SC-200 · Question #343
You have a Microsoft 365 subscription that uses Microsoft Defender for Endpoint and contains the devices shown in the following table. You initiate a live response session on each device. You need…
The correct answer is C. Device3 and Device4 only. Advanced live response commands in Microsoft Defender for Endpoint - including the ability to collect investigation packages from the CLI - require specific OS versions. Based on the device table referenced in the question, Device3 and Device4 run operating systems that fully…
Question
You have a Microsoft 365 subscription that uses Microsoft Defender for Endpoint and contains the devices shown in the following table. You initiate a live response session on each device. You need to collect a Defender for Endpoint investigation package from each device. On which devices can you collect the package by running advanced live response commands from the command-line interface (CLI)?
Options
- ADevice1 and Device2 only
- BDevice1, Device2, and Device3 only
- CDevice3 and Device4 only
- DDevice1, Device2, Device3, and Device4
How the community answered
(43 responses)- A16% (7)
- B5% (2)
- C72% (31)
- D7% (3)
Explanation
Advanced live response commands in Microsoft Defender for Endpoint - including the ability to collect investigation packages from the CLI - require specific OS versions. Based on the device table referenced in the question, Device3 and Device4 run operating systems that fully support advanced live response (typically macOS, Linux, or Windows 10 version 1903+ / Windows Server 2019+). Device1 and Device2 run older or unsupported OS versions (such as Windows 7, Windows 8.1, or Windows Server 2012 R2) where only basic live response commands are available. The investigation package collection via CLI is an advanced command and is therefore limited to Device3 and Device4.
Community Discussion
No community discussion yet for this question.