Submitting only PE files for Microsoft Defender XDR deep analysis

SC-200 By islever Editorial Last updated

Respond to alerts and incidents in Microsoft Defender XDR

Short answer

D Deep analysis only supports PE files (.exe, .dll), so File2.exe and File3.dll can be submitted; the .ps1 script cannot.

Question

You have a Microsoft 365 subscription that uses Microsoft Defender XDR and contains a Windows device named Device1. The timeline of Device1 includes three files named File1.ps1, File2.exe, and File3.dll. You need to submit files for deep analysis in Microsoft Defender XDR. Which files can you submit?
  1. File1.ps1 only
  2. File2.exe only
  3. File3.dll only
  4. File2.exe and File3.dll only Correct Answer
  5. File1.ps1 and File2.exe only

Key Takeaways

Defender XDR deep analysis is limited to PE files (.exe, .dll), so File2.exe and File3.dll qualify while the .ps1 PowerShell script does not, regardless of whether the script is signed.

In Microsoft Defender XDR deep analysis, only portable executable (PE) files (.exe and .dll) are supported; the PowerShell script File1.ps1 is not a PE file, so only File2.exe and File3.dll can be submitted for deep analysis.

Common mistake: Including the .ps1 PowerShell script — deep analysis does not support script files, only PE files, so File1.ps1 cannot be submitted even though it is signed.

Expert Analysis

Why the Answer Is Correct

Microsoft Defender XDR (and Defender for Endpoint) deep analysis supports extensive analysis of portable executable (PE) files, which have.exe and.dll extensions. PowerShell scripts (.ps1) are not PE files and are not supported for deep analysis, so among File1.ps1, File2.exe, and File3.dll, only the two PE files (File2.exe and File3.dll) can be submitted.

Why the Other Options Are Wrong

Any option that includes File1.ps1 (A or E) is incorrect because.ps1 scripts are not eligible for deep analysis. Options that omit one of the two PE files (B, C) are incomplete.

Community Comment Notes

The community is unanimous (D 100). rsanx42 (10 likes) and scfitzp cite the respond-file-alerts deep-analysis documentation, confirming only PE files (.exe/.dll) are supported. liveup2it's Copilot answer incorrectly claims.ps1 is supported, but the documented behavior restricts deep analysis to PE files.

Official Reference

https://learn.microsoft.com/en-us/defender-endpoint/respond-file-alerts

This link opens the official vendor documentation in a new tab.

Community Votes

D
100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

  1. rsanx42 👍 10 Answered D
    Correct. Deep analysis currently supports extensive analysis of portable executable (PE) files (including .exe and .dll files). PE files typically have .exe or .dll extensions (executable programs or applications). https://learn.microsoft.com/en-us/defender-endpoint/respond-file-alerts#deep-analysis
  2. liveup2it 👍 2
    Answer generated by CoPilot: In Microsoft Defender XDR, the following file types can be submitted for deep analysis: • Executable files (.exe, .dll) • Document files (.doc, .docx, .xls, .xlsx, .ppt, .pptx) • PDF files (.pdf) • Script files (.js, .vbs, .ps1) • Archive files (.zip, .rar, .tar, .gz) Please note that the ability to submit a file for deep analysis does not guarantee that meaningful results will be obtained for all file types. The effectiveness of deep analysis can vary depending on the specific characteristics of each file type.
  3. scfitzp 👍 2 Answered D
    https://learn.microsoft.com/en-us/defender-endpoint/respond-file-alerts#deep-analysis Note Only PE files are supported, including .exe and .dll files.
  4. Itsmebigal 👍 1 Answered D
    I logged into XDR to check this and grabbed a ps1 file. On the DA tab this is the message it shows Submitting file to deep analysis collects the file from the device or from Microsoft sample store if the file already exists. Collecting the file can take up to 3 hours depending on file and device availability. The collected file is analyzed in a secured environment and a detailed report is created.  File type not supported Deep analysis currently supports analysis of portable executable (PE) files (for example, .exe and .dll files).
  5. g_man_rap 👍 1
    You need to submit files for deep analysis in Microsoft Defender XDR. PowerShell script files can you submit? Sent by Copilot: Yes, you can submit PowerShell script files for deep analysis in Microsoft Defender XDR.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Creating a Microsoft Sentinel bookmark from the Hunting page to support an incident investigation

S-grade

Identifying Affected Entities in Microsoft Defender XDR Incidents

S-grade

Containing a Defender for Identity pass-the-ticket alert by quarantining only the affected device

S-grade

Limiting Microsoft Defender device discovery to specific onboarded devices by creating a device tag first

S-grade

Practice All SC-200 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-200 Practice Test →

← Back to SC-200 Study Guide