In Microsoft Defender for Endpoint, what is the purpose of collecting an investigation package from a device?

To update the device's security intelligence

To automatically remediate all detected threats on the device

To change the device's group policy settings

To gather a bundle of forensic evidence for offline analysis

After containing a malware outbreak on several devices, you need to implement remediation to prevent the same malware from spreading again. The malware used a specific file share to propagate. What should you do?

Run a full antivirus scan on all devices and consider the incident resolved.

Block the file share path using indicators and ensure all affected devices are cleaned.

Only isolate the affected devices and leave the file share accessible.

Delete the file share from the server.

Microsoft Certified:Security Operations Analyst Associate

Domain 2Objective 2

Respond to Alerts and Incidents in Microsoft Defender for Endpoint SC-200 Practice Questions (Page 8)

Part of the Respond to security incidents domain, which accounts for 35–40% of the SC-200 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~14–26 in this domain), expect 5–9 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

7concepts

35–40%of the exam

Questions 36–37

36foundation · easy
In Microsoft Defender for Endpoint, what is the purpose of collecting an investigation package from a device?
Select an answer first
37application · medium
After containing a malware outbreak on several devices, you need to implement remediation to prevent the same malware from spreading again. The malware used a specific file share to propagate. What should you do?
Select an answer first

Finished these 2 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to SC-200

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-200” is a trademark of its owner, used for identification only.

Respond to Alerts and Incidents in Microsoft Defender for Endpoint SC-200 Practice Questions (Page 8)

Questions 36–37

In Microsoft Defender for Endpoint, what is the purpose of collecting an investigation package from a device?

After containing a malware outbreak on several devices, you need to implement remediation to prevent the same malware from spreading again. The malware used a specific file share to propagate. What should you do?

Keep studying — Respond to security incidents