SC-200 Respond to security incidents Practice Question
Which THREE are valid methods to collect forensic evidence from a compromised Windows machine during incident response in Microsoft Defender XDR? (Choose three.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Collect a memory dump from the device using Live Response
Options B, D, and E are correct: Live Response allows script execution and file collection; collecting a memory dump captures volatile evidence necessary for forensic analysis; exporting Windows Event Logs provides a timeline of events. Option A is incorrect because resetting the device destroys evidence instead of preserving it. Option C is incorrect because full disk imaging is not natively supported in Microsoft Defender XDR; it requires external tools.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Reset the device to a clean state
Why it's wrong here
Resetting destroys evidence.
- ✓
Collect a memory dump from the device using Live Response
Why this is correct
Memory dump captures running processes and network connections.
- ✗
Perform a full disk image using Microsoft Defender for Endpoint
Why it's wrong here
Not supported; disk imaging requires external tools.
- ✓
Run Live Response commands to collect files and run scripts
Why this is correct
Live Response is a built-in feature for forensic collection.
- ✓
Export Windows Event Logs using Live Response
Why this is correct
Event logs provide critical timeline information.
Go deeper
Related to this question
About these practice questions
This SC-200 question is part of Courseiva's 209-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.