Uploading a signed PowerShell script to the live response library before running it

Respond to alerts and incidents in Microsoft Defender for Endpoint
Answer Correct answer: B — A script must be uploaded to the live response library before it can be run in a session.

You have a Microsoft 365 subscription that uses Microsoft Defender for Endpoint Plan 2 and contains 1,000 Windows devices. You have a PowerShell script named Script1.ps1 that is signed digitally. You need to ensure that you can run Script1.ps1 in a live response session on one of the devices. What should you do first from the live response session?

  1. Run the library command.
  2. Upload Script1.ps1 to the library. Correct Answer
  3. Run the putfile command.
  4. Modify the PowerShell execution policy of the device.
defender live response library upload script putfile run powershell script

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

Defender for Endpoint live response requires scripts to be uploaded to the library before they can be executed; the putfile command or the library upload is the first step, after which the script can be run on the device.

To run a digitally signed PowerShell script in a Defender for Endpoint live response session, you must first upload the script to the live response library (using putfile or the library upload), because scripts cannot be run directly from the session without being in the library.

Trying to run or putfile directly without first uploading to the library — the script must reside in the library before it can be invoked in a live response session.

Community Discussion (4 comments)

ServerBrain 👍 5 Selected: B
Upload Script1.ps1 to the library:
sapphire 👍 1 Selected: B
Correct answer
smanzana 👍 1
First upload it to the library
brichardson14 👍 2 Selected: B
https://learn.microsoft.com/en-us/defender-endpoint/live-response#put-a-file-in-the-library

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Why the Answer Is Correct

In Microsoft Defender for Endpoint live response, scripts must be added to the live response library before they can be run on a device. The first step is therefore to upload Script1.ps1 to the library (via the library upload or the putfile command), after which it can be executed in the session. The signing status does not remove the library requirement.

Why the Other Options Are Wrong

Running the library command (A) assumes the script is already in the library. The putfile command (C) is the mechanism to place a file in the library, but the conceptual step is uploading to the library first. Modifying the device's PowerShell execution policy (D) is unrelated to the library requirement for live response scripts.

Community Comment Notes

The community is unanimous (B 100). ServerBrain and brichardson14 cite the live-response documentation, confirming that uploading the script to the library is the prerequisite before running it in a live response session.

Official Reference

https://learn.microsoft.com/en-us/defender-endpoint/live-response

Related Analysis

You have 500 on-premises devices. You have a Microsoft 365 E

S-Grade

You have a Microsoft Sentinel workspace. You are investigati

S-Grade

You have a Microsoft 365 subscription that uses Microsoft De

A-Grade

Practice All SC-200 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-200 Practice Test →

← Back to SC-200 Study Guide