SC-200 Certification Practice Question #42

Question

You have a Microsoft 365 E5 subscription that contains 100 Windows 10 devices.

You onboard the devices to Microsoft Defender 365.

You need to ensure that you can initiate remote shell connections to the onboarded devices from the Microsoft 365 Defender portal.

What should you do first?

Accepted Answer

The task is to "ensure that you *can initiate* remote shell connections," and per MS Learn, initiating a live response session is gated by RBAC — "only users who are provisioned with the appropriate permissions can initiate a session," and those permissions are the Basic/Advanced live response actions controlled by RBAC custom roles. Option C is the strongest distractor and the source of the community split, but it is worded as "enable **automated investigation**," which is a different advanced feature; the actual toggle is "live response," so C does not describe the correct enabling step and is eliminated on its wording. Even nsss (3 👍) calls this out: "That's not what option C says." Both the official Suggested Answer and the dominant community vote select D (23 votes vs C's 12), and the canonical RBAC requirement on MS Learn supports D. Confidence is held at 79 because there is a genuine, well-reasoned C faction (the live-response feature does also need enabling from Advanced features), but C's specific wording about "automated investigation" makes it wrong as written, leaving D as the defensible answer.

More SC-200 practice questions