SC-200 Certification Practice Question #222

Question

You have a Microsoft 365 subscription that uses Microsoft Defender for Endpoint Plan 2 and contains a Windows device named Device1.
You initiate a live response session on Device1 and launch an executable file named File1.exe in the background.

You need to perform the following actions:

•	Identify the command ID of File1.exe.
•	Interact with File1.exe.

Which live response command should you run for each action? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Accepted Answer

File1.exe was launched in the background during a live response session, which makes it a job. The `jobs` command "shows currently running jobs, their ID and status," so it is how you identify the command ID — the `processes` command would return a PID, not the command ID the next step needs. To interact with (resume/foreground) that background job you use `fg <command ID>`, which MS Learn explicitly notes "takes a command ID available from jobs, not a PID." This jobs → fg pairing is the overwhelming community consensus (rsanx42 26 👍, smanzana 6 👍, plus MomenAWS and Cognac85) and is directly grounded in the live-response command reference. Confidence is 88 rather than higher because no Suggested Answer is recorded and a minority initially argued processes/connect, but the documentation cleanly resolves it.

More SC-200 practice questions