SC-200 Certification Practice Question #259

Question

You have a Microsoft 365 subscription.

You have the devices shown in the following table.

All the devices are onboarded to Microsoft Defender for Endpoint.

You are investigating a potential malware exploit on the devices.

You need to review the system log of each device. The solution must minimize disruptions to the devices.

What should you do for each device first in the Microsoft Defender portal?

Accepted Answer

The task is narrowly scoped: *review the system log* of each device while *minimizing disruptions*, doing it *first*. Collecting an investigation package is the dedicated non-intrusive response action whose contents explicitly include the device's Security/System event log (per MS Learn), and it runs silently in the background with no user-visible session. Live response (the Suggested Answer) does give log access, but only through an interactive remote shell that requires the analyst to be active on the machine — a heavier, more disruptive operation, and one not available across the mobile platforms shown (Android/iOS). Because the official Suggested Answer (D) contradicts the community Most Voted (B), confidence is lowered; MS Learn is the tiebreaker and favours the package collection for a pure "review the logs, minimize disruption" requirement, so B wins narrowly.

More SC-200 practice questions