You have a Microsoft 365 tenant that contains a Windows 10 device. The device is onboarded to Microsoft Defender for Endpoint. From Microsoft 365 Defender portal, you perform a security…

The correct answer is C. Initiate Live Response Session. Live response is designed to enhance investigations by enabling you to collect forensic data, run scripts, send suspicious entities for analysis, remediate threats, and proactively hunt for emerging…

Submitted by certguy· Apr 18, 2026Manage security and threats by using Microsoft Defender XDR

Question

You have a Microsoft 365 tenant that contains a Windows 10 device. The device is onboarded to Microsoft Defender for Endpoint. From Microsoft 365 Defender portal, you perform a security investigation. You need to run a PowerShell script on the device to collect forensic information. Which action should you select on the device page?

Options

ACollect investigation package
BGo hunt
CInitiate Live Response Session
DInitiate Automated Investigation

How the community answered

(29 responses)

A
3% (1)
B
7% (2)
C
79% (23)
D
10% (3)

Explanation

Live response is designed to enhance investigations by enabling you to collect forensic data, run scripts, send suspicious entities for analysis, remediate threats, and proactively hunt for emerging https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/respond-machine- alerts?view=o365-worldwide

Topics

#Microsoft Defender for Endpoint#Live Response#Security Investigation#Forensics

Community Discussion

No community discussion yet for this question.

Full MS-102 Practice