SC-200 · Question #363
You have a Microsoft 365 E5 subscription that contains a device named Device1. From the Microsoft Defender portal, you discover that an alert was triggered for Device1. From the Device inventory…
The correct answer is B. Run an advanced hunting query against the DeviceTvmSoftwareInventory table. To collect a list of installed programs on Device1, run an advanced hunting query against the DeviceTvmSoftwareInventory table in Microsoft Defender for Endpoint.
Question
You have a Microsoft 365 E5 subscription that contains a device named Device1. From the Microsoft Defender portal, you discover that an alert was triggered for Device1. From the Device inventory page, you isolate Device1. You need to collect a list of installed programs on Device1. What should you do?
Options
- ARun an advanced hunting query against the DeviceProcessEvents table.
- BRun an advanced hunting query against the DeviceTvmSoftwareInventory table.
- CInitiate an automated investigation and view the results in the Action center.
- DInitiate a live response session and run the processes command.
How the community answered
(37 responses)- A3% (1)
- B73% (27)
- C8% (3)
- D16% (6)
Why each option
To collect a list of installed programs on Device1, run an advanced hunting query against the `DeviceTvmSoftwareInventory` table in Microsoft Defender for Endpoint.
The `DeviceProcessEvents` table logs process creation and execution, not a static inventory of all installed software on a device.
The `DeviceTvmSoftwareInventory` table in advanced hunting specifically stores detailed information about all installed software on devices, making it the most direct and efficient source for collecting a comprehensive list of installed programs.
Initiating an automated investigation primarily focuses on resolving the alert and associated entities, and its outputs in the Action center do not typically include a full, dedicated list of all installed programs.
Initiating a live response session and running the `processes` command would list currently running processes, not a comprehensive list of all installed programs on the device.
Concept tested: Microsoft Defender for Endpoint advanced hunting tables (software inventory)
Source: learn.microsoft.com/microsoft-365/security/defender-endpoint/device-software-inventory-tables
Community Discussion
No community discussion yet for this question.