Task 2.2: Respond to alerts and incidents in Microsoft Defender for Endpoint

• AFull isolation, then add the proxy to network isolation exclusions after release fails

  Incorrect

  Full isolation is what might not recover in proxy environments.

• BContain device from the device page

  Incorrect

  Contain device doesn't isolate the laptop itself, so it doesn't meet the requirement.

• CRestrict app execution instead of isolating

  Incorrect

  Restricting apps doesn't cut the device off the network.

• DSelective isolation

  Correct

  Selective isolation is recommended where devices use web proxies, and needs no exclusions for this.

In environments with web proxies, including PAC, WPAD and static proxies, devices might not recover from network isolation. Microsoft recommends selective isolation there, which doesn't need exclusion settings to avoid the problem.

• AThe script stored on a file share that the session can reach

  Incorrect

  Scripts run from the live response library, not from a share.

• BLive response for servers turned on

  Incorrect

  That setting matters for servers; the target is a workstation.

• CThe script uploaded to the live response library

  Correct

  A script must be in the library before the run command can use it.

• DAllow unsigned script execution turned on in Advanced features

  Correct

  Unsigned PowerShell scripts need this setting.

• EAn investigation package collected before the session

  Incorrect

  A package isn't a prerequisite for running scripts.

Before you run a PowerShell or Bash script in live response, upload it to the library, then use the run command. Unsigned PowerShell scripts also require Allow unsigned script execution in the Advanced features page.

• AIsolate device

  Incorrect

  Isolation runs on the device itself, which needs the Defender agent.

• BRun antivirus scan

  Incorrect

  A scan also needs Defender on the device.

• CContain device

  Correct

  Onboarded devices then block incoming and outgoing communication with the contained device.

• DCollect investigation package

  Incorrect

  Collection needs the agent and doesn't stop the spread.

Contain device is meant for unmanaged devices that are compromised: every onboarded Defender for Endpoint device blocks communication with the contained device. If its IP address changes, onboarded devices block the new address.

• AExtend the timeline's date filter to 30 days and export again

  Incorrect

  Timeline exports cover up to seven days at a time.

• BRun an advanced hunting query over the device's tables for 30 days and export the results

  Correct

  Advanced hunting covers 30 days of Defender data and exports query results.

• CCollect an investigation package and export its security event log

  Incorrect

  The package holds a point-in-time snapshot, not the device's EDR events.

• DFlag every event in the timeline and export flagged events only

  Incorrect

  Flagged exports still follow the timeline export limit.

The device timeline can export detailed events for a date range of up to seven days. For a longer period, use advanced hunting, which holds 30 days of raw Defender XDR data, and export the query results.

• AInstalled programs

  Incorrect

  It lists installed software, not what ran or was deleted.

• BScheduled tasks

  Correct

  It lists scheduled tasks, which reveal code set to run automatically.

• CPrefetch files

  Correct

  Prefetch tracks recently used files, including apps that were deleted.

• DUsers and Groups

  Incorrect

  It lists group membership, not execution.

• ESystem Information

  Incorrect

  It shows OS version and network cards.

The Windows investigation package includes Scheduled tasks (a CSV of tasks that run automatically) and Prefetch files, which help track files recently used on the system and traces of applications that might have been deleted. Autoruns covers registry auto-start points.

• AThe Global Administrator role, then Undo on the action in the Action center

  Correct

  Undoing contain user actions requires Global Administrator.

• BRelease from isolation on the user's device

  Incorrect

  The user is contained across devices; the device isn't isolated.

• CRe-enable the account in Microsoft Entra ID

  Incorrect

  Contain user works at the endpoint layer and doesn't disable the account.

• DAdd the user to the attack disruption identity exclusions

  Incorrect

  Exclusions keep future automatic actions off the user; they don't release an action already applied.

Contain user blocks the identity at the endpoint layer on onboarded devices without disabling the account. It's applied automatically by attack disruption. To release it, select the action in the Action center (or the user) and select Undo, which requires Global Administrator.

• AThe past 24 hours

  Incorrect

  You can filter to a day, but it isn't the default.

• BThe past seven days

  Incorrect

  The default view covers a longer period.

• CThe past 30 days

  Correct

  By default, the device timeline displays events from the past 30 days.

• DEverything since the device was onboarded

  Incorrect

  The view is limited to a time range.

By default, the device timeline displays events from the past 30 days. You can pick the past day, week, 30 days or a custom range.

• AFiles allowed by your file indicators

  Incorrect

  The restriction uses a code integrity policy, not your indicators.

• BFiles that Defender Antivirus scanned as clean

  Incorrect

  Scan results don't decide what runs under the restriction.

• CFiles run by administrators

  Incorrect

  The policy applies regardless of who runs the file.

• DFiles signed by a Microsoft-issued certificate

  Correct

  The code integrity policy allows only Microsoft-signed files.

Restrict app execution applies a code integrity policy that allows files to run only if they're signed by a Microsoft-issued certificate. You can reverse it with Remove app restrictions.

• A30 minutes

  Correct

  The live response session inactive timeout is 30 minutes.

• B10 minutes

  Incorrect

  Ten minutes is the time limit for most single commands.

• C24 hours

  Incorrect

  Sessions time out far sooner when inactive.

• DSessions never time out

  Incorrect

  Inactive sessions do time out.

Live response sessions time out after 30 minutes of inactivity. Most commands have a 10-minute limit, and getfile, findfile and run have 30 minutes.

• ANo; the action needs Defender Antivirus in active mode

  Incorrect

  The scan can run alongside other antivirus solutions.

• BYes; choose a quick or full scan

  Correct

  A Defender Antivirus scan can run in passive mode, as quick or full.

• CYes, but only a custom scan of one folder

  Incorrect

  The options are quick and full.

• DOnly from live response, not from the device page

  Incorrect

  The device page offers the action directly.

Run antivirus scan remotely starts a quick or full Microsoft Defender Antivirus scan. It can run alongside other antivirus solutions, with Defender Antivirus in passive mode, and results appear in the Action center and as alerts.