Reviewing Prefetch files in the investigation package to find first and last execution times of an executable

SC-200 By islever Editorial Last updated

Respond to alerts and incidents in Microsoft Defender for Endpoint

Short answer

E Prefetch files record each executable's first and last run times, so they identify when File1.exe executed.

Question

You have a Microsoft 365 E5 subscription that contains a device named Device1. Device1 is enrolled in Microsoft Defender for Endpoint. Device1 reports an incident that includes a file named File1.exe as evidence. You initiate the Collect Investigation Package action and download the ZIP file. You need to identify the first and last time File1.exe was executed. What should you review in the investigation package?
  1. Processes
  2. Autoruns
  3. Security event log
  4. Scheduled tasks
  5. Prefetch files Correct Answer

Key Takeaways

Windows Prefetch files capture the run history of executables, including the first and last execution timestamps and run count, which is precisely what the question asks for.

After collecting a Defender for Endpoint investigation package, you need the first and last execution time of File1.exe; the Prefetch files in the package record exactly when each executable was run, making them the right artifact to review.

Common mistake: Reviewing the Security event log or Processes instead — those show current/live process activity or audit events but do not directly record the first and last execution times of a file the way Prefetch does.

Expert Analysis

Why the Answer Is Correct

The investigation package's Prefetch files are Windows artifacts that record how often and when a particular executable was launched, including its first and last run times and the path it executed from. To determine the first and last time File1.exe ran on Device1, the Prefetch files are the authoritative source.

Why the Other Options Are Wrong

Processes (A) and Scheduled tasks (D) show currently running or configured automation, not historical first/last execution. The Security event log (C) records audit events but does not aggregate first/last execution times per executable. Autoruns (B) lists persistence mechanisms, not execution history.

Community Comment Notes

wheeldj (10 likes) and 281f173 both confirm E, noting Prefetch records first/last run times, execution count, and path. g_man_rap details that the prefetch file for a specific executable includes the first and last execution timestamps. sapphire cites the collect-investigation-package documentation.

Official Reference

https://learn.microsoft.com/en-us/defender-endpoint/respond-machine-alerts

This link opens the official vendor documentation in a new tab.

Community Votes

E
64%
C
18%
A
18%

64% of anonymous learners picked answer E. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 8 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 8

  1. wheeldj 👍 10
    Definitely E To identify the first and last time that File1.exe was executed on Device1, you should review the Prefetch files in the investigation package. Prefetch files in Windows are designed to speed up the application launch process and contain information about how often and when a particular application is run. This data can be used to determine the execution history of File1.exe. https://learn.microsoft.com/en-us/defender-endpoint/respond-machine-alerts#collect-investigation-package-from-devices
  2. 281f173 👍 5 Answered E
    Prefetch files record the first and last times an executable has been run, the name and the path it was executed from, how many times it has been executed
  3. ServerBrain 👍 2 Answered A
    To identify the first and last time the File1.exe was executed, you should review the Processes information in the investigation package. Collect Investigation Package: By collecting the investigation package, you can understand the current state of the device and further investigate the tools and techniques used by the attacker. The package includes relevant data and logs related to the incident, which can help you analyze events and activities on the device. Processes: The Processes section provides details about running processes on the device. You can look for entries related to File1.exe to determine when it was first and last executed. Pay attention to timestamps, process names, and any associated events.
  4. DChilds 👍 2
    A https://learn.microsoft.com/en-us/defender-endpoint/investigate-files?view=o365-worldwide#devices
  5. g_man_rap 👍 1 Answered E
    Prefetch files (Option E): These files are created by the Windows operating system to speed up the startup of applications. Each time an executable file runs, Windows records the launch in the prefetch data. The prefetch file for a specific executable will include information about the first time and the last time the executable was run. By analyzing the prefetch file for File1.exe, you can determine the exact timestamps of its first and most recent executions.
Show 3 more comments
  1. sapphire 👍 1
    E is correct - https://learn.microsoft.com/en-us/defender-endpoint/respond-machine-alerts#collect-investigation-package-from-devices
  2. sapphire 👍 1 Answered E
    https://learn.microsoft.com/en-us/defender-endpoint/respond-machine-alerts#collect-investigation-package-from-devices
  3. pk69 👍 2 Answered C
    Security event log

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Creating a Microsoft Sentinel bookmark from the Hunting page to support an incident investigation

S-grade

Identifying Affected Entities in Microsoft Defender XDR Incidents

S-grade

Containing a Defender for Identity pass-the-ticket alert by quarantining only the affected device

S-grade

Limiting Microsoft Defender device discovery to specific onboarded devices by creating a device tag first

S-grade

Practice All SC-200 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-200 Practice Test →

← Back to SC-200 Study Guide