SC-200 · Question #302
You have a Microsoft 365 subscription that uses Microsoft Defender for Endpoint Plan 2 and contains 1,000 Windows devices. You have a PowerShell script named Script1.ps1 that is signed digitally…
The correct answer is B. Upload Script1.ps1 to the library. To run a digitally signed PowerShell script within a Microsoft Defender for Endpoint live response session, you must first upload the script to the live response library.
Question
You have a Microsoft 365 subscription that uses Microsoft Defender for Endpoint Plan 2 and contains 1,000 Windows devices. You have a PowerShell script named Script1.ps1 that is signed digitally. You need to ensure that you can run Script1.ps1 in a live response session on one of the devices. What should you do first from the live response session?
Options
- ARun the library command.
- BUpload Script1.ps1 to the library.
- CRun the putfile command.
- DModify the PowerShell execution policy of the device.
How the community answered
(33 responses)- A3% (1)
- B76% (25)
- C6% (2)
- D15% (5)
Why each option
To run a digitally signed PowerShell script within a Microsoft Defender for Endpoint live response session, you must first upload the script to the live response library.
The `library` command is used to list scripts already in the library, not to upload them or prepare them for execution.
For security reasons, scripts intended to be run during a live response session in Microsoft Defender for Endpoint must first be uploaded to the dedicated live response library in the Defender portal. This ensures that only approved and vetted scripts can be executed on devices, maintaining a secure and controlled environment for investigation and remediation.
The `putfile` command is used to write a file from the live response session to the device, or to upload a file from the device to the console, not to make a script available for execution within live response.
While PowerShell execution policy can affect script execution, the primary and required step to enable a script to be run in a live response session is to upload it to the Defender for Endpoint script library; the library execution bypasses local execution policy for approved scripts.
Concept tested: Defender for Endpoint live response script execution
Source: https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/live-response-prerequisites#create-a-script-library
Community Discussion
No community discussion yet for this question.