SC-200 Question 27

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• 1

  Turn on Live Response Live Response is the Defender for Endpoint feature that gives responders a remote shell connection to a device from the Defender portal. It is turned on under Settings > Endpoints > Advanced features. Without it, the "Initiate live response session" option doesn't appear. Device group with Automation level set to "No automated response" Live Response requires the devices to be in a device group, and the group's remediation (automation) level can't be "No remediation" in the way people often assume. In the exam's wording, the group with No automated response is the expected pick. It is the least privileged choice, because it doesn't give Defender permission to investigate and remediate automatically, and only the people who connect through the remote shell take actions.

• 1

  "Least Privilege," so "no automated response," as you just want to remote shell. These two are independent features.

• 4

  The best combination would be: *Turn on Live Response – This directly enables remote shell access, allowing security teams to investigate devices and respond to threats from the Microsoft 365 Defender portal. *Create a Device Group that contains the devices and set Automation to No Automated Response – This ensures that security teams can interact with devices manually rather than relying on automated remediation, which aligns with the principle of least privilege by preventing unnecessary system-wide actions