Collecting Forensic Data in Microsoft Defender XDR

SC-200 By islever Editorial Last updated

Respond to alerts and incidents in Microsoft Defender XDR

Short answer

D Collect an investigation package to automatically gather forensic data like processes and network connections on Device1 with minimal effort.

Question

You have a Microsoft 365 subscription that uses Microsoft Defender for Endpoint Plan 1 and contains a Windows 11 device named Device1.
A suspicious PowerShell activity alert is generated on Device1.
You need to collect forensic data from Device1. The solution must meet the following requirements:
• Include details of all the running processes and active network connections on Device1.
• Minimize administrative effort.
What should you do first in the Microsoft Defender portal?
  1. Restrict the execution of all applications.
  2. Contain Device1.
  3. Initiate a live response session.
  4. Collect an investigation package. Correct Answer

Key Takeaways

The key trap is confusing Live Response (manual, high effort) with Investigation Packages (automated, low effort) when the goal is rapid forensic collection.

Learn how to efficiently collect forensic data from Windows devices in Microsoft Defender XDR using the Investigation Package feature to capture processes and network connections.

Common mistake: Choosing Live Response (C) because it offers real-time control; however, it fails the 'minimize administrative effort' requirement compared to the automated Investigation Package.

Expert Analysis

Investigation Package vs. Live Response The question requires collecting forensic data, specifically running processes and active network connections, while minimizing administrative effort. In Microsoft Defender XDR, the Investigation Package is a pre-configured forensic tool designed exactly for this purpose. It automatically gathers a comprehensive set of artifacts from the endpoint, including process lists, network connections, registry keys, and event logs, into a single downloadable file.

Why Other Options Fail Option C, initiating a live response session, allows for real-time command-line interaction. While it can retrieve similar data, it requires manual commands (e.g., ps, netstat) and significant administrative effort to execute and interpret, violating the "minimize administrative effort" constraint. Option B, containing the device, is an incident response action to isolate the threat but does not inherently collect the requested forensic details. Option A restricts application execution and is unrelated to data collection.

Conclusion The Investigation Package provides the required data with zero manual scripting or command entry, making it the correct first step for efficient forensic collection.

Exam Strategy

When a scenario emphasizes 'minimal effort' or 'quick collection' of standard forensic artifacts, prioritize built-in automated tools like Investigation Packages over manual interactive sessions like Live Response. Always check if the requirement specifies automation versus manual intervention.

Frequently Asked Questions

What does an Investigation Package include?

It collects running processes, active network connections, installed programs, scheduled tasks, services, and relevant event logs from the endpoint.

When should I use Live Response instead?

Use Live Response when you need to perform specific, ad-hoc commands or interact with the system in real-time to investigate complex, non-standard scenarios.

More SC-200 FAQ →

Discussion 2 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 2

  1. Afrrahh 👍 1 Answered D
    Repeated Question Answer: D. Collect an investigation package. Why? The investigation package is a built-in device response action that gathers forensic data from the device, including the running processes and active network connections. It also collects autoruns, installed programs, scheduled tasks, services, and event logs. That meets the first requirement. It’s a single action from the device page, and the package can be downloaded afterward. That meets the “minimize administrative effort” requirement. It’s available with Defender for Endpoint Plan 1, which is the license in this scenario. Why not C. Initiate a live response session: Live response is a Defender for Endpoint Plan 2 capability, so it isn’t available with Plan 1. Even with Plan 2, it requires manually running commands, which takes more effort than collecting a package.
  2. shuny 👍 1 Answered D
    D is correct for minimize effort

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Creating a Microsoft Sentinel bookmark from the Hunting page to support an incident investigation

S-grade

Containing a Defender for Identity pass-the-ticket alert by quarantining only the affected device

S-grade

Limiting Microsoft Defender device discovery to specific onboarded devices by creating a device tag first

S-grade

Assigning the Microsoft Sentinel Responder role so a user can investigate incidents under least privilege

S-grade

Practice All SC-200 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-200 Practice Test →

← Back to SC-200 Study Guide