The correct action is to initiate the 'Collect investigation package' action from the device’s entity page. This is the right choice because it automatically gathers a comprehensive forensic bundle—including the suspicious file, registry keys, memory dumps, and other artifacts—without requiring direct interactive access to the isolated device. On the Microsoft Security Operations Analyst SC-200 exam, this scenario tests your understanding of automated investigation and response (AIR) workflows, specifically how to collect an investigation package from a device for sandbox analysis. A common trap is confusing this with “Run antivirus scan” or “Initiate live response,” but the key distinction is that the collect investigation package action is purpose-built for one-click, non-interactive forensic collection. Remember the memory tip: “Package for the sandbox, not a live box”—if the device is already isolated and you need files for analysis, always choose the collect investigation package action.
SC-200 Mitigate threats using Microsoft Defender XDR Practice Question
This SC-200 practice question tests your understanding of mitigate threats using microsoft defender xdr. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. A key principle to apply: collects a compressed package of forensic data from a device.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
An analyst is investigating a malware incident in Microsoft 365 Defender and has isolated the compromised device using automated investigation and response. The analyst now needs to collect a copy of a suspicious file from that device for further analysis in a sandbox. Which action should the analyst take from the device's entity page?
This action collects a package of files, processes, and other data from the device, including suspicious files, for analysis.
B
Run a live response session and manually download the file.
Why wrong: Live response is possible but requires establishing a session and manual steps; the automated 'Collect investigation package' is simpler and standard.
C
Use the 'Add indicator' to allow the file and then collect.
Why wrong: Adding an indicator affects detection, not file collection.
D
Use the 'Device isolation' action to isolate again with different settings.
Why wrong: Isolation only restricts network, it does not collect files.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Initiate 'Collect investigation package' action.
The 'Collect investigation package' action is the correct choice because it is specifically designed to gather a comprehensive set of forensic data from a device, including suspicious files, without requiring interactive access. This action automatically collects the file and other relevant artifacts, which can then be submitted to Microsoft 365 Defender's sandbox for analysis. It is a one-click, automated process that aligns with the analyst's need to obtain a copy of the file for further investigation.
Key principle: Collects a compressed package of forensic data from a device.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
Initiate 'Collect investigation package' action.
Why this is correct
This action collects a package of files, processes, and other data from the device, including suspicious files, for analysis.
Related concept
Collects a compressed package of forensic data from a device.
✗
Run a live response session and manually download the file.
Why it's wrong here
Live response is possible but requires establishing a session and manual steps; the automated 'Collect investigation package' is simpler and standard.
✗
Use the 'Add indicator' to allow the file and then collect.
Why it's wrong here
Adding an indicator affects detection, not file collection.
✗
Use the 'Device isolation' action to isolate again with different settings.
Why it's wrong here
Isolation only restricts network, it does not collect files.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often confuse the 'Collect investigation package' action with a live response session, assuming manual file download is required, but the exam tests the understanding that automated collection is the preferred method for gathering forensic data from an isolated device without interactive overhead.
Detailed technical explanation
How to think about this question
The 'Collect investigation package' action leverages the Microsoft Defender for Endpoint sensor to gather a ZIP file containing the device's registry, event logs, memory dump, and specific files from predefined locations, such as suspicious files identified during automated investigation. This package can be directly submitted to the Microsoft 365 Defender sandbox (deep analysis) for behavioral analysis, which uses a hypervisor-based environment to detonate the file safely. The action is asynchronous and can be initiated even if the device is offline, with results stored in the portal for later retrieval.
KKey Concepts to Remember
Collects a compressed package of forensic data from a device.
Includes suspicious files, event logs, and running processes.
Automates secure upload to the cloud for analysis.
Initiated from the device's entity page in Microsoft 365 Defender.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Collects a compressed package of forensic data from a device.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this SC-200 question in full detail.
Review collects a compressed package of forensic data from a device., then practise related SC-200 questions on the same topic to reinforce the concept.
Mitigate threats using Microsoft Defender XDR — This question tests Mitigate threats using Microsoft Defender XDR — Collects a compressed package of forensic data from a device..
What is the correct answer to this question?
The correct answer is: Initiate 'Collect investigation package' action. — The 'Collect investigation package' action is the correct choice because it is specifically designed to gather a comprehensive set of forensic data from a device, including suspicious files, without requiring interactive access. This action automatically collects the file and other relevant artifacts, which can then be submitted to Microsoft 365 Defender's sandbox for analysis. It is a one-click, automated process that aligns with the analyst's need to obtain a copy of the file for further investigation.
What should I do if I get this SC-200 question wrong?
Review collects a compressed package of forensic data from a device., then practise related SC-200 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
Collects a compressed package of forensic data from a device.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.