SC-200 Certification Practice Question #224

Question

You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR and contains a Windows device named Device1.

You detect malicious activity on Device1.

You initiate a live response session on Device1.

You need to perform the following actions:

•	Download a file from the live response library.
•	Stop a process that is running on Device1.

Which live response command should you run for each action? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Accepted Answer

The trap is the word "download." In Live Response the library is a tenant-level store, and the only command that pulls a file FROM the library onto the target device is **putfile** ("Puts a file from the library to the device") per MS Learn — `getfile` does the reverse (device→portal) and `library` merely lists/manages library files. To stop a running process, **remediate** is the command whose Process action is "stop, delete image file"; `analyze` only reaches a verdict and `services`/`library` are unrelated. The 17-vote Highly Voted comment and three additional source-aligned comments back putfile, and remediate is unambiguous in the docs; the small minority favoring `library`/`getfile` is directly refuted by the command definitions, so confidence is high but not maximal given the deliberate ambiguity and lack of an official Suggested Answer.

More SC-200 practice questions