nerdexam
Microsoft

SC-200 · Question #363

You have a Microsoft 365 E5 subscription that contains a device named Device1. From the Microsoft Defender portal, you discover that an alert was triggered for Device1. From the Device inventory…

The correct answer is B. Run an advanced hunting query against the DeviceTvmSoftwareInventory table. To collect a list of installed programs on Device1, run an advanced hunting query against the DeviceTvmSoftwareInventory table in Microsoft Defender for Endpoint.

Submitted by valeria.br· Apr 18, 2026

Question

You have a Microsoft 365 E5 subscription that contains a device named Device1. From the Microsoft Defender portal, you discover that an alert was triggered for Device1. From the Device inventory page, you isolate Device1. You need to collect a list of installed programs on Device1. What should you do?

Options

  • ARun an advanced hunting query against the DeviceProcessEvents table.
  • BRun an advanced hunting query against the DeviceTvmSoftwareInventory table.
  • CInitiate an automated investigation and view the results in the Action center.
  • DInitiate a live response session and run the processes command.

How the community answered

(37 responses)
  • A
    3% (1)
  • B
    73% (27)
  • C
    8% (3)
  • D
    16% (6)

Why each option

To collect a list of installed programs on Device1, run an advanced hunting query against the `DeviceTvmSoftwareInventory` table in Microsoft Defender for Endpoint.

ARun an advanced hunting query against the DeviceProcessEvents table.

The `DeviceProcessEvents` table logs process creation and execution, not a static inventory of all installed software on a device.

BRun an advanced hunting query against the DeviceTvmSoftwareInventory table.Correct

The `DeviceTvmSoftwareInventory` table in advanced hunting specifically stores detailed information about all installed software on devices, making it the most direct and efficient source for collecting a comprehensive list of installed programs.

CInitiate an automated investigation and view the results in the Action center.

Initiating an automated investigation primarily focuses on resolving the alert and associated entities, and its outputs in the Action center do not typically include a full, dedicated list of all installed programs.

DInitiate a live response session and run the processes command.

Initiating a live response session and running the `processes` command would list currently running processes, not a comprehensive list of all installed programs on the device.

Concept tested: Microsoft Defender for Endpoint advanced hunting tables (software inventory)

Source: learn.microsoft.com/microsoft-365/security/defender-endpoint/device-software-inventory-tables

Community Discussion

No community discussion yet for this question.

Full SC-200 Practice