SC-200 Certification Practice Question #220

Question

You have a Microsoft 365 subscription that uses Microsoft Defender XDR and contains a Windows device named Device1.

The timeline of Device1 includes three files named File1.ps1, File2.exe, and File3.dll.

You need to submit files for deep analysis in Microsoft Defender XDR.

Which files can you submit?

Accepted Answer

Microsoft Defender XDR / Defender for Endpoint deep analysis runs a submitted file in an instrumented cloud sandbox, and MS Learn states only Portable Executable (PE) files — specifically .exe and .dll — are supported. PowerShell scripts (.ps1) are interpreted text, not PE binaries, and the portal explicitly returns "File type not supported" for them (confirmed by Itsmebigal's hands-on test). The Suggested Answer (D), the unanimous Most Voted (D, 16 votes), the top Highly Voted comment, and the documentation all agree, so File2.exe and File3.dll only is the answer. The only dissent comes from unverified Copilot/ChatGPT output that the docs directly contradict.

More SC-200 practice questions