SC-200 Certification Practice Question #228

Question

You have an on-premises Windows 11 Pro device named Device1 that is onboarded to Microsoft Defender for Endpoint.

You have a Microsoft 365 subscription.

You need to identify the processes running on Device1 and which network connections the processes have open. The solution must minimize administrative effort.

Which four actions should you perform in the Microsoft Defender portal in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Accepted Answer

The requirement — list the processes running on Device1 *and* the network connections those processes have open, with minimal administrative effort — maps precisely to the Defender for Endpoint **investigation package**, which MS Learn confirms bundles a Processes .CSV (running processes) and a Network connections folder (`ActiveNetConnections.txt` = current TCP/IP connections per process) in a single packaged action. The documented portal flow is: open the device page, choose Collect investigation package, then go to the Action center to invoke/download the action, and finally extract the ZIP — exactly the four tiles in order. The competing live-response/netstat ordering (favored by a few 1-👍 comments) would technically surface similar data but demands an interactive remote shell and manual commands, which violates the "minimize administrative effort" clause, so it loses. The top Highly Voted comment (9 👍) and the next-strongest reply (4 👍) both land on this exact sequence, aligning with the docs; confidence is 84% rather than higher because the file carries no official Suggested Answer and the thread shows a genuine (if weaker) live-response split.

More SC-200 practice questions