Submitting only PE files for Microsoft Defender XDR deep analysis

Respond to alerts and incidents in Microsoft Defender XDR
Answer Correct answer: D — Deep analysis only supports PE files (.exe, .dll), so File2.exe and File3.dll can be submitted; the .ps1 script cannot.

You have a Microsoft 365 subscription that uses Microsoft Defender XDR and contains a Windows device named Device1. The timeline of Device1 includes three files named File1.ps1, File2.exe, and File3.dll. You need to submit files for deep analysis in Microsoft Defender XDR. Which files can you submit?

  1. File1.ps1 only
  2. File2.exe only
  3. File3.dll only
  4. File2.exe and File3.dll only Correct Answer
  5. File1.ps1 and File2.exe only
defender xdr deep analysis pe files exe dll powershell ps1 not supported

Community Votes

D
100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

Defender XDR deep analysis is limited to PE files (.exe, .dll), so File2.exe and File3.dll qualify while the .ps1 PowerShell script does not, regardless of whether the script is signed.

In Microsoft Defender XDR deep analysis, only portable executable (PE) files (.exe and .dll) are supported; the PowerShell script File1.ps1 is not a PE file, so only File2.exe and File3.dll can be submitted for deep analysis.

Including the .ps1 PowerShell script — deep analysis does not support script files, only PE files, so File1.ps1 cannot be submitted even though it is signed.

Community Discussion (5 comments)

rsanx42 👍 10 Selected: D
Correct. Deep analysis currently supports extensive analysis of portable executable (PE) files (including .exe and .dll files). PE files typically have .exe or .dll extensions (executable programs or applications). https://learn.microsoft.com/en-us/defender-endpoint/respond-file-alerts#deep-analysis
Itsmebigal 👍 1 Selected: D
I logged into XDR to check this and grabbed a ps1 file. On the DA tab this is the message it shows Submitting file to deep analysis collects the file from the device or from Microsoft sample store if the file already exists. Collecting the file can take up to 3 hours depending on file and device availability. The collected file is analyzed in a secured environment and a detailed report is created.  File type not supported Deep analysis currently supports analysis of portable executable (PE) files (for example, .exe and .dll files).
g_man_rap 👍 1
You need to submit files for deep analysis in Microsoft Defender XDR. PowerShell script files can you submit? Sent by Copilot: Yes, you can submit PowerShell script files for deep analysis in Microsoft Defender XDR.
scfitzp 👍 2 Selected: D
https://learn.microsoft.com/en-us/defender-endpoint/respond-file-alerts#deep-analysis Note Only PE files are supported, including .exe and .dll files.
liveup2it 👍 2
Answer generated by CoPilot: In Microsoft Defender XDR, the following file types can be submitted for deep analysis: • Executable files (.exe, .dll) • Document files (.doc, .docx, .xls, .xlsx, .ppt, .pptx) • PDF files (.pdf) • Script files (.js, .vbs, .ps1) • Archive files (.zip, .rar, .tar, .gz) Please note that the ability to submit a file for deep analysis does not guarantee that meaningful results will be obtained for all file types. The effectiveness of deep analysis can vary depending on the specific characteristics of each file type.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Why the Answer Is Correct

Microsoft Defender XDR (and Defender for Endpoint) deep analysis supports extensive analysis of portable executable (PE) files, which have.exe and.dll extensions. PowerShell scripts (.ps1) are not PE files and are not supported for deep analysis, so among File1.ps1, File2.exe, and File3.dll, only the two PE files (File2.exe and File3.dll) can be submitted.

Why the Other Options Are Wrong

Any option that includes File1.ps1 (A or E) is incorrect because.ps1 scripts are not eligible for deep analysis. Options that omit one of the two PE files (B, C) are incomplete.

Community Comment Notes

The community is unanimous (D 100). rsanx42 (10 likes) and scfitzp cite the respond-file-alerts deep-analysis documentation, confirming only PE files (.exe/.dll) are supported. liveup2it's Copilot answer incorrectly claims.ps1 is supported, but the documented behavior restricts deep analysis to PE files.

Official Reference

https://learn.microsoft.com/en-us/defender-endpoint/respond-file-alerts

Related Analysis

You have a Microsoft Sentinel workspace that contains a cust

A-Grade

You have a Microsoft 365 subscription that uses Microsoft De

S-Grade

You have an Azure subscription named Sub1 that uses Microsof

A-Grade

Practice All SC-200 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-200 Practice Test →

← Back to SC-200 Study Guide