SC-200 Certification Practice Question #45

Question

You have a Microsoft 365 E5 subscription that contains 100 Linux devices. The devices are onboarded to Microsoft Defender 365.

You need to initiate the collection of investigation packages from the devices by using the Microsoft 365 Defender portal.

Which response action should you use?

Accepted Answer

The task is to initiate collection of investigation packages from Linux devices via the Microsoft Defender portal. MS Learn now documents the investigation-package contents specifically for Mac and Linux devices, confirming the "Collect investigation package" response action supports Linux. While Live Response (D) exposes a `collect` command on Linux, the question asks for the dedicated response action that collects the package, which is "Collect investigation package." The official Suggested Answer, the 14-vote community majority, and the two highest-voted comments (with hands-on testing as recent as Sep 2025) all align on C. Confidence is held just below 90 because the D dissent reflects a previously valid state before Linux support shipped, so older study material may still show D.

More SC-200 practice questions