The answer is Live Response, the correct feature for investigating process details like command line and parent process when an IOC is detected on an Azure VM. Live Response in Microsoft Defender for Cloud provides a remote shell connection that allows an analyst to run forensic commands in real time, directly inspecting running processes, their arguments, and parent-child relationships without needing to install additional agents. This capability is critical for the SC-200 exam’s “live response investigate process IOC” scenario, which tests your ability to perform deep, on-demand forensic analysis on a live system rather than relying on static alerts or automated investigation. A common trap is confusing Live Response with automated investigation or file analysis features, but remember that Live Response is the only tool that gives you a direct, interactive command-line session to probe process details. Memory tip: “Live” means you’re alive in the shell—run commands like `ps` or `Get-Process` to see the full picture.
SC-200 Practice Question: Mitigate threats using Microsoft Defender for Cloud
This SC-200 practice question tests your understanding of mitigate threats using microsoft defender for cloud. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. A key principle to apply: live response provides real-time access to an endpoint's operating system.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A security analyst receives an alert in Microsoft Defender for Cloud that an Azure virtual machine is running a process with a known indicator of compromise (IOC). The analyst wants to investigate the process details, including the command line and parent process. Which feature should the analyst use to gather this information from the VM?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Live response
Live Response in Microsoft Defender for Cloud provides a remote shell connection to the VM, allowing the analyst to run commands to inspect running processes, command-line arguments, and parent process details in real time. This is the correct feature for deep forensic investigation of an active IOC on the VM.
Key principle: Live response provides real-time access to an endpoint's operating system.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Vulnerability assessment
Why it's wrong here
Vulnerability assessment identifies missing updates and misconfigurations, not real-time process information.
✓
Live response
Why this is correct
Live response enables remote investigation of a VM, including process listing and command-line analysis.
Related concept
Live response provides real-time access to an endpoint's operating system.
✗
Inventory of resources
Why it's wrong here
Inventory shows metadata about Azure resources but does not provide guest OS process details.
✗
Secure score
Why it's wrong here
Secure score measures overall security posture, not per-process investigation.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates confuse Live Response with Vulnerability Assessment or Inventory, thinking those can provide process-level details, but only Live Response offers interactive, real-time forensic access to the VM's operating system.
Trap categories for this question
Command / output trap
Inventory shows metadata about Azure resources but does not provide guest OS process details.
Detailed technical explanation
How to think about this question
Live Response uses a secure, encrypted channel (WinRM over HTTPS for Windows, SSH for Linux) to execute commands like `Get-Process` or `ps aux` with full command-line and parent process information. Under the hood, it leverages the Microsoft Defender for Endpoint sensor installed on the VM to collect and stream process creation events, which are then correlated with IOC databases for real-time threat hunting.
KKey Concepts to Remember
Live response provides real-time access to an endpoint's operating system.
It allows execution of commands to gather forensic data like process details.
Live response can be used to collect files, terminate processes, and isolate devices.
It integrates with Microsoft Defender for Endpoint for server protection in Defender for Cloud.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Live response provides real-time access to an endpoint's operating system.
Real-world example
How this comes up in practice
An e-commerce site experiences heavy traffic on Black Friday and near-zero traffic during off-peak weeks. Rather than provisioning permanent large VMs, the team uses auto-scaling groups that add capacity automatically under load and reduce it overnight. Questions like this test whether you understand elasticity, availability zones, and cloud compute scaling patterns.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this SC-200 question in full detail.
Review live response provides real-time access to an endpoint's operating system., then practise related SC-200 questions on the same topic to reinforce the concept.
Mitigate threats using Microsoft Defender for Cloud — This question tests Mitigate threats using Microsoft Defender for Cloud — Live response provides real-time access to an endpoint's operating system..
What is the correct answer to this question?
The correct answer is: Live response — Live Response in Microsoft Defender for Cloud provides a remote shell connection to the VM, allowing the analyst to run commands to inspect running processes, command-line arguments, and parent process details in real time. This is the correct feature for deep forensic investigation of an active IOC on the VM.
What should I do if I get this SC-200 question wrong?
Review live response provides real-time access to an endpoint's operating system., then practise related SC-200 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
Live response provides real-time access to an endpoint's operating system.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.