Reviewing Prefetch files in the investigation package to find first and last execution times of an executable

Respond to alerts and incidents in Microsoft Defender for Endpoint
Answer Correct answer: E — Prefetch files record each executable's first and last run times, so they identify when File1.exe executed.

You have a Microsoft 365 E5 subscription that contains a device named Device1. Device1 is enrolled in Microsoft Defender for Endpoint. Device1 reports an incident that includes a file named File1.exe as evidence. You initiate the Collect Investigation Package action and download the ZIP file. You need to identify the first and last time File1.exe was executed. What should you review in the investigation package?

  1. Processes
  2. Autoruns
  3. Security event log
  4. Scheduled tasks
  5. Prefetch files Correct Answer
defender investigation package prefetch files execution time collect investigation package

Community Votes

E
64%
C
18%
A
18%

64% of anonymous learners picked answer E. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

Windows Prefetch files capture the run history of executables, including the first and last execution timestamps and run count, which is precisely what the question asks for.

After collecting a Defender for Endpoint investigation package, you need the first and last execution time of File1.exe; the Prefetch files in the package record exactly when each executable was run, making them the right artifact to review.

Reviewing the Security event log or Processes instead — those show current/live process activity or audit events but do not directly record the first and last execution times of a file the way Prefetch does.

Community Discussion (8 comments)

wheeldj 👍 10
Definitely E To identify the first and last time that File1.exe was executed on Device1, you should review the Prefetch files in the investigation package. Prefetch files in Windows are designed to speed up the application launch process and contain information about how often and when a particular application is run. This data can be used to determine the execution history of File1.exe. https://learn.microsoft.com/en-us/defender-endpoint/respond-machine-alerts#collect-investigation-package-from-devices
281f173 👍 5 Selected: E
Prefetch files record the first and last times an executable has been run, the name and the path it was executed from, how many times it has been executed
sapphire 👍 1 Selected: E
https://learn.microsoft.com/en-us/defender-endpoint/respond-machine-alerts#collect-investigation-package-from-devices
sapphire 👍 1
E is correct - https://learn.microsoft.com/en-us/defender-endpoint/respond-machine-alerts#collect-investigation-package-from-devices
g_man_rap 👍 1 Selected: E
Prefetch files (Option E): These files are created by the Windows operating system to speed up the startup of applications. Each time an executable file runs, Windows records the launch in the prefetch data. The prefetch file for a specific executable will include information about the first time and the last time the executable was run. By analyzing the prefetch file for File1.exe, you can determine the exact timestamps of its first and most recent executions.
ServerBrain 👍 2 Selected: A
To identify the first and last time the File1.exe was executed, you should review the Processes information in the investigation package. Collect Investigation Package: By collecting the investigation package, you can understand the current state of the device and further investigate the tools and techniques used by the attacker. The package includes relevant data and logs related to the incident, which can help you analyze events and activities on the device. Processes: The Processes section provides details about running processes on the device. You can look for entries related to File1.exe to determine when it was first and last executed. Pay attention to timestamps, process names, and any associated events.
DChilds 👍 2
A https://learn.microsoft.com/en-us/defender-endpoint/investigate-files?view=o365-worldwide#devices
pk69 👍 2 Selected: C
Security event log

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Why the Answer Is Correct

The investigation package's Prefetch files are Windows artifacts that record how often and when a particular executable was launched, including its first and last run times and the path it executed from. To determine the first and last time File1.exe ran on Device1, the Prefetch files are the authoritative source.

Why the Other Options Are Wrong

Processes (A) and Scheduled tasks (D) show currently running or configured automation, not historical first/last execution. The Security event log (C) records audit events but does not aggregate first/last execution times per executable. Autoruns (B) lists persistence mechanisms, not execution history.

Community Comment Notes

wheeldj (10 likes) and 281f173 both confirm E, noting Prefetch records first/last run times, execution count, and path. g_man_rap details that the prefetch file for a specific executable includes the first and last execution timestamps. sapphire cites the collect-investigation-package documentation.

Official Reference

https://learn.microsoft.com/en-us/defender-endpoint/respond-machine-alerts

Related Analysis

You have a Microsoft 365 subscription that uses Microsoft De

A-Grade

You have a Microsoft 365 subscription that uses Microsoft De

S-Grade

You have a Microsoft Sentinel workspace. You are investigati

S-Grade

Practice All SC-200 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-200 Practice Test →

← Back to SC-200 Study Guide