SC-200 Respond to security incidents Practice Question
Which THREE are valid methods to collect forensic evidence from a compromised Windows machine during incident response in Microsoft Defender XDR? (Choose three.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Collect a memory dump from the device using Live Response
Options B, D, and E are correct: Live Response allows script execution and file collection; collecting a memory dump captures volatile evidence necessary for forensic analysis; exporting Windows Event Logs provides a timeline of events. Option A is incorrect because resetting the device destroys evidence instead of preserving it. Option C is incorrect because full disk imaging is not natively supported in Microsoft Defender XDR; it requires external tools.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Reset the device to a clean state
Why it's wrong here
Resetting to a clean state destroys volatile memory, disk artefacts and logs, eliminating the evidence rather than collecting it. It is tempting because device reset is a legitimate remediation action once evidence has been preserved and the incident is contained.
- ✓
Collect a memory dump from the device using Live Response
Why this is correct
Live Response in Microsoft Defender XDR supports running the `Get-File` and memory-dump collection commands directly on a compromised Windows endpoint, satisfying the requirement to gather volatile forensic evidence without disrupting the device. This preserves RAM contents that would otherwise be lost on shutdown, which is essential for incident response.
- ✗
Perform a full disk image using Microsoft Defender for Endpoint
Why it's wrong here
Microsoft Defender for Endpoint offers live response, evidence collection and investigation packages, not full disk imaging. It is tempting because it is the native forensic toolkit in Defender XDR, but imaging requires separate tools such as FTK Imager or dd.
- ✓
Run Live Response commands to collect files and run scripts
Why this is correct
Live Response provides a remote shell on the device, letting analysts run commands, retrieve files and execute scripts for triage. It collects volatile and persistent artefacts directly from the compromised host, satisfying the need for forensic evidence gathering within Defender XDR.
- ✓
Export Windows Event Logs using Live Response
Why this is correct
Live Response can run commands that export Windows Event Log channels to a file, which is then retrieved for offline analysis. This preserves authentication, process and system events as forensic evidence without disrupting the running endpoint.
Go deeper
Related to this question
About these practice questions
This SC-200 question is part of Courseiva's 1,303-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.