SC-200 Certification Practice Question #194

Question

You have a Microsoft 365 E5 subscription that uses Microsoft 365 Defender for Endpoint.

You need to ensure that you can initiate remote shell connections to Windows servers by using the Microsoft 365 Defender portal.

What should you configure? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Accepted Answer

To run a remote shell (live response) against Windows servers from the Microsoft Defender portal you must turn on the advanced feature "Live Response for Servers," which is the only listed option that grants remote shell access (Device discovery and EDR in block mode are unrelated). The second selection is contested between "device tag" and "Automation level," but the top-voted answer (25 👍) and the best-reasoned comment (Tuitor01, 6 👍) both cite the Defender requirement that a device must belong to an RBAC device group with an automated remediation level configured — otherwise a live-response session can't be established. A device tag merely groups devices and does not authorize remote shell, so it is discounted. Confidence is set in the mid-80s because of the genuine community split on row 2, with the documentation and the strongest vote weight favoring the Automation level.

More SC-200 practice questions