initiate a live response session.
upvoted 1 times
...
rkrau
4 months ago
I go with Navigate to the device page for Device1 Initiate a live response session Collect and investigation package Extract the contents of the ZIP file
upvoted 2 times
G57
3 months ago
Why run a live response session if you need to download the investigation package?
upvoted 3 times
...
...
a_kto_to
4 months, 1 week ago
Navigate to the device page for Device1 Collect and investigation package From the Action center, invoke an action Extract the contents of the ZIP file here link: https://learn.microsoft.com/en-us/defender-endpoint/respond-machine-alerts
upvoted 4 times
Krayzr
2 months, 3 weeks ago
Don't you have to INITIATE LIVE RESPONSE SESSION ? https://learn.microsoft.com/en-us/defender-endpoint/respond-machine-alerts#initiate-live-response-session
upvoted 1 times
...
...
Optimizor_IT
4 months, 1 week ago
Navigate to the device page for Device1 Initiate a live response session From the Action center, invoke an action (run ps and net) Collect an investigation package (optional, for records, though not needed for live data)
upvoted 1 times
...
54c341a
5 months, 1 week ago
The first step as initiate live response session doesn't make sense. Initiating a live response session does nothing without then running commands. None of them really fit but the closest I think would be 'From the Action centre, invoke an action, with the action being collect an investigation package. Navigate to the device page for Device1 From the Action center, invoke an action Collect and investigation package Extract the contents of the ZIP file
upvoted 1 times
...
Charles_2002
5 months, 2 weeks ago
Navigate to Endpoints > Device inventory and select a device to investigate. The devices page opens first https://learn.microsoft.com/en-us/defender-endpoint/live-response
upvoted 1 times
Optimizor_IT
4 months, 1 week ago
And your answer to the question is?
upvoted 1 times
...
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel