The correct action is to initiate a Live Response session. This is because Live Response in Microsoft 365 Defender provides a remote shell connection to the device, allowing the analyst to run commands like 'getfile' to collect a specific suspicious file for offline analysis without disrupting the user’s workflow or rebooting the machine. On the SC-200 exam, this scenario tests your understanding of how Live Response enables targeted, real-time file collection while the device remains operational, distinguishing it from broader actions like full device isolation or running a virus scan. A common trap is confusing Live Response with automated investigation or submission to Microsoft for analysis, which do not offer the same granular, user-transparent file retrieval. Remember the memory tip: “Live Response gets the file live, without a reboot or user strife.”
SC-200 Mitigate threats using Microsoft Defender XDR Practice Question
This SC-200 practice question tests your understanding of mitigate threats using microsoft defender xdr. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. A key principle to apply: live Response provides remote command-line access to devices.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A security analyst is investigating an incident in Microsoft 365 Defender where a user's device is suspected to be compromised. The analyst wants to collect a copy of a specific suspicious file from the device for offline analysis without disrupting the user. Which action should the analyst initiate?
Live Response provides a remote command-line interface to the device, enabling the analyst to collect files and perform investigation without isolating or disrupting the user.
B
Isolate the device from the network
Why wrong: Isolating the device would disrupt the user's connectivity and may not be desired if the goal is non-disruptive collection.
C
Initiate an automated investigation
Why wrong: Automated investigation may not specifically collect a user-specified file; it focuses on automated remediation based on alerts.
D
Run a full antivirus scan
Why wrong: A full antivirus scan will detect and potentially remove threats but does not collect a copy of the file for external analysis.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Initiate a Live Response session
A Live Response session allows the analyst to remotely connect to the device in real time, collect a specific suspicious file via commands like 'getfile', and download it for offline analysis without interrupting the user's workflow. This is the only action that provides targeted file collection while the device remains operational.
Key principle: Live Response provides remote command-line access to devices.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
Initiate a Live Response session
Why this is correct
Live Response provides a remote command-line interface to the device, enabling the analyst to collect files and perform investigation without isolating or disrupting the user.
Related concept
Live Response provides remote command-line access to devices.
✗
Isolate the device from the network
Why it's wrong here
Isolating the device would disrupt the user's connectivity and may not be desired if the goal is non-disruptive collection.
✗
Initiate an automated investigation
Why it's wrong here
Automated investigation may not specifically collect a user-specified file; it focuses on automated remediation based on alerts.
✗
Run a full antivirus scan
Why it's wrong here
A full antivirus scan will detect and potentially remove threats but does not collect a copy of the file for external analysis.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates confuse 'Live Response' with 'isolation' or 'automated investigation', thinking that any remediation action can collect files, but only Live Response provides the granular, non-disruptive file collection capability required for offline analysis.
Detailed technical explanation
How to think about this question
Live Response uses a secure, authenticated channel over HTTPS to the Microsoft Defender for Endpoint sensor, enabling commands such as 'getfile', 'run', and 'processes'. The analyst can specify the exact file path, and the sensor streams the file in chunks to the cloud, where it can be downloaded as a ZIP archive. This is critical in ransomware scenarios where the file must be preserved as evidence without triggering encryption or deletion.
KKey Concepts to Remember
Live Response provides remote command-line access to devices.
It enables real-time investigation and remediation actions.
Analysts can collect files, run scripts, and terminate processes.
Actions are performed without necessarily disrupting the end-user.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Live Response provides remote command-line access to devices.
Real-world example
How this comes up in practice
A healthcare organisation deploys an application with a public-facing web tier and a private database tier. The database subnet has no public IP and only accepts connections from the web tier's security group. Questions like this test whether you can design cloud network isolation using VNets/VPCs, subnets, and security group rules.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this SC-200 question in full detail.
Review live Response provides remote command-line access to devices., then practise related SC-200 questions on the same topic to reinforce the concept.
Mitigate threats using Microsoft Defender XDR — This question tests Mitigate threats using Microsoft Defender XDR — Live Response provides remote command-line access to devices..
What is the correct answer to this question?
The correct answer is: Initiate a Live Response session — A Live Response session allows the analyst to remotely connect to the device in real time, collect a specific suspicious file via commands like 'getfile', and download it for offline analysis without interrupting the user's workflow. This is the only action that provides targeted file collection while the device remains operational.
What should I do if I get this SC-200 question wrong?
Review live Response provides remote command-line access to devices., then practise related SC-200 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
Live Response provides remote command-line access to devices.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.