Uploading a signed PowerShell script to the live response library before running it

SC-200 By islever Editorial Last updated

Respond to alerts and incidents in Microsoft Defender for Endpoint

Short answer

B A script must be uploaded to the live response library before it can be run in a session.

Question

You have a Microsoft 365 subscription that uses Microsoft Defender for Endpoint Plan 2 and contains 1,000 Windows devices. You have a PowerShell script named Script1.ps1 that is signed digitally. You need to ensure that you can run Script1.ps1 in a live response session on one of the devices. What should you do first from the live response session?
  1. Run the library command.
  2. Upload Script1.ps1 to the library. Correct Answer
  3. Run the putfile command.
  4. Modify the PowerShell execution policy of the device.

Key Takeaways

Defender for Endpoint live response requires scripts to be uploaded to the library before they can be executed; the putfile command or the library upload is the first step, after which the script can be run on the device.

To run a digitally signed PowerShell script in a Defender for Endpoint live response session, you must first upload the script to the live response library (using putfile or the library upload), because scripts cannot be run directly from the session without being in the library.

Common mistake: Trying to run or putfile directly without first uploading to the library — the script must reside in the library before it can be invoked in a live response session.

Expert Analysis

Why the Answer Is Correct

In Microsoft Defender for Endpoint live response, scripts must be added to the live response library before they can be run on a device. The first step is therefore to upload Script1.ps1 to the library (via the library upload or the putfile command), after which it can be executed in the session. The signing status does not remove the library requirement.

Why the Other Options Are Wrong

Running the library command (A) assumes the script is already in the library. The putfile command (C) is the mechanism to place a file in the library, but the conceptual step is uploading to the library first. Modifying the device's PowerShell execution policy (D) is unrelated to the library requirement for live response scripts.

Community Comment Notes

The community is unanimous (B 100). ServerBrain and brichardson14 cite the live-response documentation, confirming that uploading the script to the library is the prerequisite before running it in a live response session.

Official Reference

https://learn.microsoft.com/en-us/defender-endpoint/live-response

This link opens the official vendor documentation in a new tab.

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. ServerBrain 👍 5 Answered B
    Upload Script1.ps1 to the library:
  2. brichardson14 👍 2 Answered B
    https://learn.microsoft.com/en-us/defender-endpoint/live-response#put-a-file-in-the-library
  3. smanzana 👍 1
    First upload it to the library
  4. sapphire 👍 1 Answered B
    Correct answer

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Creating a Microsoft Sentinel bookmark from the Hunting page to support an incident investigation

S-grade

Identifying Affected Entities in Microsoft Defender XDR Incidents

S-grade

Containing a Defender for Identity pass-the-ticket alert by quarantining only the affected device

S-grade

Limiting Microsoft Defender device discovery to specific onboarded devices by creating a device tag first

S-grade

Practice All SC-200 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-200 Practice Test →

← Back to SC-200 Study Guide