SC-200 Certification Practice Question #233

Question

You have a Microsoft 365 E5 subscription that contains a device named Device1.

From the Microsoft Defender portal, you discover that an alert was triggered for Device1.

From the Device inventory page, you isolate Device1.

You need to collect a list of installed programs on Device1.

What should you do?

Accepted Answer

This variant deliberately omits the DeviceTvmSoftwareInventory option, so the correct path to a list of installed programs is the investigation package, whose contents per MS Learn explicitly include an "Installed programs" CSV. The distractor table DeviceTvmInfoGathering captures configuration/attack-surface assessment events rather than software inventory, DeviceProcessEvents is running-process activity, and live response `analyze` inspects a file. Suggested Answer, the dominant Most Voted (8) with the author's explicit correction, and MS Learn all point to A.

More SC-200 practice questions