mediumMultiple ChoiceObjective-mapped
SC-200 Practice Question: A security analyst is investigating an incident…
A security analyst is investigating an incident in Microsoft 365 Defender where a user's device is suspected to be compromised. The analyst wants to collect a copy of a specific suspicious file from the device for offline analysis without disrupting the user. Which action should the analyst initiate?
⚠ Common exam trap
It's easy for candidates to confuse 'Live Response' with 'isolation' or 'automated investigation', thinking that any remediation action can collect files, but only Live Response provides the granular, non-disruptive file collection capability required for offline analysis.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Initiate a Live Response session
A Live Response session allows the analyst to remotely connect to the device in real time, collect a specific suspicious file via commands like 'getfile', and download it for offline analysis without interrupting the user's workflow. This is the only action that provides targeted file collection while the device remains operational.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Initiate a Live Response session
Why this is correct
Live Response is a Microsoft Defender for Endpoint capability that opens an authenticated, remote command-line shell to the device. Using commands like 'collectfile' or 'getfile', an analyst can retrieve a specific file copy without changing the system state or interrupting the user's session, making it ideal for preserving evidence and performing focused file collection.
- ✗
Isolate the device from the network
Why it's wrong here
Isolating the device reverses network connectivity, cutting off all communication except to the Defender service. This disruptive action stops lateral movement but does not gather any files; it is a containment step that prevents remote collection via network shares or APIs, and the user's access to resources is severely impacted, making it inappropriate for a non-disruptive collection task.
- ✗
Initiate an automated investigation
Why it's wrong here
Automated investigation executes predefined playbooks that respond to alerts, typically by running scans, quarantining threats, or suspending processes. It cannot be pointed to a specific file path for manual collection; its logic targets only entities identified as malicious in the alert, so a user-specified file may be overlooked entirely or altered by automated remediation actions before it can be analyzed.
- ✗
Run a full antivirus scan
Why it's wrong here
A full antivirus scan is a detection and remediation action that examines the device for known malware. While it might identify a malicious file, it does not produce a copy of the file for the analyst; the file may be quarantined, removed, or left in place, but the scan's output is a threat report, not a forensic artifact. It also consumes significant system resources and does not preserve the file's original state for external deep-dive analysis.
Go deeper
Related to this question
About these practice questions
One of 209 original SC-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.