Exam SC-200 topic 4 question 32 discussion

Actual exam question from Microsoft's SC-200

Question #: 32
Topic #: 4

HOTSPOT
-

You have a Microsoft 365 subscription. The subscription contains 500 Windows 11 devices that are onboarded to Microsoft Defender for Endpoint.

You need to configure Defender for Endpoint to meet the following requirements:

• Ensure that security operation analysts can run PowerShell scripts on client computers.
• Perform the automatic remediation of threats on client computers.

Which Endpoints settings should you configure in the Microsoft Defender XDR portal? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Show Suggested Answer

Suggested Answer:

by Krayzr at June 13, 2025, 7:58 p.m.

Comments

Submit Cancel

Krayzr

1 day, 19 hours ago

To ensure that the analysts can run PowerShell scripts: Live Response in Advanced features Explanation: Live Response is the feature in Microsoft Defender for Endpoint that provides security operations analysts with remote shell access to devices. This allows them to run PowerShell scripts and other commands for in-depth investigation and immediate response actions. To perform the automatic remediation of threats: Automatically resolve alerts in Advanced features Explanation: This setting controls the level of automation for Microsoft Defender for Endpoint's automated investigation and response (AIR) capabilities. Selecting "Automatically resolve alerts" (often referred to as "Full automation") allows the system to automatically remediate threats it finds during an investigation without requiring manual approval.

upvoted 1 times

...