SC-200 Practice Question 3746
Exam: SC-200
Domain: Respond to security incidents
Difficulty: medium
During an incident investigation in Defender for Endpoint, you need to connect directly to a remote compromised workstation to run PowerShell inspection commands, download forensic artifacts, and terminate rogue processes. Which feature provides this?
Answer Options
A
Live Response
B
Remote Desktop Protocol (RDP)
C
Quick Assist over internet
D
Telnet session on port 23
Correct Answer
A: Live Response
Explanation
Live Response provides security analysts with an interactive remote command-line shell to an active endpoint to conduct forensic collection, script execution, and process termination.