Discuss Microsoft SC-200 Exam Topic 3 Question 85

You have a Microsoft 365 E5 subscription that contains a device named Device 1. Device 1 is enrolled in Microsoft Defender for End point.

Device1 reports an incident that includes a file named File1 exe as evidence.

You initiate the Collect Investigation Package action and download the ZIP file.

You need to identify the first and last time File1.exe was executed.

What should you review in the investigation package?

Suggested Answer: E

Get Premium SC-200 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

39 comments · newest first

Ora 11 months ago

Wait, I thought autoruns were the best way to track this stuff?

Annita 11 months ago

Prefetch files can also give you execution info, don't forget that!

Nana 11 months ago

I'm not so sure about that, what if it was a scheduled task?

Major 12 months ago

Definitely, that's where all the execution data is stored!

Laila 12 months ago

You should check the Security event log for execution times.

Adela 1 year ago

I feel like Scheduled tasks might not be the right choice here, but I can't recall if they could show execution times. I think I’d lean towards the Security event log instead.

Lucina 1 year ago

I practiced a similar question where we had to analyze processes. Maybe checking the Processes section could help us find when File1.exe was active?

Elmer 1 year ago

I'm not entirely sure, but I remember something about Prefetch files being useful for tracking execution history. Could they show us the first and last run times?

Bulah 1 year ago

I think we might need to look at the Security event log to find the execution times for File1.exe. That seems to be where execution events are logged.

Charlene 1 year ago

This seems straightforward to me. The security event log is where Windows records application execution, so that's where I'd look to find the first and last run times for File1.exe. I'm confident that's the right approach.

Regenia 1 year ago

I'm a bit confused by this question. The investigation package seems like it might have some specialized information, but I'm not sure which section would be the most relevant. I think I'll have to review the Processes, Autoruns, and Security event log to see which one provides the best information.

Vanesa 1 year ago

Okay, let's think this through. The question is asking about identifying the first and last time File1.exe was executed. That sounds like it would be in the process history, so I'm going to go with Processes as my answer.

Alesia 1 year ago

Hmm, I'm not sure about this one. The question mentions an investigation package, so I'm wondering if the answer might be something specific to that package, like the Processes or Autoruns sections.

Cathrine 1 year ago

I think the security event log would be the best place to look for the execution times of File1.exe. The event log should have records of when the file was run.

Fletcher 2 years ago

Ah, the security event log, the all-knowing, all-seeing oracle of IT. If this was a crime scene, it would be the one witness that never lies. Option D, without a doubt!

Fernanda 2 years ago

↳ replying to Fletcher

D) Security event log

Thad 2 years ago

↳ replying to Fletcher

Definitely the Security event log, it's the key to solving this mystery.

Leah 2 years ago

↳ replying to Fletcher

E) Prefetch files

Beckie 2 years ago

↳ replying to Fletcher

D) Security event log

Willard 2 years ago

↳ replying to Fletcher

C) Autoruns

Arlie 2 years ago

↳ replying to Fletcher

B) Scheduled tasks

Alishia 2 years ago

↳ replying to Fletcher

A) Processes

Gladys 2 years ago

I bet the person who came up with 'Scheduled tasks' as an option is the same one who thought Microsoft Bob was a good idea. Security event log is the way to go, my friends.

Nieves 2 years ago

Hmm, let's see. Autoruns might show some interesting stuff, but for a specific file, the event log is the obvious choice. This is like security incident investigation 101.

Darrel 2 years ago

↳ replying to Nieves

Let's check the Security event log in the investigation package.

Royce 2 years ago

↳ replying to Nieves

Agreed, that's where we can find the first and last time File1.exe was executed.

Odette 2 years ago

↳ replying to Nieves

I think we should review the Security event log.

Micaela 2 years ago

I believe we should also check the security event log for more information.

Bulah 2 years ago

I agree with Terrilyn, processes can help us identify when File1.exe was executed.

Dierdre 2 years ago

Seriously? Prefetch files? What is this, Windows XP? As if those would give you any useful info about a security incident. Option D all the way!

Carman 2 years ago

↳ replying to Dierdre

Definitely, Security event log will provide the most accurate information about the execution of File1.exe.

Ilona 2 years ago

↳ replying to Dierdre

Yeah, Security event log is more reliable for identifying when File1.exe was executed.

Glendora 2 years ago

↳ replying to Dierdre

I agree, Prefetch files are outdated. Security event log is the way to go.

Mari 2 years ago

The security event log is the way to go! If there's a file associated with an incident, the event log is where you'll find the execution details. This is a no-brainer for any security-savvy admin.

Broderick 2 years ago

↳ replying to Mari

D) Security event log

Chi 2 years ago

↳ replying to Mari

C) Autoruns

Leeann 2 years ago

↳ replying to Mari

B) Scheduled tasks

Penney 2 years ago

↳ replying to Mari

A) Processes

Terrilyn 2 years ago

I think we should review the processes in the investigation package.

Microsoft SC-200 Exam - Topic 3 Question 85 Discussion