SC-200 · Question #408
You have a Microsoft 365 E5 subscription that contains a device named Device1. From the Microsoft Defender portal, you discover that an alert was triggered for Device1. From the Device inventory…
The correct answer is A. Collect an investigation package and download the results from the Action center. To collect a list of installed programs from an isolated device in Microsoft Defender for Endpoint, you should initiate an investigation package collection.
Question
You have a Microsoft 365 E5 subscription that contains a device named Device1. From the Microsoft Defender portal, you discover that an alert was triggered for Device1. From the Device inventory page, you isolate Device1. You need to collect a list of installed programs on Device1. What should you do?
Options
- ACollect an investigation package and download the results from the Action center.
- BInitiate a live response session and run the analyze command.
- CRun an advanced hunting query against the DeviceProcessEvents table.
- DRun an advanced hunting query against the DeviceTvmInfoGathering table.
How the community answered
(39 responses)- A77% (30)
- B13% (5)
- C3% (1)
- D8% (3)
Why each option
To collect a list of installed programs from an isolated device in Microsoft Defender for Endpoint, you should initiate an investigation package collection.
Collecting an investigation package is a feature in Microsoft Defender for Endpoint designed to gather comprehensive forensic data from a device, which explicitly includes a list of installed applications. The results are then available for download from the Action center for analysis.
The `analyze` command is not a standard or valid command within a Microsoft Defender for Endpoint live response session for enumerating installed programs; specific commands or scripts are typically used for this purpose.
The `DeviceProcessEvents` table in advanced hunting records process creation and other process-related activities, not a complete inventory of all installed programs on a device.
While Threat and Vulnerability Management tables like `DeviceTvmSoftwareInventory` or `DeviceTvmSoftwareEvidence` contain software inventory, `DeviceTvmInfoGathering` is less direct, and an investigation package is the specific action to actively collect a real-time, comprehensive list of installed programs from an isolated device as part of an incident response.
Concept tested: Collecting forensic data and installed programs via investigation package
Source: https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/collect-investigation-package
Community Discussion
No community discussion yet for this question.